diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1081_linux-4.19.82.patch | 5814 |
2 files changed, 5818 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 3811a861..3a289a88 100644 --- a/0000_README +++ b/0000_README @@ -363,6 +363,10 @@ Patch: 1080_linux-4.19.81.patch From: https://www.kernel.org Desc: Linux 4.19.81 +Patch: 1081_linux-4.19.82.patch +From: https://www.kernel.org +Desc: Linux 4.19.82 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1081_linux-4.19.82.patch b/1081_linux-4.19.82.patch new file mode 100644 index 00000000..a9bb6a1b --- /dev/null +++ b/1081_linux-4.19.82.patch @@ -0,0 +1,5814 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 16607b178b47..a855f83defa6 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -5117,6 +5117,10 @@ + the unplug protocol + never -- do not unplug even if version check succeeds + ++ xen_legacy_crash [X86,XEN] ++ Crash from Xen panic notifier, without executing late ++ panic() code such as dumping handler. ++ + xen_nopvspin [X86,XEN] + Disables the ticketlock slowpath using Xen PV + optimizations. +diff --git a/Makefile b/Makefile +index 3c146e8d93dc..6af1c13d8753 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 81 ++SUBLEVEL = 82 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S +index 997b02302c31..9328f2010bc1 100644 +--- a/arch/arm/kernel/head-common.S ++++ b/arch/arm/kernel/head-common.S +@@ -72,7 +72,7 @@ ENDPROC(__vet_atags) + * The following fragment of code is executed with the MMU on in MMU mode, + * and uses absolute addresses; this is not position independent. + * +- * r0 = cp#15 control register ++ * r0 = cp#15 control register (exc_ret for M-class) + * r1 = machine ID + * r2 = atags/dtb pointer + * r9 = processor ID +@@ -141,7 +141,8 @@ __mmap_switched_data: + #ifdef CONFIG_CPU_CP15 + .long cr_alignment @ r3 + #else +- .long 0 @ r3 ++M_CLASS(.long exc_ret) @ r3 ++AR_CLASS(.long 0) @ r3 + #endif + .size __mmap_switched_data, . - __mmap_switched_data + +diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S +index cab89479d15e..326a97aa3ea0 100644 +--- a/arch/arm/kernel/head-nommu.S ++++ b/arch/arm/kernel/head-nommu.S +@@ -205,6 +205,8 @@ M_CLASS(streq r3, [r12, #PMSAv8_MAIR1]) + bic r0, r0, #V7M_SCB_CCR_IC + #endif + str r0, [r12, V7M_SCB_CCR] ++ /* Pass exc_ret to __mmap_switched */ ++ mov r0, r10 + #endif /* CONFIG_CPU_CP15 elif CONFIG_CPU_V7M */ + ret lr + ENDPROC(__after_proc_init) +diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S +index 92e84181933a..59d82864c134 100644 +--- a/arch/arm/mm/proc-v7m.S ++++ b/arch/arm/mm/proc-v7m.S +@@ -139,9 +139,8 @@ __v7m_setup_cont: + cpsie i + svc #0 + 1: cpsid i +- ldr r0, =exc_ret +- orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK +- str lr, [r0] ++ /* Calculate exc_ret */ ++ orr r10, lr, #EXC_RET_THREADMODE_PROCESSSTACK + ldmia sp, {r0-r3, r12} + str r5, [r12, #11 * 4] @ restore the original SVC vector entry + mov lr, r6 @ restore LR +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 9b7d5abd04af..fa770c070fdd 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -68,6 +68,7 @@ + #define ARM_CPU_IMP_BRCM 0x42 + #define ARM_CPU_IMP_QCOM 0x51 + #define ARM_CPU_IMP_NVIDIA 0x4E ++#define ARM_CPU_IMP_HISI 0x48 + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -96,6 +97,8 @@ + #define NVIDIA_CPU_PART_DENVER 0x003 + #define NVIDIA_CPU_PART_CARMEL 0x004 + ++#define HISI_CPU_PART_TSV110 0xD01 ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) +@@ -114,6 +117,7 @@ + #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) + #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) + #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) ++#define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) + + #ifndef __ASSEMBLY__ + +diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h +index 78b942c1bea4..e060c2746f36 100644 +--- a/arch/arm64/include/asm/pgtable-prot.h ++++ b/arch/arm64/include/asm/pgtable-prot.h +@@ -43,11 +43,11 @@ + #define PROT_DEFAULT (_PROT_DEFAULT | PTE_MAYBE_NG) + #define PROT_SECT_DEFAULT (_PROT_SECT_DEFAULT | PMD_MAYBE_NG) + +-#define PROT_DEVICE_nGnRnE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE)) +-#define PROT_DEVICE_nGnRE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE)) +-#define PROT_NORMAL_NC (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC)) +-#define PROT_NORMAL_WT (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT)) +-#define PROT_NORMAL (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_DIRTY | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL)) ++#define PROT_DEVICE_nGnRnE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRnE)) ++#define PROT_DEVICE_nGnRE (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_DEVICE_nGnRE)) ++#define PROT_NORMAL_NC (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_NC)) ++#define PROT_NORMAL_WT (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL_WT)) ++#define PROT_NORMAL (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_WRITE | PTE_ATTRINDX(MT_NORMAL)) + + #define PROT_SECT_DEVICE_nGnRE (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_DEVICE_nGnRE)) + #define PROT_SECT_NORMAL (PROT_SECT_DEFAULT | PMD_SECT_PXN | PMD_SECT_UXN | PMD_ATTRINDX(MT_NORMAL)) +@@ -91,8 +91,9 @@ + #define PAGE_S2_DEVICE __pgprot(_PROT_DEFAULT | PAGE_S2_MEMATTR(DEVICE_nGnRE) | PTE_S2_RDONLY | PAGE_S2_XN) + + #define PAGE_NONE __pgprot(((_PAGE_DEFAULT) & ~PTE_VALID) | PTE_PROT_NONE | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN) +-#define PAGE_SHARED __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE) +-#define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_WRITE) ++/* shared+writable pages are clean by default, hence PTE_RDONLY|PTE_WRITE */ ++#define PAGE_SHARED __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN | PTE_WRITE) ++#define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE) + #define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN) + #define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN) + #define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN) +diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c +index 92be1d12d590..39dc98dd78eb 100644 +--- a/arch/arm64/kernel/armv8_deprecated.c ++++ b/arch/arm64/kernel/armv8_deprecated.c +@@ -177,6 +177,9 @@ static void __init register_insn_emulation(struct insn_emulation_ops *ops) + struct insn_emulation *insn; + + insn = kzalloc(sizeof(*insn), GFP_KERNEL); ++ if (!insn) ++ return; ++ + insn->ops = ops; + insn->min = INSN_UNDEF; + +@@ -236,6 +239,8 @@ static void __init register_insn_emulation_sysctl(void) + + insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl), + GFP_KERNEL); ++ if (!insns_sysctl) ++ return; + + raw_spin_lock_irqsave(&insn_emulation_lock, flags); + list_for_each_entry(insn, &insn_emulation, node) { +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index ff5beb59b3dc..220ebfa0ece6 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -906,6 +906,7 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, + MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), ++ MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + { /* sentinel */ } + }; + char const *str = "kpti command line option"; +diff --git a/arch/arm64/kernel/ftrace.c b/arch/arm64/kernel/ftrace.c +index 7eff8afa035f..b6618391be8c 100644 +--- a/arch/arm64/kernel/ftrace.c ++++ b/arch/arm64/kernel/ftrace.c +@@ -119,10 +119,16 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) + + /* + * Ensure updated trampoline is visible to instruction +- * fetch before we patch in the branch. ++ * fetch before we patch in the branch. Although the ++ * architecture doesn't require an IPI in this case, ++ * Neoverse-N1 erratum #1542419 does require one ++ * if the TLB maintenance in module_enable_ro() is ++ * skipped due to rodata_enabled. It doesn't seem worth ++ * it to make it conditional given that this is ++ * certainly not a fast-path. + */ +- __flush_icache_range((unsigned long)&dst[0], +- (unsigned long)&dst[1]); ++ flush_icache_range((unsigned long)&dst[0], ++ (unsigned long)&dst[1]); + } + addr = (unsigned long)dst; + #else /* CONFIG_ARM64_MODULE_PLTS */ +diff --git a/arch/mips/fw/sni/sniprom.c b/arch/mips/fw/sni/sniprom.c +index 8772617b64ce..80112f2298b6 100644 +--- a/arch/mips/fw/sni/sniprom.c ++++ b/arch/mips/fw/sni/sniprom.c +@@ -43,7 +43,7 @@ + + /* O32 stack has to be 8-byte aligned. */ + static u64 o32_stk[4096]; +-#define O32_STK &o32_stk[sizeof(o32_stk)] ++#define O32_STK (&o32_stk[ARRAY_SIZE(o32_stk)]) + + #define __PROM_O32(fun, arg) fun arg __asm__(#fun); \ + __asm__(#fun " = call_o32") +diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h +index 89e9fb7976fe..520ca166cbed 100644 +--- a/arch/mips/include/asm/cmpxchg.h ++++ b/arch/mips/include/asm/cmpxchg.h +@@ -73,8 +73,8 @@ extern unsigned long __xchg_called_with_bad_pointer(void) + extern unsigned long __xchg_small(volatile void *ptr, unsigned long val, + unsigned int size); + +-static inline unsigned long __xchg(volatile void *ptr, unsigned long x, +- int size) ++static __always_inline ++unsigned long __xchg(volatile void *ptr, unsigned long x, int size) + { + switch (size) { + case 1: +@@ -146,8 +146,9 @@ static inline unsigned long __xchg(volatile void *ptr, unsigned long x, + extern unsigned long __cmpxchg_small(volatile void *ptr, unsigned long old, + unsigned long new, unsigned int size); + +-static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old, +- unsigned long new, unsigned int size) ++static __always_inline ++unsigned long __cmpxchg(volatile void *ptr, unsigned long old, ++ unsigned long new, unsigned int size) + { + switch (size) { + case 1: +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index a29fdf8a2e56..232bf5987f91 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -70,6 +70,7 @@ static int change_memblock_state(struct memory_block *mem, void *arg) + return 0; + } + ++/* called with device_hotplug_lock held */ + static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + { + u64 end_pfn = start_pfn + nr_pages - 1; +@@ -110,6 +111,7 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + /* Trace memory needs to be aligned to the size */ + end_pfn = round_down(end_pfn - nr_pages, nr_pages); + ++ lock_device_hotplug(); + for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) { + if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) { + /* +@@ -118,7 +120,6 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + * we never try to remove memory that spans two iomem + * resources. + */ +- lock_device_hotplug(); + end_pfn = base_pfn + nr_pages; + for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) { + remove_memory(nid, pfn << PAGE_SHIFT, bytes); +@@ -127,6 +128,7 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + return base_pfn << PAGE_SHIFT; + } + } ++ unlock_device_hotplug(); + + return 0; + } +diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c +index db09c7022635..fdd9577d1798 100644 +--- a/arch/powerpc/platforms/powernv/smp.c ++++ b/arch/powerpc/platforms/powernv/smp.c +@@ -150,20 +150,25 @@ static int pnv_smp_cpu_disable(void) + return 0; + } + ++static void pnv_flush_interrupts(void) ++{ ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) { ++ if (xive_enabled()) ++ xive_flush_interrupt(); ++ else ++ icp_opal_flush_interrupt(); ++ } else { ++ icp_native_flush_interrupt(); ++ } ++} ++ + static void pnv_smp_cpu_kill_self(void) + { ++ unsigned long srr1, unexpected_mask, wmask; + unsigned int cpu; +- unsigned long srr1, wmask; + u64 lpcr_val; + + /* Standard hot unplug procedure */ +- /* +- * This hard disables local interurpts, ensuring we have no lazy +- * irqs pending. +- */ +- WARN_ON(irqs_disabled()); +- hard_irq_disable(); +- WARN_ON(lazy_irq_pending()); + + idle_task_exit(); + current->active_mm = NULL; /* for sanity */ +@@ -176,6 +181,27 @@ static void pnv_smp_cpu_kill_self(void) + if (cpu_has_feature(CPU_FTR_ARCH_207S)) + wmask = SRR1_WAKEMASK_P8; + ++ /* ++ * This turns the irq soft-disabled state we're called with, into a ++ * hard-disabled state with pending irq_happened interrupts cleared. ++ * ++ * PACA_IRQ_DEC - Decrementer should be ignored. ++ * PACA_IRQ_HMI - Can be ignored, processing is done in real mode. ++ * PACA_IRQ_DBELL, EE, PMI - Unexpected. ++ */ ++ hard_irq_disable(); ++ if (generic_check_cpu_restart(cpu)) ++ goto out; ++ ++ unexpected_mask = ~(PACA_IRQ_DEC | PACA_IRQ_HMI | PACA_IRQ_HARD_DIS); ++ if (local_paca->irq_happened & unexpected_mask) { ++ if (local_paca->irq_happened & PACA_IRQ_EE) ++ pnv_flush_interrupts(); ++ DBG("CPU%d Unexpected exit while offline irq_happened=%lx!\n", ++ cpu, local_paca->irq_happened); ++ } ++ local_paca->irq_happened = PACA_IRQ_HARD_DIS; ++ + /* + * We don't want to take decrementer interrupts while we are + * offline, so clear LPCR:PECE1. We keep PECE2 (and +@@ -201,6 +227,7 @@ static void pnv_smp_cpu_kill_self(void) + + srr1 = pnv_cpu_offline(cpu); + ++ WARN_ON_ONCE(!irqs_disabled()); + WARN_ON(lazy_irq_pending()); + + /* +@@ -216,13 +243,7 @@ static void pnv_smp_cpu_kill_self(void) + */ + if (((srr1 & wmask) == SRR1_WAKEEE) || + ((srr1 & wmask) == SRR1_WAKEHVI)) { +- if (cpu_has_feature(CPU_FTR_ARCH_300)) { +- if (xive_enabled()) +- xive_flush_interrupt(); +- else +- icp_opal_flush_interrupt(); +- } else +- icp_native_flush_interrupt(); ++ pnv_flush_interrupts(); + } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) { + unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER); + asm volatile(PPC_MSGCLR(%0) : : "r" (msg)); +@@ -270,7 +291,7 @@ static void pnv_smp_cpu_kill_self(void) + */ + lpcr_val = mfspr(SPRN_LPCR) | (u64)LPCR_PECE1; + pnv_program_cpu_hotplug_lpcr(cpu, lpcr_val); +- ++out: + DBG("CPU%d coming online...\n", cpu); + } + +diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h +index 5332f628c1ed..40194f8c772a 100644 +--- a/arch/s390/include/asm/uaccess.h ++++ b/arch/s390/include/asm/uaccess.h +@@ -84,7 +84,7 @@ raw_copy_to_user(void __user *to, const void *from, unsigned long n); + __rc; \ + }) + +-static inline int __put_user_fn(void *x, void __user *ptr, unsigned long size) ++static __always_inline int __put_user_fn(void *x, void __user *ptr, unsigned long size) + { + unsigned long spec = 0x010000UL; + int rc; +@@ -114,7 +114,7 @@ static inline int __put_user_fn(void *x, void __user *ptr, unsigned long size) + return rc; + } + +-static inline int __get_user_fn(void *x, const void __user *ptr, unsigned long size) ++static __always_inline int __get_user_fn(void *x, const void __user *ptr, unsigned long size) + { + unsigned long spec = 0x01UL; + int rc; +diff --git a/arch/s390/kernel/idle.c b/arch/s390/kernel/idle.c +index b9d8fe45737a..8f8456816d83 100644 +--- a/arch/s390/kernel/idle.c ++++ b/arch/s390/kernel/idle.c +@@ -69,18 +69,26 @@ DEVICE_ATTR(idle_count, 0444, show_idle_count, NULL); + static ssize_t show_idle_time(struct device *dev, + struct device_attribute *attr, char *buf) + { ++ unsigned long long now, idle_time, idle_enter, idle_exit, in_idle; + struct s390_idle_data *idle = &per_cpu(s390_idle, dev->id); +- unsigned long long now, idle_time, idle_enter, idle_exit; + unsigned int seq; + + do { +- now = get_tod_clock(); + seq = read_seqcount_begin(&idle->seqcount); + idle_time = READ_ONCE(idle->idle_time); + idle_enter = READ_ONCE(idle->clock_idle_enter); + idle_exit = READ_ONCE(idle->clock_idle_exit); + } while (read_seqcount_retry(&idle->seqcount, seq)); +- idle_time += idle_enter ? ((idle_exit ? : now) - idle_enter) : 0; ++ in_idle = 0; ++ now = get_tod_clock(); ++ if (idle_enter) { ++ if (idle_exit) { ++ in_idle = idle_exit - idle_enter; ++ } else if (now > idle_enter) { ++ in_idle = now - idle_enter; ++ } ++ } ++ idle_time += in_idle; + return sprintf(buf, "%llu\n", idle_time >> 12); + } + DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL); +@@ -88,17 +96,24 @@ DEVICE_ATTR(idle_time_us, 0444, show_idle_time, NULL); + u64 arch_cpu_idle_time(int cpu) + { + struct s390_idle_data *idle = &per_cpu(s390_idle, cpu); +- unsigned long long now, idle_enter, idle_exit; ++ unsigned long long now, idle_enter, idle_exit, in_idle; + unsigned int seq; + + do { +- now = get_tod_clock(); + seq = read_seqcount_begin(&idle->seqcount); + idle_enter = READ_ONCE(idle->clock_idle_enter); + idle_exit = READ_ONCE(idle->clock_idle_exit); + } while (read_seqcount_retry(&idle->seqcount, seq)); +- +- return cputime_to_nsecs(idle_enter ? ((idle_exit ?: now) - idle_enter) : 0); ++ in_idle = 0; ++ now = get_tod_clock(); ++ if (idle_enter) { ++ if (idle_exit) { ++ in_idle = idle_exit - idle_enter; ++ } else if (now > idle_enter) { ++ in_idle = now - idle_enter; ++ } ++ } ++ return cputime_to_nsecs(in_idle); + } + + void arch_cpu_idle_enter(void) +diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c +index 510a18299196..a51c892f14f3 100644 +--- a/arch/s390/mm/cmm.c ++++ b/arch/s390/mm/cmm.c +@@ -298,16 +298,16 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write, + } + + if (write) { +- len = *lenp; +- if (copy_from_user(buf, buffer, +- len > sizeof(buf) ? sizeof(buf) : len)) ++ len = min(*lenp, sizeof(buf)); ++ if (copy_from_user(buf, buffer, len)) + return -EFAULT; +- buf[sizeof(buf) - 1] = '\0'; ++ buf[len - 1] = '\0'; + cmm_skip_blanks(buf, &p); + nr = simple_strtoul(p, &p, 0); + cmm_skip_blanks(p, &p); + seconds = simple_strtoul(p, &p, 0); + cmm_set_timeout(nr, seconds); ++ *ppos += *lenp; + } else { + len = sprintf(buf, "%ld %ld\n", + cmm_timeout_pages, cmm_timeout_seconds); +@@ -315,9 +315,9 @@ static int cmm_timeout_handler(struct ctl_table *ctl, int write, + len = *lenp; + if (copy_to_user(buffer, buf, len)) + return -EFAULT; ++ *lenp = len; ++ *ppos += len; + } +- *lenp = len; +- *ppos += len; + return 0; + } + +diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c +index 27ade3cb6482..defb536aebce 100644 +--- a/arch/x86/events/amd/core.c ++++ b/arch/x86/events/amd/core.c +@@ -4,12 +4,14 @@ + #include <linux/init.h> + #include <linux/slab.h> + #include <linux/delay.h> ++#include <linux/jiffies.h> + #include <asm/apicdef.h> + #include <asm/nmi.h> + + #include "../perf_event.h" + +-static DEFINE_PER_CPU(unsigned int, perf_nmi_counter); ++static DEFINE_PER_CPU(unsigned long, perf_nmi_tstamp); ++static unsigned long perf_nmi_window; + + static __initconst const u64 amd_hw_cache_event_ids + [PERF_COUNT_HW_CACHE_MAX] +@@ -640,11 +642,12 @@ static void amd_pmu_disable_event(struct perf_event *event) + * handler when multiple PMCs are active or PMC overflow while handling some + * other source of an NMI. + * +- * Attempt to mitigate this by using the number of active PMCs to determine +- * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset +- * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the +- * number of active PMCs or 2. The value of 2 is used in case an NMI does not +- * arrive at the LAPIC in time to be collapsed into an already pending NMI. ++ * Attempt to mitigate this by creating an NMI window in which un-handled NMIs ++ * received during this window will be claimed. This prevents extending the ++ * window past when it is possible that latent NMIs should be received. The ++ * per-CPU perf_nmi_tstamp will be set to the window end time whenever perf has ++ * handled a counter. When an un-handled NMI is received, it will be claimed ++ * only if arriving within that window. + */ + static int amd_pmu_handle_irq(struct pt_regs *regs) + { +@@ -662,21 +665,19 @@ static int amd_pmu_handle_irq(struct pt_regs *regs) + handled = x86_pmu_handle_irq(regs); + + /* +- * If a counter was handled, record the number of possible remaining +- * NMIs that can occur. ++ * If a counter was handled, record a timestamp such that un-handled ++ * NMIs will be claimed if arriving within that window. + */ + if (handled) { +- this_cpu_write(perf_nmi_counter, +- min_t(unsigned int, 2, active)); ++ this_cpu_write(perf_nmi_tstamp, ++ jiffies + perf_nmi_window); + + return handled; + } + +- if (!this_cpu_read(perf_nmi_counter)) ++ if (time_after(jiffies, this_cpu_read(perf_nmi_tstamp))) + return NMI_DONE; + +- this_cpu_dec(perf_nmi_counter); +- + return NMI_HANDLED; + } + +@@ -908,6 +909,9 @@ static int __init amd_core_pmu_init(void) + if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE)) + return 0; + ++ /* Avoid calulating the value each time in the NMI handler */ ++ perf_nmi_window = msecs_to_jiffies(100); ++ + switch (boot_cpu_data.x86) { + case 0x15: + pr_cont("Fam15h "); +diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h +index 5d0b72f28140..2a8e5f78e23c 100644 +--- a/arch/x86/include/asm/intel-family.h ++++ b/arch/x86/include/asm/intel-family.h +@@ -6,7 +6,7 @@ + * "Big Core" Processors (Branded as Core, Xeon, etc...) + * + * The "_X" parts are generally the EP and EX Xeons, or the +- * "Extreme" ones, like Broadwell-E. ++ * "Extreme" ones, like Broadwell-E, or Atom microserver. + * + * While adding a new CPUID for a new microarchitecture, add a new + * group to keep logically sorted out in chronological order. Within +@@ -61,6 +61,9 @@ + #define INTEL_FAM6_TIGERLAKE_L 0x8C + #define INTEL_FAM6_TIGERLAKE 0x8D + ++#define INTEL_FAM6_COMETLAKE 0xA5 ++#define INTEL_FAM6_COMETLAKE_L 0xA6 ++ + /* "Small Core" Processors (Atom) */ + + #define INTEL_FAM6_ATOM_BONNELL 0x1C /* Diamondville, Pineview */ +@@ -80,6 +83,7 @@ + #define INTEL_FAM6_ATOM_GOLDMONT 0x5C /* Apollo Lake */ + #define INTEL_FAM6_ATOM_GOLDMONT_X 0x5F /* Denverton */ + #define INTEL_FAM6_ATOM_GOLDMONT_PLUS 0x7A /* Gemini Lake */ ++#define INTEL_FAM6_ATOM_TREMONT_X 0x86 /* Jacobsville */ + + /* Xeon Phi */ + +diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c +index 9061babfbc83..335a62e74a2e 100644 +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -893,9 +893,6 @@ static void __init kexec_enter_virtual_mode(void) + + if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX)) + runtime_code_page_mkexec(); +- +- /* clean DUMMY object */ +- efi_delete_dummy_variable(); + #endif + } + +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index c6c7c9b7b5c1..2483ff345bbc 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -266,19 +266,41 @@ void xen_reboot(int reason) + BUG(); + } + ++static int reboot_reason = SHUTDOWN_reboot; ++static bool xen_legacy_crash; + void xen_emergency_restart(void) + { +- xen_reboot(SHUTDOWN_reboot); ++ xen_reboot(reboot_reason); + } + + static int + xen_panic_event(struct notifier_block *this, unsigned long event, void *ptr) + { +- if (!kexec_crash_loaded()) +- xen_reboot(SHUTDOWN_crash); ++ if (!kexec_crash_loaded()) { ++ if (xen_legacy_crash) ++ xen_reboot(SHUTDOWN_crash); ++ ++ reboot_reason = SHUTDOWN_crash; ++ ++ /* ++ * If panic_timeout==0 then we are supposed to wait forever. ++ * However, to preserve original dom0 behavior we have to drop ++ * into hypervisor. (domU behavior is controlled by its ++ * config file) ++ */ ++ if (panic_timeout == 0) ++ panic_timeout = -1; ++ } + return NOTIFY_DONE; + } + ++static int __init parse_xen_legacy_crash(char *arg) ++{ ++ xen_legacy_crash = true; ++ return 0; ++} ++early_param("xen_legacy_crash", parse_xen_legacy_crash); ++ + static struct notifier_block xen_panic_block = { + .notifier_call = xen_panic_event, + .priority = INT_MIN +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index bc2fa4e85f0c..bd9aafe86c2f 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -228,8 +228,8 @@ static void nbd_put(struct nbd_device *nbd) + if (refcount_dec_and_mutex_lock(&nbd->refs, + &nbd_index_mutex)) { + idr_remove(&nbd_index_idr, nbd->index); +- mutex_unlock(&nbd_index_mutex); + nbd_dev_remove(nbd); ++ mutex_unlock(&nbd_index_mutex); + } + } + +@@ -924,6 +924,25 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx, + return ret; + } + ++static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, ++ int *err) ++{ ++ struct socket *sock; ++ ++ *err = 0; ++ sock = sockfd_lookup(fd, err); ++ if (!sock) ++ return NULL; ++ ++ if (sock->ops->shutdown == sock_no_shutdown) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); ++ *err = -EINVAL; ++ return NULL; ++ } ++ ++ return sock; ++} ++ + static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + bool netlink) + { +@@ -933,7 +952,7 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + struct nbd_sock *nsock; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +@@ -985,7 +1004,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) + int i; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 70cbd0ee1b07..76abe40bfa83 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -312,13 +312,14 @@ static void reset_bdev(struct zram *zram) + static ssize_t backing_dev_show(struct device *dev, + struct device_attribute *attr, char *buf) + { ++ struct file *file; + struct zram *zram = dev_to_zram(dev); +- struct file *file = zram->backing_dev; + char *p; + ssize_t ret; + + down_read(&zram->init_lock); +- if (!zram_wb_enabled(zram)) { ++ file = zram->backing_dev; ++ if (!file) { + memcpy(buf, "none\n", 5); + up_read(&zram->init_lock); + return 5; +diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c +index f5d54a64d33c..dddda45127a8 100644 +--- a/drivers/clk/imgtec/clk-boston.c ++++ b/drivers/clk/imgtec/clk-boston.c +@@ -73,31 +73,39 @@ static void __init clk_boston_setup(struct device_node *np) + hw = clk_hw_register_fixed_rate(NULL, "input", NULL, 0, in_freq); + if (IS_ERR(hw)) { + pr_err("failed to register input clock: %ld\n", PTR_ERR(hw)); +- goto error; ++ goto fail_input; + } + onecell->hws[BOSTON_CLK_INPUT] = hw; + + hw = clk_hw_register_fixed_rate(NULL, "sys", "input", 0, sys_freq); + if (IS_ERR(hw)) { + pr_err("failed to register sys clock: %ld\n", PTR_ERR(hw)); +- goto error; ++ goto fail_sys; + } + onecell->hws[BOSTON_CLK_SYS] = hw; + + hw = clk_hw_register_fixed_rate(NULL, "cpu", "input", 0, cpu_freq); + if (IS_ERR(hw)) { + pr_err("failed to register cpu clock: %ld\n", PTR_ERR(hw)); +- goto error; ++ goto fail_cpu; + } + onecell->hws[BOSTON_CLK_CPU] = hw; + + err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, onecell); +- if (err) ++ if (err) { + pr_err("failed to add DT provider: %d\n", err); ++ goto fail_clk_add; ++ } + + return; + +-error: ++fail_clk_add: ++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_CPU]); ++fail_cpu: ++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_SYS]); ++fail_sys: ++ clk_hw_unregister_fixed_rate(onecell->hws[BOSTON_CLK_INPUT]); ++fail_input: + kfree(onecell); + } + +diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c +index 489c8fa4d2e2..4451ccfaf7c9 100644 +--- a/drivers/dma/qcom/bam_dma.c ++++ b/drivers/dma/qcom/bam_dma.c +@@ -703,6 +703,25 @@ static int bam_dma_terminate_all(struct dma_chan *chan) + + /* remove all transactions, including active transaction */ + spin_lock_irqsave(&bchan->vc.lock, flag); ++ /* ++ * If we have transactions queued, then some might be committed to the ++ * hardware in the desc fifo. The only way to reset the desc fifo is ++ * to do a hardware reset (either by pipe or the entire block). ++ * bam_chan_init_hw() will trigger a pipe reset, and also reinit the ++ * pipe. If the pipe is left disabled (default state after pipe reset) ++ * and is accessed by a connected hardware engine, a fatal error in ++ * the BAM will occur. There is a small window where this could happen ++ * with bam_chan_init_hw(), but it is assumed that the caller has ++ * stopped activity on any attached hardware engine. Make sure to do ++ * this first so that the BAM hardware doesn't cause memory corruption ++ * by accessing freed resources. ++ */ ++ if (!list_empty(&bchan->desc_list)) { ++ async_desc = list_first_entry(&bchan->desc_list, ++ struct bam_async_desc, desc_node); ++ bam_chan_init_hw(bchan, async_desc->dir); ++ } ++ + list_for_each_entry_safe(async_desc, tmp, + &bchan->desc_list, desc_node) { + list_add(&async_desc->vd.node, &bchan->vc.desc_issued); +diff --git a/drivers/dma/ti/cppi41.c b/drivers/dma/ti/cppi41.c +index e507ec36c0d3..f8fa99402f12 100644 +--- a/drivers/dma/ti/cppi41.c ++++ b/drivers/dma/ti/cppi41.c +@@ -585,9 +585,22 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg( + enum dma_transfer_direction dir, unsigned long tx_flags, void *context) + { + struct cppi41_channel *c = to_cpp41_chan(chan); ++ struct dma_async_tx_descriptor *txd = NULL; ++ struct cppi41_dd *cdd = c->cdd; + struct cppi41_desc *d; + struct scatterlist *sg; + unsigned int i; ++ int error; ++ ++ error = pm_runtime_get(cdd->ddev.dev); ++ if (error < 0) { ++ pm_runtime_put_noidle(cdd->ddev.dev); ++ ++ return NULL; ++ } ++ ++ if (cdd->is_suspended) ++ goto err_out_not_ready; + + d = c->desc; + for_each_sg(sgl, sg, sg_len, i) { +@@ -610,7 +623,13 @@ static struct dma_async_tx_descriptor *cppi41_dma_prep_slave_sg( + d++; + } + +- return &c->txd; ++ txd = &c->txd; ++ ++err_out_not_ready: ++ pm_runtime_mark_last_busy(cdd->ddev.dev); ++ pm_runtime_put_autosuspend(cdd->ddev.dev); ++ ++ return txd; + } + + static void cppi41_compute_td_desc(struct cppi41_desc *d) +diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c +index 4045098ddb86..116989cf3d45 100644 +--- a/drivers/firmware/efi/cper.c ++++ b/drivers/firmware/efi/cper.c +@@ -393,7 +393,7 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie, + printk("%s""vendor_id: 0x%04x, device_id: 0x%04x\n", pfx, + pcie->device_id.vendor_id, pcie->device_id.device_id); + p = pcie->device_id.class_code; +- printk("%s""class_code: %02x%02x%02x\n", pfx, p[0], p[1], p[2]); ++ printk("%s""class_code: %02x%02x%02x\n", pfx, p[2], p[1], p[0]); + } + if (pcie->validation_bits & CPER_PCIE_VALID_SERIAL_NUMBER) + printk("%s""serial number: 0x%04x, 0x%04x\n", pfx, +diff --git a/drivers/gpio/gpio-max77620.c b/drivers/gpio/gpio-max77620.c +index 538bce4b5b42..ac6c1c0548b6 100644 +--- a/drivers/gpio/gpio-max77620.c ++++ b/drivers/gpio/gpio-max77620.c +@@ -163,13 +163,13 @@ static int max77620_gpio_set_debounce(struct max77620_gpio *mgpio, + case 0: + val = MAX77620_CNFG_GPIO_DBNC_None; + break; +- case 1 ... 8: ++ case 1000 ... 8000: + val = MAX77620_CNFG_GPIO_DBNC_8ms; + break; +- case 9 ... 16: ++ case 9000 ... 16000: + val = MAX77620_CNFG_GPIO_DBNC_16ms; + break; +- case 17 ... 32: ++ case 17000 ... 32000: + val = MAX77620_CNFG_GPIO_DBNC_32ms; + break; + default: +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +index b80243d3972e..ce7f18c5ccb2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +@@ -264,7 +264,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data, + + r = amdgpu_bo_create_list_entry_array(&args->in, &info); + if (r) +- goto error_free; ++ return r; + + switch (args->in.operation) { + case AMDGPU_BO_LIST_OP_CREATE: +@@ -277,8 +277,7 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data, + r = idr_alloc(&fpriv->bo_list_handles, list, 1, 0, GFP_KERNEL); + mutex_unlock(&fpriv->bo_list_lock); + if (r < 0) { +- amdgpu_bo_list_put(list); +- return r; ++ goto error_put_list; + } + + handle = r; +@@ -300,9 +299,8 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data, + mutex_unlock(&fpriv->bo_list_lock); + + if (IS_ERR(old)) { +- amdgpu_bo_list_put(list); + r = PTR_ERR(old); +- goto error_free; ++ goto error_put_list; + } + + amdgpu_bo_list_put(old); +@@ -319,8 +317,10 @@ int amdgpu_bo_list_ioctl(struct drm_device *dev, void *data, + + return 0; + ++error_put_list: ++ amdgpu_bo_list_put(list); ++ + error_free: +- if (info) +- kvfree(info); ++ kvfree(info); + return r; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index d440b28ee43f..6896d69b8c24 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1399,9 +1399,9 @@ bool dc_remove_plane_from_context( + * For head pipe detach surfaces from pipe for tail + * pipe just zero it out + */ +- if (!pipe_ctx->top_pipe || +- (!pipe_ctx->top_pipe->top_pipe && ++ if (!pipe_ctx->top_pipe || (!pipe_ctx->top_pipe->top_pipe && + pipe_ctx->top_pipe->stream_res.opp != pipe_ctx->stream_res.opp)) { ++ pipe_ctx->top_pipe = NULL; + pipe_ctx->plane_state = NULL; + pipe_ctx->bottom_pipe = NULL; + } else { +@@ -1803,8 +1803,6 @@ enum dc_status dc_remove_stream_from_ctx( + dc->res_pool->funcs->remove_stream_from_ctx(dc, new_ctx, stream); + + memset(del_pipe, 0, sizeof(*del_pipe)); +- +- break; + } + } + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +index fb86c24394ff..ce459ea4ec3a 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +@@ -4751,9 +4751,7 @@ static void vega10_odn_update_soc_table(struct pp_hwmgr *hwmgr, + + if (type == PP_OD_EDIT_SCLK_VDDC_TABLE) { + podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_sclk; +- for (i = 0; i < podn_vdd_dep->count - 1; i++) +- od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc; +- if (od_vddc_lookup_table->entries[i].us_vdd < podn_vdd_dep->entries[i].vddc) ++ for (i = 0; i < podn_vdd_dep->count; i++) + od_vddc_lookup_table->entries[i].us_vdd = podn_vdd_dep->entries[i].vddc; + } else if (type == PP_OD_EDIT_MCLK_VDDC_TABLE) { + podn_vdd_dep = &data->odn_dpm_table.vdd_dep_on_mclk; +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +index 74cc204b07e8..2d9b7b5fb49c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +@@ -442,35 +442,38 @@ static void dpu_kms_wait_for_commit_done(struct msm_kms *kms, + } + } + +-static void _dpu_kms_initialize_dsi(struct drm_device *dev, ++static int _dpu_kms_initialize_dsi(struct drm_device *dev, + struct msm_drm_private *priv, + struct dpu_kms *dpu_kms) + { + struct drm_encoder *encoder = NULL; +- int i, rc; ++ int i, rc = 0; ++ ++ if (!(priv->dsi[0] || priv->dsi[1])) ++ return rc; + + /*TODO: Support two independent DSI connectors */ + encoder = dpu_encoder_init(dev, DRM_MODE_ENCODER_DSI); +- if (IS_ERR_OR_NULL(encoder)) { ++ if (IS_ERR(encoder)) { + DPU_ERROR("encoder init failed for dsi display\n"); +- return; ++ return PTR_ERR(encoder); + } + + priv->encoders[priv->num_encoders++] = encoder; + + for (i = 0; i < ARRAY_SIZE(priv->dsi); i++) { +- if (!priv->dsi[i]) { +- DPU_DEBUG("invalid msm_dsi for ctrl %d\n", i); +- return; +- } ++ if (!priv->dsi[i]) ++ continue; + + rc = msm_dsi_modeset_init(priv->dsi[i], dev, encoder); + if (rc) { + DPU_ERROR("modeset_init failed for dsi[%d], rc = %d\n", + i, rc); +- continue; ++ break; + } + } ++ ++ return rc; + } + + /** +@@ -481,16 +484,16 @@ static void _dpu_kms_initialize_dsi(struct drm_device *dev, + * @dpu_kms: Pointer to dpu kms structure + * Returns: Zero on success + */ +-static void _dpu_kms_setup_displays(struct drm_device *dev, ++static int _dpu_kms_setup_displays(struct drm_device *dev, + struct msm_drm_private *priv, + struct dpu_kms *dpu_kms) + { +- _dpu_kms_initialize_dsi(dev, priv, dpu_kms); +- + /** + * Extend this function to initialize other + * types of displays + */ ++ ++ return _dpu_kms_initialize_dsi(dev, priv, dpu_kms); + } + + static void _dpu_kms_drm_obj_destroy(struct dpu_kms *dpu_kms) +@@ -552,7 +555,9 @@ static int _dpu_kms_drm_obj_init(struct dpu_kms *dpu_kms) + * Create encoder and query display drivers to create + * bridges and connectors + */ +- _dpu_kms_setup_displays(dev, priv, dpu_kms); ++ ret = _dpu_kms_setup_displays(dev, priv, dpu_kms); ++ if (ret) ++ goto fail; + + max_crtc_count = min(catalog->mixer_count, priv->num_encoders); + +diff --git a/drivers/hid/hid-axff.c b/drivers/hid/hid-axff.c +index a594e478a1e2..843aed4dec80 100644 +--- a/drivers/hid/hid-axff.c ++++ b/drivers/hid/hid-axff.c +@@ -75,13 +75,20 @@ static int axff_init(struct hid_device *hid) + { + struct axff_device *axff; + struct hid_report *report; +- struct hid_input *hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list =&hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int field_count = 0; + int i, j; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 861375561156..63a1628f7cf7 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -975,6 +975,7 @@ int hid_open_report(struct hid_device *device) + __u8 *start; + __u8 *buf; + __u8 *end; ++ __u8 *next; + int ret; + static int (*dispatch_type[])(struct hid_parser *parser, + struct hid_item *item) = { +@@ -1028,7 +1029,8 @@ int hid_open_report(struct hid_device *device) + device->collection_size = HID_DEFAULT_NUM_COLLECTIONS; + + ret = -EINVAL; +- while ((start = fetch_item(start, end, &item)) != NULL) { ++ while ((next = fetch_item(start, end, &item)) != NULL) { ++ start = next; + + if (item.format != HID_ITEM_FORMAT_SHORT) { + hid_err(device, "unexpected long global item\n"); +@@ -1058,7 +1060,8 @@ int hid_open_report(struct hid_device *device) + } + } + +- hid_err(device, "item fetching failed at offset %d\n", (int)(end - start)); ++ hid_err(device, "item fetching failed at offset %u/%u\n", ++ size - (unsigned int)(end - start), size); + err: + kfree(parser->collection_stack); + alloc_err: +diff --git a/drivers/hid/hid-dr.c b/drivers/hid/hid-dr.c +index 818ea7d93533..309969b8dc2e 100644 +--- a/drivers/hid/hid-dr.c ++++ b/drivers/hid/hid-dr.c +@@ -87,13 +87,19 @@ static int drff_init(struct hid_device *hid) + { + struct drff_device *drff; + struct hid_report *report; +- struct hid_input *hidinput = list_first_entry(&hid->inputs, +- struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-emsff.c b/drivers/hid/hid-emsff.c +index d82d75bb11f7..80f9a02dfa69 100644 +--- a/drivers/hid/hid-emsff.c ++++ b/drivers/hid/hid-emsff.c +@@ -59,13 +59,19 @@ static int emsff_init(struct hid_device *hid) + { + struct emsff_device *emsff; + struct hid_report *report; +- struct hid_input *hidinput = list_first_entry(&hid->inputs, +- struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-gaff.c b/drivers/hid/hid-gaff.c +index 2d8cead3adca..5a02c50443cb 100644 +--- a/drivers/hid/hid-gaff.c ++++ b/drivers/hid/hid-gaff.c +@@ -77,14 +77,20 @@ static int gaff_init(struct hid_device *hid) + { + struct gaff_device *gaff; + struct hid_report *report; +- struct hid_input *hidinput = list_entry(hid->inputs.next, +- struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; + struct list_head *report_ptr = report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-holtekff.c b/drivers/hid/hid-holtekff.c +index edc0f64bb584..c68486ee203c 100644 +--- a/drivers/hid/hid-holtekff.c ++++ b/drivers/hid/hid-holtekff.c +@@ -136,13 +136,19 @@ static int holtekff_init(struct hid_device *hid) + { + struct holtekff_device *holtekff; + struct hid_report *report; +- struct hid_input *hidinput = list_entry(hid->inputs.next, +- struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output report found\n"); + return -ENODEV; +diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c +index 704049e62d58..4d1496f60071 100644 +--- a/drivers/hid/hid-hyperv.c ++++ b/drivers/hid/hid-hyperv.c +@@ -322,60 +322,24 @@ static void mousevsc_on_receive(struct hv_device *device, + + static void mousevsc_on_channel_callback(void *context) + { +- const int packet_size = 0x100; +- int ret; + struct hv_device *device = context; +- u32 bytes_recvd; +- u64 req_id; + struct vmpacket_descriptor *desc; +- unsigned char *buffer; +- int bufferlen = packet_size; +- +- buffer = kmalloc(bufferlen, GFP_ATOMIC); +- if (!buffer) +- return; +- +- do { +- ret = vmbus_recvpacket_raw(device->channel, buffer, +- bufferlen, &bytes_recvd, &req_id); +- +- switch (ret) { +- case 0: +- if (bytes_recvd <= 0) { +- kfree(buffer); +- return; +- } +- desc = (struct vmpacket_descriptor *)buffer; +- +- switch (desc->type) { +- case VM_PKT_COMP: +- break; +- +- case VM_PKT_DATA_INBAND: +- mousevsc_on_receive(device, desc); +- break; +- +- default: +- pr_err("unhandled packet type %d, tid %llx len %d\n", +- desc->type, req_id, bytes_recvd); +- break; +- } + ++ foreach_vmbus_pkt(desc, device->channel) { ++ switch (desc->type) { ++ case VM_PKT_COMP: + break; + +- case -ENOBUFS: +- kfree(buffer); +- /* Handle large packet */ +- bufferlen = bytes_recvd; +- buffer = kmalloc(bytes_recvd, GFP_ATOMIC); +- +- if (!buffer) +- return; ++ case VM_PKT_DATA_INBAND: ++ mousevsc_on_receive(device, desc); ++ break; + ++ default: ++ pr_err("Unhandled packet type %d, tid %llx len %d\n", ++ desc->type, desc->trans_id, desc->len8 * 8); + break; + } +- } while (1); +- ++ } + } + + static int mousevsc_connect_to_vsp(struct hv_device *device) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 0eeb273fb73d..6b33117ca60e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -713,6 +713,7 @@ + #define USB_VENDOR_ID_LG 0x1fd2 + #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064 + #define USB_DEVICE_ID_LG_MELFAS_MT 0x6007 ++#define I2C_DEVICE_ID_LG_8001 0x8001 + + #define USB_VENDOR_ID_LOGITECH 0x046d + #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index d988b92b20c8..01bed2f6862e 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -328,6 +328,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL, + USB_DEVICE_ID_SYMBOL_SCANNER_3), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK, ++ USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +diff --git a/drivers/hid/hid-lg2ff.c b/drivers/hid/hid-lg2ff.c +index 0e3fb1a7e421..6909d9c2fc67 100644 +--- a/drivers/hid/hid-lg2ff.c ++++ b/drivers/hid/hid-lg2ff.c +@@ -62,11 +62,17 @@ int lg2ff_init(struct hid_device *hid) + { + struct lg2ff_device *lg2ff; + struct hid_report *report; +- struct hid_input *hidinput = list_entry(hid->inputs.next, +- struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + int error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + /* Check that the report looks ok */ + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7); + if (!report) +diff --git a/drivers/hid/hid-lg3ff.c b/drivers/hid/hid-lg3ff.c +index 8c2da183d3bc..acf739fc4060 100644 +--- a/drivers/hid/hid-lg3ff.c ++++ b/drivers/hid/hid-lg3ff.c +@@ -129,12 +129,19 @@ static const signed short ff3_joystick_ac[] = { + + int lg3ff_init(struct hid_device *hid) + { +- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + const signed short *ff_bits = ff3_joystick_ac; + int error; + int i; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + /* Check that the report looks ok */ + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 35)) + return -ENODEV; +diff --git a/drivers/hid/hid-lg4ff.c b/drivers/hid/hid-lg4ff.c +index 4b26928cb2b6..ef80c592b88a 100644 +--- a/drivers/hid/hid-lg4ff.c ++++ b/drivers/hid/hid-lg4ff.c +@@ -1259,8 +1259,8 @@ static int lg4ff_handle_multimode_wheel(struct hid_device *hid, u16 *real_produc + + int lg4ff_init(struct hid_device *hid) + { +- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT].report_list; + struct hid_report *report = list_entry(report_list->next, struct hid_report, list); + const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor); +@@ -1272,6 +1272,13 @@ int lg4ff_init(struct hid_device *hid) + int mmode_ret, mmode_idx = -1; + u16 real_product_id; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + /* Check that the report looks ok */ + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) + return -1; +diff --git a/drivers/hid/hid-lgff.c b/drivers/hid/hid-lgff.c +index e1394af0ae7b..1871cdcd1e0a 100644 +--- a/drivers/hid/hid-lgff.c ++++ b/drivers/hid/hid-lgff.c +@@ -127,12 +127,19 @@ static void hid_lgff_set_autocenter(struct input_dev *dev, u16 magnitude) + + int lgff_init(struct hid_device* hid) + { +- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + const signed short *ff_bits = ff_joystick; + int error; + int i; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + /* Check that the report looks ok */ + if (!hid_validate_values(hid, HID_OUTPUT_REPORT, 0, 0, 7)) + return -ENODEV; +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index e642cfaf303b..034c883e57fa 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -1867,8 +1867,8 @@ static void hidpp_ff_destroy(struct ff_device *ff) + static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index) + { + struct hid_device *hid = hidpp->hid_dev; +- struct hid_input *hidinput = list_entry(hid->inputs.next, struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + const struct usb_device_descriptor *udesc = &(hid_to_usb_dev(hid)->descriptor); + const u16 bcdDevice = le16_to_cpu(udesc->bcdDevice); + struct ff_device *ff; +@@ -1877,6 +1877,13 @@ static int hidpp_ff_init(struct hidpp_device *hidpp, u8 feature_index) + int error, j, num_slots; + u8 version; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + if (!dev) { + hid_err(hid, "Struct input_dev not set!\n"); + return -EINVAL; +diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c +index 09f2c617b09f..d05c387a588e 100644 +--- a/drivers/hid/hid-sony.c ++++ b/drivers/hid/hid-sony.c +@@ -2249,9 +2249,15 @@ static int sony_play_effect(struct input_dev *dev, void *data, + + static int sony_init_ff(struct sony_sc *sc) + { +- struct hid_input *hidinput = list_entry(sc->hdev->inputs.next, +- struct hid_input, list); +- struct input_dev *input_dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *input_dev; ++ ++ if (list_empty(&sc->hdev->inputs)) { ++ hid_err(sc->hdev, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(sc->hdev->inputs.next, struct hid_input, list); ++ input_dev = hidinput->input; + + input_set_capability(input_dev, EV_FF, FF_RUMBLE); + return input_ff_create_memless(input_dev, NULL, sony_play_effect); +diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c +index dc4128bfe2ca..8dae0f9b819e 100644 +--- a/drivers/hid/hid-steam.c ++++ b/drivers/hid/hid-steam.c +@@ -283,11 +283,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable) + static int steam_input_open(struct input_dev *dev) + { + struct steam_device *steam = input_get_drvdata(dev); +- int ret; +- +- ret = hid_hw_open(steam->hdev); +- if (ret) +- return ret; + + mutex_lock(&steam->mutex); + if (!steam->client_opened && lizard_mode) +@@ -304,8 +299,6 @@ static void steam_input_close(struct input_dev *dev) + if (!steam->client_opened && lizard_mode) + steam_set_lizard_mode(steam, true); + mutex_unlock(&steam->mutex); +- +- hid_hw_close(steam->hdev); + } + + static enum power_supply_property steam_battery_props[] = { +@@ -506,6 +499,7 @@ static void steam_battery_unregister(struct steam_device *steam) + static int steam_register(struct steam_device *steam) + { + int ret; ++ bool client_opened; + + /* + * This function can be called several times in a row with the +@@ -518,9 +512,11 @@ static int steam_register(struct steam_device *steam) + * Unlikely, but getting the serial could fail, and it is not so + * important, so make up a serial number and go on. + */ ++ mutex_lock(&steam->mutex); + if (steam_get_serial(steam) < 0) + strlcpy(steam->serial_no, "XXXXXXXXXX", + sizeof(steam->serial_no)); ++ mutex_unlock(&steam->mutex); + + hid_info(steam->hdev, "Steam Controller '%s' connected", + steam->serial_no); +@@ -535,13 +531,15 @@ static int steam_register(struct steam_device *steam) + } + + mutex_lock(&steam->mutex); +- if (!steam->client_opened) { ++ client_opened = steam->client_opened; ++ if (!client_opened) + steam_set_lizard_mode(steam, lizard_mode); ++ mutex_unlock(&steam->mutex); ++ ++ if (!client_opened) + ret = steam_input_register(steam); +- } else { ++ else + ret = 0; +- } +- mutex_unlock(&steam->mutex); + + return ret; + } +@@ -623,11 +621,6 @@ static void steam_client_ll_stop(struct hid_device *hdev) + static int steam_client_ll_open(struct hid_device *hdev) + { + struct steam_device *steam = hdev->driver_data; +- int ret; +- +- ret = hid_hw_open(steam->hdev); +- if (ret) +- return ret; + + mutex_lock(&steam->mutex); + steam->client_opened = true; +@@ -635,22 +628,28 @@ static int steam_client_ll_open(struct hid_device *hdev) + + steam_input_unregister(steam); + +- return ret; ++ return 0; + } + + static void steam_client_ll_close(struct hid_device *hdev) + { + struct steam_device *steam = hdev->driver_data; + ++ unsigned long flags; ++ bool connected; ++ ++ spin_lock_irqsave(&steam->lock, flags); ++ connected = steam->connected; ++ spin_unlock_irqrestore(&steam->lock, flags); ++ + mutex_lock(&steam->mutex); + steam->client_opened = false; ++ if (connected) ++ steam_set_lizard_mode(steam, lizard_mode); + mutex_unlock(&steam->mutex); + +- hid_hw_close(steam->hdev); +- if (steam->connected) { +- steam_set_lizard_mode(steam, lizard_mode); ++ if (connected) + steam_input_register(steam); +- } + } + + static int steam_client_ll_raw_request(struct hid_device *hdev, +@@ -759,14 +758,15 @@ static int steam_probe(struct hid_device *hdev, + if (ret) + goto client_hdev_add_fail; + ++ ret = hid_hw_open(hdev); ++ if (ret) { ++ hid_err(hdev, ++ "%s:hid_hw_open\n", ++ __func__); ++ goto hid_hw_open_fail; ++ } ++ + if (steam->quirks & STEAM_QUIRK_WIRELESS) { +- ret = hid_hw_open(hdev); +- if (ret) { +- hid_err(hdev, +- "%s:hid_hw_open for wireless\n", +- __func__); +- goto hid_hw_open_fail; +- } + hid_info(hdev, "Steam wireless receiver connected"); + steam_request_conn_status(steam); + } else { +@@ -781,8 +781,8 @@ static int steam_probe(struct hid_device *hdev, + + return 0; + +-hid_hw_open_fail: + input_register_fail: ++hid_hw_open_fail: + client_hdev_add_fail: + hid_hw_stop(hdev); + hid_hw_start_fail: +@@ -809,8 +809,8 @@ static void steam_remove(struct hid_device *hdev) + cancel_work_sync(&steam->work_connect); + if (steam->quirks & STEAM_QUIRK_WIRELESS) { + hid_info(hdev, "Steam wireless receiver disconnected"); +- hid_hw_close(hdev); + } ++ hid_hw_close(hdev); + hid_hw_stop(hdev); + steam_unregister(steam); + } +diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c +index 30b8c3256c99..efe8c2a0261e 100644 +--- a/drivers/hid/hid-tmff.c ++++ b/drivers/hid/hid-tmff.c +@@ -136,12 +136,18 @@ static int tmff_init(struct hid_device *hid, const signed short *ff_bits) + struct tmff_device *tmff; + struct hid_report *report; + struct list_head *report_list; +- struct hid_input *hidinput = list_entry(hid->inputs.next, +- struct hid_input, list); +- struct input_dev *input_dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *input_dev; + int error; + int i; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ input_dev = hidinput->input; ++ + tmff = kzalloc(sizeof(struct tmff_device), GFP_KERNEL); + if (!tmff) + return -ENOMEM; +diff --git a/drivers/hid/hid-zpff.c b/drivers/hid/hid-zpff.c +index a29756c6ca02..4e7e01be99b1 100644 +--- a/drivers/hid/hid-zpff.c ++++ b/drivers/hid/hid-zpff.c +@@ -66,11 +66,17 @@ static int zpff_init(struct hid_device *hid) + { + struct zpff_device *zpff; + struct hid_report *report; +- struct hid_input *hidinput = list_entry(hid->inputs.next, +- struct hid_input, list); +- struct input_dev *dev = hidinput->input; ++ struct hid_input *hidinput; ++ struct input_dev *dev; + int i, error; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ hidinput = list_entry(hid->inputs.next, struct hid_input, list); ++ dev = hidinput->input; ++ + for (i = 0; i < 4; i++) { + report = hid_validate_values(hid, HID_OUTPUT_REPORT, 0, i, 1); + if (!report) +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 3cde7c1b9c33..2f940c1de616 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -50,6 +50,7 @@ + #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1) + #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2) + #define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3) ++#define I2C_HID_QUIRK_BOGUS_IRQ BIT(4) + + /* flags */ + #define I2C_HID_STARTED 0 +@@ -177,6 +178,10 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_NO_RUNTIME_PM }, + { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33, + I2C_HID_QUIRK_DELAY_AFTER_SLEEP }, ++ { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001, ++ I2C_HID_QUIRK_NO_RUNTIME_PM }, ++ { USB_VENDOR_ID_ELAN, HID_ANY_ID, ++ I2C_HID_QUIRK_BOGUS_IRQ }, + { 0, 0 } + }; + +@@ -501,6 +506,12 @@ static void i2c_hid_get_input(struct i2c_hid *ihid) + return; + } + ++ if (ihid->quirks & I2C_HID_QUIRK_BOGUS_IRQ && ret_size == 0xffff) { ++ dev_warn_once(&ihid->client->dev, "%s: IRQ triggered but " ++ "there's no data\n", __func__); ++ return; ++ } ++ + if ((ret_size > size) || (ret_size < 2)) { + dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n", + __func__, size, ret_size); +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index cac262a912c1..10af8585c820 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -322,6 +322,25 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ /* ++ * There are at least 2 Primebook C11B versions, the older ++ * version has a product-name of "Primebook C11B", and a ++ * bios version / release / firmware revision of: ++ * V2.1.2 / 05/03/2018 / 18.2 ++ * The new version has "PRIMEBOOK C11B" as product-name and a ++ * bios version / release / firmware revision of: ++ * CFALKSW05_BIOS_V1.1.2 / 11/19/2018 / 19.2 ++ * Only the older version needs this quirk, note the newer ++ * version will not match as it has a different product-name. ++ */ ++ .ident = "Trekstor Primebook C11B", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "TREKSTOR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Primebook C11B"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Direkt-Tek DTLAPY116-2", + .matches = { +@@ -330,6 +349,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Direkt-Tek DTLAPY133-1", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Direkt-Tek"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "DTLAPY133-1"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Mediacom Flexbook Edge 11", + .matches = { +@@ -338,6 +365,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Odys Winbook 13", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AXDIA International GmbH"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "WINBOOK 13"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { } /* Terminate list */ + }; + +diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c +index 383c802eb5b8..cb8c98a44010 100644 +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -125,7 +125,7 @@ + #define BMC150_ACCEL_SLEEP_1_SEC 0x0F + + #define BMC150_ACCEL_REG_TEMP 0x08 +-#define BMC150_ACCEL_TEMP_CENTER_VAL 24 ++#define BMC150_ACCEL_TEMP_CENTER_VAL 23 + + #define BMC150_ACCEL_AXIS_TO_REG(axis) (BMC150_ACCEL_REG_XOUT_L + (axis * 2)) + #define BMC150_AUTO_SUSPEND_DELAY_MS 2000 +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 5dd104cf0939..6e0ef9bb2497 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -1023,6 +1023,11 @@ static int meson_sar_adc_probe(struct platform_device *pdev) + if (IS_ERR(base)) + return PTR_ERR(base); + ++ priv->regmap = devm_regmap_init_mmio(&pdev->dev, base, ++ priv->data->param->regmap_config); ++ if (IS_ERR(priv->regmap)) ++ return PTR_ERR(priv->regmap); ++ + irq = irq_of_parse_and_map(pdev->dev.of_node, 0); + if (!irq) + return -EINVAL; +@@ -1032,11 +1037,6 @@ static int meson_sar_adc_probe(struct platform_device *pdev) + if (ret) + return ret; + +- priv->regmap = devm_regmap_init_mmio(&pdev->dev, base, +- priv->data->param->regmap_config); +- if (IS_ERR(priv->regmap)) +- return PTR_ERR(priv->regmap); +- + priv->clkin = devm_clk_get(&pdev->dev, "clkin"); + if (IS_ERR(priv->clkin)) { + dev_err(&pdev->dev, "failed to get clkin\n"); +diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c +index 76643c5571aa..e59d0438de73 100644 +--- a/drivers/iio/imu/adis_buffer.c ++++ b/drivers/iio/imu/adis_buffer.c +@@ -39,8 +39,11 @@ int adis_update_scan_mode(struct iio_dev *indio_dev, + return -ENOMEM; + + adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL); +- if (!adis->buffer) ++ if (!adis->buffer) { ++ kfree(adis->xfer); ++ adis->xfer = NULL; + return -ENOMEM; ++ } + + rx = adis->buffer; + tx = rx + scan_count; +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6257be21cbed..1f373ba573b6 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2270,9 +2270,10 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id, + conn_id->cm_id.iw = NULL; + cma_exch(conn_id, RDMA_CM_DESTROYING); + mutex_unlock(&conn_id->handler_mutex); ++ mutex_unlock(&listen_id->handler_mutex); + cma_deref_id(conn_id); + rdma_destroy_id(&conn_id->id); +- goto out; ++ return ret; + } + + mutex_unlock(&conn_id->handler_mutex); +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index d648a4167832..64ab92f8a4a2 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -1518,8 +1518,11 @@ int sdma_init(struct hfi1_devdata *dd, u8 port) + } + + ret = rhashtable_init(tmp_sdma_rht, &sdma_rht_params); +- if (ret < 0) ++ if (ret < 0) { ++ kfree(tmp_sdma_rht); + goto bail; ++ } ++ + dd->sdma_rht = tmp_sdma_rht; + + dd_dev_info(dd, "SDMA num_sdma: %u\n", dd->num_sdma); +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index 5bb81e564ce8..3e8d1f1b562f 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -289,7 +289,9 @@ STORE(__cached_dev) + sysfs_strtoul_clamp(writeback_rate_p_term_inverse, + dc->writeback_rate_p_term_inverse, + 1, UINT_MAX); +- d_strtoul_nonzero(writeback_rate_minimum); ++ sysfs_strtoul_clamp(writeback_rate_minimum, ++ dc->writeback_rate_minimum, ++ 1, UINT_MAX); + + sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX); + +diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c +index 36805b12661e..d3f28a9e3fd9 100644 +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -19,7 +19,6 @@ + #include <linux/vmalloc.h> + #include <linux/log2.h> + #include <linux/dm-kcopyd.h> +-#include <linux/semaphore.h> + + #include "dm.h" + +@@ -106,8 +105,8 @@ struct dm_snapshot { + /* The on disk metadata handler */ + struct dm_exception_store *store; + +- /* Maximum number of in-flight COW jobs. */ +- struct semaphore cow_count; ++ unsigned in_progress; ++ struct wait_queue_head in_progress_wait; + + struct dm_kcopyd_client *kcopyd_client; + +@@ -158,8 +157,8 @@ struct dm_snapshot { + */ + #define DEFAULT_COW_THRESHOLD 2048 + +-static int cow_threshold = DEFAULT_COW_THRESHOLD; +-module_param_named(snapshot_cow_threshold, cow_threshold, int, 0644); ++static unsigned cow_threshold = DEFAULT_COW_THRESHOLD; ++module_param_named(snapshot_cow_threshold, cow_threshold, uint, 0644); + MODULE_PARM_DESC(snapshot_cow_threshold, "Maximum number of chunks being copied on write"); + + DECLARE_DM_KCOPYD_THROTTLE_WITH_MODULE_PARM(snapshot_copy_throttle, +@@ -1207,7 +1206,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) + goto bad_hash_tables; + } + +- sema_init(&s->cow_count, (cow_threshold > 0) ? cow_threshold : INT_MAX); ++ init_waitqueue_head(&s->in_progress_wait); + + s->kcopyd_client = dm_kcopyd_client_create(&dm_kcopyd_throttle); + if (IS_ERR(s->kcopyd_client)) { +@@ -1396,9 +1395,56 @@ static void snapshot_dtr(struct dm_target *ti) + + dm_put_device(ti, s->origin); + ++ WARN_ON(s->in_progress); ++ + kfree(s); + } + ++static void account_start_copy(struct dm_snapshot *s) ++{ ++ spin_lock(&s->in_progress_wait.lock); ++ s->in_progress++; ++ spin_unlock(&s->in_progress_wait.lock); ++} ++ ++static void account_end_copy(struct dm_snapshot *s) ++{ ++ spin_lock(&s->in_progress_wait.lock); ++ BUG_ON(!s->in_progress); ++ s->in_progress--; ++ if (likely(s->in_progress <= cow_threshold) && ++ unlikely(waitqueue_active(&s->in_progress_wait))) ++ wake_up_locked(&s->in_progress_wait); ++ spin_unlock(&s->in_progress_wait.lock); ++} ++ ++static bool wait_for_in_progress(struct dm_snapshot *s, bool unlock_origins) ++{ ++ if (unlikely(s->in_progress > cow_threshold)) { ++ spin_lock(&s->in_progress_wait.lock); ++ if (likely(s->in_progress > cow_threshold)) { ++ /* ++ * NOTE: this throttle doesn't account for whether ++ * the caller is servicing an IO that will trigger a COW ++ * so excess throttling may result for chunks not required ++ * to be COW'd. But if cow_threshold was reached, extra ++ * throttling is unlikely to negatively impact performance. ++ */ ++ DECLARE_WAITQUEUE(wait, current); ++ __add_wait_queue(&s->in_progress_wait, &wait); ++ __set_current_state(TASK_UNINTERRUPTIBLE); ++ spin_unlock(&s->in_progress_wait.lock); ++ if (unlock_origins) ++ up_read(&_origins_lock); ++ io_schedule(); ++ remove_wait_queue(&s->in_progress_wait, &wait); ++ return false; ++ } ++ spin_unlock(&s->in_progress_wait.lock); ++ } ++ return true; ++} ++ + /* + * Flush a list of buffers. + */ +@@ -1414,7 +1460,7 @@ static void flush_bios(struct bio *bio) + } + } + +-static int do_origin(struct dm_dev *origin, struct bio *bio); ++static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit); + + /* + * Flush a list of buffers. +@@ -1427,7 +1473,7 @@ static void retry_origin_bios(struct dm_snapshot *s, struct bio *bio) + while (bio) { + n = bio->bi_next; + bio->bi_next = NULL; +- r = do_origin(s->origin, bio); ++ r = do_origin(s->origin, bio, false); + if (r == DM_MAPIO_REMAPPED) + generic_make_request(bio); + bio = n; +@@ -1594,7 +1640,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context) + rb_link_node(&pe->out_of_order_node, parent, p); + rb_insert_color(&pe->out_of_order_node, &s->out_of_order_tree); + } +- up(&s->cow_count); ++ account_end_copy(s); + } + + /* +@@ -1618,7 +1664,7 @@ static void start_copy(struct dm_snap_pending_exception *pe) + dest.count = src.count; + + /* Hand over to kcopyd */ +- down(&s->cow_count); ++ account_start_copy(s); + dm_kcopyd_copy(s->kcopyd_client, &src, 1, &dest, 0, copy_callback, pe); + } + +@@ -1638,7 +1684,7 @@ static void start_full_bio(struct dm_snap_pending_exception *pe, + pe->full_bio = bio; + pe->full_bio_end_io = bio->bi_end_io; + +- down(&s->cow_count); ++ account_start_copy(s); + callback_data = dm_kcopyd_prepare_callback(s->kcopyd_client, + copy_callback, pe); + +@@ -1729,6 +1775,11 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio) + if (!s->valid) + return DM_MAPIO_KILL; + ++ if (bio_data_dir(bio) == WRITE) { ++ while (unlikely(!wait_for_in_progress(s, false))) ++ ; /* wait_for_in_progress() has slept */ ++ } ++ + mutex_lock(&s->lock); + + if (!s->valid || (unlikely(s->snapshot_overflowed) && +@@ -1877,7 +1928,7 @@ redirect_to_origin: + + if (bio_data_dir(bio) == WRITE) { + mutex_unlock(&s->lock); +- return do_origin(s->origin, bio); ++ return do_origin(s->origin, bio, false); + } + + out_unlock: +@@ -2214,15 +2265,24 @@ next_snapshot: + /* + * Called on a write from the origin driver. + */ +-static int do_origin(struct dm_dev *origin, struct bio *bio) ++static int do_origin(struct dm_dev *origin, struct bio *bio, bool limit) + { + struct origin *o; + int r = DM_MAPIO_REMAPPED; + ++again: + down_read(&_origins_lock); + o = __lookup_origin(origin->bdev); +- if (o) ++ if (o) { ++ if (limit) { ++ struct dm_snapshot *s; ++ list_for_each_entry(s, &o->snapshots, list) ++ if (unlikely(!wait_for_in_progress(s, true))) ++ goto again; ++ } ++ + r = __origin_write(&o->snapshots, bio->bi_iter.bi_sector, bio); ++ } + up_read(&_origins_lock); + + return r; +@@ -2335,7 +2395,7 @@ static int origin_map(struct dm_target *ti, struct bio *bio) + dm_accept_partial_bio(bio, available_sectors); + + /* Only tell snapshots if this is a write */ +- return do_origin(o->dev, bio); ++ return do_origin(o->dev, bio, true); + } + + static long origin_dax_direct_access(struct dm_target *ti, pgoff_t pgoff, +diff --git a/drivers/media/platform/vimc/vimc-sensor.c b/drivers/media/platform/vimc/vimc-sensor.c +index 9e0d70e9f119..3f0ffd4915cd 100644 +--- a/drivers/media/platform/vimc/vimc-sensor.c ++++ b/drivers/media/platform/vimc/vimc-sensor.c +@@ -204,13 +204,6 @@ static void *vimc_sen_process_frame(struct vimc_ent_device *ved, + { + struct vimc_sen_device *vsen = container_of(ved, struct vimc_sen_device, + ved); +- const struct vimc_pix_map *vpix; +- unsigned int frame_size; +- +- /* Calculate the frame size */ +- vpix = vimc_pix_map_by_code(vsen->mbus_format.code); +- frame_size = vsen->mbus_format.width * vpix->bpp * +- vsen->mbus_format.height; + + tpg_fill_plane_buffer(&vsen->tpg, 0, 0, vsen->frame); + return vsen->frame; +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 0d2392c4b625..2804e2d1ae5e 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -4033,7 +4033,7 @@ out: + * this to-be-skipped slave to send a packet out. + */ + old_arr = rtnl_dereference(bond->slave_arr); +- for (idx = 0; idx < old_arr->count; idx++) { ++ for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) { + if (skipslave == old_arr->arr[idx]) { + old_arr->arr[idx] = + old_arr->arr[old_arr->count-1]; +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 703e6bdaf0e1..d075f0f7a3de 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -456,10 +456,12 @@ static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip) + */ + irq_set_lockdep_class(chip->irq, &lock_key, &request_key); + ++ mutex_unlock(&chip->reg_lock); + err = request_threaded_irq(chip->irq, NULL, + mv88e6xxx_g1_irq_thread_fn, + IRQF_ONESHOT, + dev_name(chip->dev), chip); ++ mutex_lock(&chip->reg_lock); + if (err) + mv88e6xxx_g1_irq_free_common(chip); + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index ee126bcf7c35..ccd9aca281b3 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -4410,9 +4410,6 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port, + err = mlxsw_sp_lag_col_port_add(mlxsw_sp_port, lag_id, port_index); + if (err) + goto err_col_port_add; +- err = mlxsw_sp_lag_col_port_enable(mlxsw_sp_port, lag_id); +- if (err) +- goto err_col_port_enable; + + mlxsw_core_lag_mapping_set(mlxsw_sp->core, lag_id, port_index, + mlxsw_sp_port->local_port); +@@ -4427,8 +4424,6 @@ static int mlxsw_sp_port_lag_join(struct mlxsw_sp_port *mlxsw_sp_port, + + return 0; + +-err_col_port_enable: +- mlxsw_sp_lag_col_port_remove(mlxsw_sp_port, lag_id); + err_col_port_add: + if (!lag->ref_count) + mlxsw_sp_lag_destroy(mlxsw_sp, lag_id); +@@ -4447,7 +4442,6 @@ static void mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port, + lag = mlxsw_sp_lag_get(mlxsw_sp, lag_id); + WARN_ON(lag->ref_count == 0); + +- mlxsw_sp_lag_col_port_disable(mlxsw_sp_port, lag_id); + mlxsw_sp_lag_col_port_remove(mlxsw_sp_port, lag_id); + + /* Any VLANs configured on the port are no longer valid */ +@@ -4492,21 +4486,56 @@ static int mlxsw_sp_lag_dist_port_remove(struct mlxsw_sp_port *mlxsw_sp_port, + return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sldr), sldr_pl); + } + +-static int mlxsw_sp_port_lag_tx_en_set(struct mlxsw_sp_port *mlxsw_sp_port, +- bool lag_tx_enabled) ++static int ++mlxsw_sp_port_lag_col_dist_enable(struct mlxsw_sp_port *mlxsw_sp_port) + { +- if (lag_tx_enabled) +- return mlxsw_sp_lag_dist_port_add(mlxsw_sp_port, +- mlxsw_sp_port->lag_id); +- else +- return mlxsw_sp_lag_dist_port_remove(mlxsw_sp_port, +- mlxsw_sp_port->lag_id); ++ int err; ++ ++ err = mlxsw_sp_lag_col_port_enable(mlxsw_sp_port, ++ mlxsw_sp_port->lag_id); ++ if (err) ++ return err; ++ ++ err = mlxsw_sp_lag_dist_port_add(mlxsw_sp_port, mlxsw_sp_port->lag_id); ++ if (err) ++ goto err_dist_port_add; ++ ++ return 0; ++ ++err_dist_port_add: ++ mlxsw_sp_lag_col_port_disable(mlxsw_sp_port, mlxsw_sp_port->lag_id); ++ return err; ++} ++ ++static int ++mlxsw_sp_port_lag_col_dist_disable(struct mlxsw_sp_port *mlxsw_sp_port) ++{ ++ int err; ++ ++ err = mlxsw_sp_lag_dist_port_remove(mlxsw_sp_port, ++ mlxsw_sp_port->lag_id); ++ if (err) ++ return err; ++ ++ err = mlxsw_sp_lag_col_port_disable(mlxsw_sp_port, ++ mlxsw_sp_port->lag_id); ++ if (err) ++ goto err_col_port_disable; ++ ++ return 0; ++ ++err_col_port_disable: ++ mlxsw_sp_lag_dist_port_add(mlxsw_sp_port, mlxsw_sp_port->lag_id); ++ return err; + } + + static int mlxsw_sp_port_lag_changed(struct mlxsw_sp_port *mlxsw_sp_port, + struct netdev_lag_lower_state_info *info) + { +- return mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port, info->tx_enabled); ++ if (info->tx_enabled) ++ return mlxsw_sp_port_lag_col_dist_enable(mlxsw_sp_port); ++ else ++ return mlxsw_sp_port_lag_col_dist_disable(mlxsw_sp_port); + } + + static int mlxsw_sp_port_stp_set(struct mlxsw_sp_port *mlxsw_sp_port, +@@ -4668,8 +4697,7 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev, + err = mlxsw_sp_port_lag_join(mlxsw_sp_port, + upper_dev); + } else { +- mlxsw_sp_port_lag_tx_en_set(mlxsw_sp_port, +- false); ++ mlxsw_sp_port_lag_col_dist_disable(mlxsw_sp_port); + mlxsw_sp_port_lag_leave(mlxsw_sp_port, + upper_dev); + } +diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c +index 35f39f23d881..8f8c9ede88c2 100644 +--- a/drivers/net/usb/sr9800.c ++++ b/drivers/net/usb/sr9800.c +@@ -336,7 +336,7 @@ static void sr_set_multicast(struct net_device *net) + static int sr_mdio_read(struct net_device *net, int phy_id, int loc) + { + struct usbnet *dev = netdev_priv(net); +- __le16 res; ++ __le16 res = 0; + + mutex_lock(&dev->phy_mutex); + sr_set_sw_mii(dev); +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 5210cffb5344..2791ef2fd716 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -532,7 +532,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .hw_ops = &wcn3990_ops, + .decap_align_bytes = 1, + .num_peers = TARGET_HL_10_TLV_NUM_PEERS, +- .n_cipher_suites = 8, ++ .n_cipher_suites = 11, + .ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT, + .num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES, + .target_64bit = true, +diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c +index 4defb7a0330f..53b66e9434c9 100644 +--- a/drivers/net/wireless/ath/ath6kl/usb.c ++++ b/drivers/net/wireless/ath/ath6kl/usb.c +@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe) + struct ath6kl_urb_context *urb_context = NULL; + unsigned long flags; + ++ /* bail if this pipe is not initialized */ ++ if (!pipe->ar_usb) ++ return NULL; ++ + spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); + if (!list_empty(&pipe->urb_list_head)) { + urb_context = +@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe, + { + unsigned long flags; + ++ /* bail if this pipe is not initialized */ ++ if (!pipe->ar_usb) ++ return; ++ + spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); + pipe->urb_cnt++; + +diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c +index 3e7fc2983cbb..409a6fa8b6c8 100644 +--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c ++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c +@@ -234,9 +234,10 @@ static int wil_rx_refill_edma(struct wil6210_priv *wil) + struct wil_ring *ring = &wil->ring_rx; + u32 next_head; + int rc = 0; +- u32 swtail = *ring->edma_rx_swtail.va; ++ ring->swtail = *ring->edma_rx_swtail.va; + +- for (; next_head = wil_ring_next_head(ring), (next_head != swtail); ++ for (; next_head = wil_ring_next_head(ring), ++ (next_head != ring->swtail); + ring->swhead = next_head) { + rc = wil_ring_alloc_skb_edma(wil, ring, ring->swhead); + if (unlikely(rc)) { +@@ -264,43 +265,26 @@ static void wil_move_all_rx_buff_to_free_list(struct wil6210_priv *wil, + struct wil_ring *ring) + { + struct device *dev = wil_to_dev(wil); +- u32 next_tail; +- u32 swhead = (ring->swhead + 1) % ring->size; ++ struct list_head *active = &wil->rx_buff_mgmt.active; + dma_addr_t pa; +- u16 dmalen; + +- for (; next_tail = wil_ring_next_tail(ring), (next_tail != swhead); +- ring->swtail = next_tail) { +- struct wil_rx_enhanced_desc dd, *d = ⅆ +- struct wil_rx_enhanced_desc *_d = +- (struct wil_rx_enhanced_desc *) +- &ring->va[ring->swtail].rx.enhanced; +- struct sk_buff *skb; +- u16 buff_id; ++ while (!list_empty(active)) { ++ struct wil_rx_buff *rx_buff = ++ list_first_entry(active, struct wil_rx_buff, list); ++ struct sk_buff *skb = rx_buff->skb; + +- *d = *_d; +- +- /* Extract the SKB from the rx_buff management array */ +- buff_id = __le16_to_cpu(d->mac.buff_id); +- if (buff_id >= wil->rx_buff_mgmt.size) { +- wil_err(wil, "invalid buff_id %d\n", buff_id); +- continue; +- } +- skb = wil->rx_buff_mgmt.buff_arr[buff_id].skb; +- wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL; + if (unlikely(!skb)) { +- wil_err(wil, "No Rx skb at buff_id %d\n", buff_id); ++ wil_err(wil, "No Rx skb at buff_id %d\n", rx_buff->id); + } else { +- pa = wil_rx_desc_get_addr_edma(&d->dma); +- dmalen = le16_to_cpu(d->dma.length); +- dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE); +- ++ rx_buff->skb = NULL; ++ memcpy(&pa, skb->cb, sizeof(pa)); ++ dma_unmap_single(dev, pa, wil->rx_buf_len, ++ DMA_FROM_DEVICE); + kfree_skb(skb); + } + + /* Move the buffer from the active to the free list */ +- list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list, +- &wil->rx_buff_mgmt.free); ++ list_move(&rx_buff->list, &wil->rx_buff_mgmt.free); + } + } + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 9cb9f0544c9b..2eba6d6f367f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -843,15 +843,17 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm) + * firmware versions. Unfortunately, we don't have a TLV API + * flag to rely on, so rely on the major version which is in + * the first byte of ucode_ver. This was implemented +- * initially on version 38 and then backported to29 and 17. +- * The intention was to have it in 36 as well, but not all +- * 8000 family got this feature enabled. The 8000 family is +- * the only one using version 36, so skip this version +- * entirely. ++ * initially on version 38 and then backported to 17. It was ++ * also backported to 29, but only for 7265D devices. The ++ * intention was to have it in 36 as well, but not all 8000 ++ * family got this feature enabled. The 8000 family is the ++ * only one using version 36, so skip this version entirely. + */ + return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 || +- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 || +- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17; ++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17 || ++ (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 && ++ ((mvm->trans->hw_rev & CSR_HW_REV_TYPE_MSK) == ++ CSR_HW_REV_TYPE_7265D)); + } + + int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm) +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index 479a4cfc245d..5f998ea2d5a6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -775,6 +775,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, + return; + } else { + noa_num = (noa_len - 2) / 13; ++ if (noa_num > P2P_MAX_NOA_NUM) ++ noa_num = P2P_MAX_NOA_NUM; ++ + } + noa_index = ie[3]; + if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == +@@ -869,6 +872,9 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, + return; + } else { + noa_num = (noa_len - 2) / 13; ++ if (noa_num > P2P_MAX_NOA_NUM) ++ noa_num = P2P_MAX_NOA_NUM; ++ + } + noa_index = ie[3]; + if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == +diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c +index 5d823e965883..fcb57d64d97e 100644 +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -559,18 +559,25 @@ static int pn533_usb_probe(struct usb_interface *interface, + + rc = pn533_finalize_setup(priv); + if (rc) +- goto error; ++ goto err_deregister; + + usb_set_intfdata(interface, phy); + + return 0; + ++err_deregister: ++ pn533_unregister_device(phy->priv); + error: ++ usb_kill_urb(phy->in_urb); ++ usb_kill_urb(phy->out_urb); ++ usb_kill_urb(phy->ack_urb); ++ + usb_free_urb(phy->in_urb); + usb_free_urb(phy->out_urb); + usb_free_urb(phy->ack_urb); + usb_put_dev(phy->udev); + kfree(in_buf); ++ kfree(phy->ack_buffer); + + return rc; + } +diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c +index e85c5a8206c4..6ac17f0c4077 100644 +--- a/drivers/pci/pcie/pme.c ++++ b/drivers/pci/pcie/pme.c +@@ -437,6 +437,7 @@ static void pcie_pme_remove(struct pcie_device *srv) + + pcie_pme_disable_interrupt(srv->port, data); + free_irq(srv->irq, srv); ++ cancel_work_sync(&data->work); + kfree(data); + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 06be52912dcd..64933994f772 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -5083,8 +5083,8 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev) + pci_disable_device(pdev); + } + #define SWITCHTEC_QUIRK(vid) \ +- DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \ +- quirk_switchtec_ntb_dma_alias) ++ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_MICROSEMI, vid, \ ++ PCI_CLASS_BRIDGE_OTHER, 8, quirk_switchtec_ntb_dma_alias) + + SWITCHTEC_QUIRK(0x8531); /* PFX 24xG3 */ + SWITCHTEC_QUIRK(0x8532); /* PFX 32xG3 */ +diff --git a/drivers/platform/x86/intel_atomisp2_pm.c b/drivers/platform/x86/intel_atomisp2_pm.c +index 9371603a0ac9..b0f421fea2a5 100644 +--- a/drivers/platform/x86/intel_atomisp2_pm.c ++++ b/drivers/platform/x86/intel_atomisp2_pm.c +@@ -33,46 +33,45 @@ + #define ISPSSPM0_IUNIT_POWER_ON 0x0 + #define ISPSSPM0_IUNIT_POWER_OFF 0x3 + +-static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id) ++static int isp_set_power(struct pci_dev *dev, bool enable) + { + unsigned long timeout; +- u32 val; +- +- pci_write_config_dword(dev, PCI_INTERRUPT_CTRL, 0); +- +- /* +- * MRFLD IUNIT DPHY is located in an always-power-on island +- * MRFLD HW design need all CSI ports are disabled before +- * powering down the IUNIT. +- */ +- pci_read_config_dword(dev, PCI_CSI_CONTROL, &val); +- val |= PCI_CSI_CONTROL_PORTS_OFF_MASK; +- pci_write_config_dword(dev, PCI_CSI_CONTROL, val); ++ u32 val = enable ? ISPSSPM0_IUNIT_POWER_ON : ++ ISPSSPM0_IUNIT_POWER_OFF; + +- /* Write 0x3 to ISPSSPM0 bit[1:0] to power off the IUNIT */ ++ /* Write to ISPSSPM0 bit[1:0] to power on/off the IUNIT */ + iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, +- ISPSSPM0_IUNIT_POWER_OFF, ISPSSPM0_ISPSSC_MASK); ++ val, ISPSSPM0_ISPSSC_MASK); + + /* + * There should be no IUNIT access while power-down is + * in progress HW sighting: 4567865 + * Wait up to 50 ms for the IUNIT to shut down. ++ * And we do the same for power on. + */ + timeout = jiffies + msecs_to_jiffies(50); + while (1) { +- /* Wait until ISPSSPM0 bit[25:24] shows 0x3 */ +- iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &val); +- val = (val & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET; +- if (val == ISPSSPM0_IUNIT_POWER_OFF) ++ u32 tmp; ++ ++ /* Wait until ISPSSPM0 bit[25:24] shows the right value */ ++ iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &tmp); ++ tmp = (tmp & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET; ++ if (tmp == val) + break; + + if (time_after(jiffies, timeout)) { +- dev_err(&dev->dev, "IUNIT power-off timeout.\n"); ++ dev_err(&dev->dev, "IUNIT power-%s timeout.\n", ++ enable ? "on" : "off"); + return -EBUSY; + } + usleep_range(1000, 2000); + } + ++ return 0; ++} ++ ++static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id) ++{ + pm_runtime_allow(&dev->dev); + pm_runtime_put_sync_suspend(&dev->dev); + +@@ -87,11 +86,40 @@ static void isp_remove(struct pci_dev *dev) + + static int isp_pci_suspend(struct device *dev) + { ++ struct pci_dev *pdev = to_pci_dev(dev); ++ u32 val; ++ ++ pci_write_config_dword(pdev, PCI_INTERRUPT_CTRL, 0); ++ ++ /* ++ * MRFLD IUNIT DPHY is located in an always-power-on island ++ * MRFLD HW design need all CSI ports are disabled before ++ * powering down the IUNIT. ++ */ ++ pci_read_config_dword(pdev, PCI_CSI_CONTROL, &val); ++ val |= PCI_CSI_CONTROL_PORTS_OFF_MASK; ++ pci_write_config_dword(pdev, PCI_CSI_CONTROL, val); ++ ++ /* ++ * We lose config space access when punit power gates ++ * the ISP. Can't use pci_set_power_state() because ++ * pmcsr won't actually change when we write to it. ++ */ ++ pci_save_state(pdev); ++ pdev->current_state = PCI_D3cold; ++ isp_set_power(pdev, false); ++ + return 0; + } + + static int isp_pci_resume(struct device *dev) + { ++ struct pci_dev *pdev = to_pci_dev(dev); ++ ++ isp_set_power(pdev, true); ++ pdev->current_state = PCI_D0; ++ pci_restore_state(pdev); ++ + return 0; + } + +@@ -99,6 +127,7 @@ static UNIVERSAL_DEV_PM_OPS(isp_pm_ops, isp_pci_suspend, + isp_pci_resume, NULL); + + static const struct pci_device_id isp_id_table[] = { ++ { PCI_VDEVICE(INTEL, 0x0f38), }, + { PCI_VDEVICE(INTEL, 0x22b8), }, + { 0, } + }; +diff --git a/drivers/power/supply/max14656_charger_detector.c b/drivers/power/supply/max14656_charger_detector.c +index d19307f791c6..9e6472834e37 100644 +--- a/drivers/power/supply/max14656_charger_detector.c ++++ b/drivers/power/supply/max14656_charger_detector.c +@@ -240,6 +240,14 @@ static enum power_supply_property max14656_battery_props[] = { + POWER_SUPPLY_PROP_MANUFACTURER, + }; + ++static void stop_irq_work(void *data) ++{ ++ struct max14656_chip *chip = data; ++ ++ cancel_delayed_work_sync(&chip->irq_work); ++} ++ ++ + static int max14656_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { +@@ -278,8 +286,6 @@ static int max14656_probe(struct i2c_client *client, + if (ret) + return -ENODEV; + +- INIT_DELAYED_WORK(&chip->irq_work, max14656_irq_worker); +- + chip->detect_psy = devm_power_supply_register(dev, + &chip->psy_desc, &psy_cfg); + if (IS_ERR(chip->detect_psy)) { +@@ -287,6 +293,13 @@ static int max14656_probe(struct i2c_client *client, + return -EINVAL; + } + ++ INIT_DELAYED_WORK(&chip->irq_work, max14656_irq_worker); ++ ret = devm_add_action(dev, stop_irq_work, chip); ++ if (ret) { ++ dev_err(dev, "devm_add_action %d failed\n", ret); ++ return ret; ++ } ++ + ret = devm_request_irq(dev, chip->irq, max14656_irq, + IRQF_TRIGGER_FALLING, + MAX14656_NAME, chip); +diff --git a/drivers/rtc/rtc-pcf8523.c b/drivers/rtc/rtc-pcf8523.c +index 3fcd2cbafc84..2e03021f15d1 100644 +--- a/drivers/rtc/rtc-pcf8523.c ++++ b/drivers/rtc/rtc-pcf8523.c +@@ -97,8 +97,9 @@ static int pcf8523_voltage_low(struct i2c_client *client) + return !!(value & REG_CONTROL3_BLF); + } + +-static int pcf8523_select_capacitance(struct i2c_client *client, bool high) ++static int pcf8523_load_capacitance(struct i2c_client *client) + { ++ u32 load; + u8 value; + int err; + +@@ -106,14 +107,24 @@ static int pcf8523_select_capacitance(struct i2c_client *client, bool high) + if (err < 0) + return err; + +- if (!high) +- value &= ~REG_CONTROL1_CAP_SEL; +- else ++ load = 12500; ++ of_property_read_u32(client->dev.of_node, "quartz-load-femtofarads", ++ &load); ++ ++ switch (load) { ++ default: ++ dev_warn(&client->dev, "Unknown quartz-load-femtofarads value: %d. Assuming 12500", ++ load); ++ /* fall through */ ++ case 12500: + value |= REG_CONTROL1_CAP_SEL; ++ break; ++ case 7000: ++ value &= ~REG_CONTROL1_CAP_SEL; ++ break; ++ } + + err = pcf8523_write(client, REG_CONTROL1, value); +- if (err < 0) +- return err; + + return err; + } +@@ -347,9 +358,10 @@ static int pcf8523_probe(struct i2c_client *client, + if (!pcf) + return -ENOMEM; + +- err = pcf8523_select_capacitance(client, true); ++ err = pcf8523_load_capacitance(client); + if (err < 0) +- return err; ++ dev_warn(&client->dev, "failed to set xtal load capacitance: %d", ++ err); + + err = pcf8523_set_pm(client, 0); + if (err < 0) +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index e2575c8ec93e..22efefcc6cd8 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1713,7 +1713,11 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + } + tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- wait_for_completion_timeout(&tport_unreg_cmp, 5); ++ if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, ++ msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) ++ lpfc_printf_log(phba, KERN_ERR, LOG_NVME, ++ "6179 Unreg targetport %p timeout " ++ "reached.\n", phba->targetport); + lpfc_nvmet_cleanup_io_context(phba); + } + phba->targetport = NULL; +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h +index 0ec1082ce7ef..3b170284a0e5 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.h ++++ b/drivers/scsi/lpfc/lpfc_nvmet.h +@@ -31,6 +31,8 @@ + #define LPFC_NVMET_MRQ_AUTO 0 + #define LPFC_NVMET_MRQ_MAX 16 + ++#define LPFC_NVMET_WAIT_TMO (5 * MSEC_PER_SEC) ++ + /* Used for NVME Target */ + struct lpfc_nvmet_tgtport { + struct lpfc_hba *phba; +diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c +index 200b5bca1f5f..666495f21c24 100644 +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -4161,7 +4161,7 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn, + /* If pCmd was set to NULL from abort path, do not call scsi_done */ + if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) { + lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP, +- "0711 FCP cmd already NULL, sid: 0x%06x, " ++ "5688 FCP cmd already NULL, sid: 0x%06x, " + "did: 0x%06x, oxid: 0x%04x\n", + vport->fc_myDID, + (pnode) ? pnode->nlp_DID : 0, +diff --git a/drivers/staging/mt7621-pinctrl/Kconfig b/drivers/staging/mt7621-pinctrl/Kconfig +index 37cf9c3273be..fc3612711307 100644 +--- a/drivers/staging/mt7621-pinctrl/Kconfig ++++ b/drivers/staging/mt7621-pinctrl/Kconfig +@@ -2,3 +2,4 @@ config PINCTRL_RT2880 + bool "RT2800 pinctrl driver for RALINK/Mediatek SOCs" + depends on RALINK + select PINMUX ++ select GENERIC_PINCONF +diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c +index aa98fbb17013..80e7067cfb79 100644 +--- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c ++++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c +@@ -11,6 +11,7 @@ + #include <linux/of.h> + #include <linux/pinctrl/pinctrl.h> + #include <linux/pinctrl/pinconf.h> ++#include <linux/pinctrl/pinconf-generic.h> + #include <linux/pinctrl/pinmux.h> + #include <linux/pinctrl/consumer.h> + #include <linux/pinctrl/machine.h> +@@ -73,48 +74,12 @@ static int rt2880_get_group_pins(struct pinctrl_dev *pctrldev, + return 0; + } + +-static int rt2880_pinctrl_dt_node_to_map(struct pinctrl_dev *pctrldev, +- struct device_node *np_config, +- struct pinctrl_map **map, +- unsigned int *num_maps) +-{ +- struct rt2880_priv *p = pinctrl_dev_get_drvdata(pctrldev); +- struct property *prop; +- const char *function_name, *group_name; +- int ret; +- int ngroups = 0; +- unsigned int reserved_maps = 0; +- +- for_each_node_with_property(np_config, "group") +- ngroups++; +- +- *map = NULL; +- ret = pinctrl_utils_reserve_map(pctrldev, map, &reserved_maps, +- num_maps, ngroups); +- if (ret) { +- dev_err(p->dev, "can't reserve map: %d\n", ret); +- return ret; +- } +- +- of_property_for_each_string(np_config, "group", prop, group_name) { +- ret = pinctrl_utils_add_map_mux(pctrldev, map, &reserved_maps, +- num_maps, group_name, +- function_name); +- if (ret) { +- dev_err(p->dev, "can't add map: %d\n", ret); +- return ret; +- } +- } +- +- return 0; +-} +- + static const struct pinctrl_ops rt2880_pctrl_ops = { + .get_groups_count = rt2880_get_group_count, + .get_group_name = rt2880_get_group_name, + .get_group_pins = rt2880_get_group_pins, +- .dt_node_to_map = rt2880_pinctrl_dt_node_to_map, +- .dt_free_map = pinctrl_utils_free_map, ++ .dt_node_to_map = pinconf_generic_dt_node_to_map_all, ++ .dt_free_map = pinconf_generic_dt_free_map, + }; + + static int rt2880_pmx_func_count(struct pinctrl_dev *pctrldev) +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index dfee6985efa6..8ef7b44b6abc 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -348,8 +348,10 @@ static struct adapter *rtw_usb_if1_init(struct dvobj_priv *dvobj, + } + + padapter->HalData = kzalloc(sizeof(struct hal_data_8188e), GFP_KERNEL); +- if (!padapter->HalData) +- DBG_88E("cant not alloc memory for HAL DATA\n"); ++ if (!padapter->HalData) { ++ DBG_88E("Failed to allocate memory for HAL data\n"); ++ goto free_adapter; ++ } + + /* step read_chip_version */ + rtw_hal_read_chip_version(padapter); +diff --git a/drivers/target/iscsi/cxgbit/cxgbit_cm.c b/drivers/target/iscsi/cxgbit/cxgbit_cm.c +index b19c960d5490..d46eee369864 100644 +--- a/drivers/target/iscsi/cxgbit/cxgbit_cm.c ++++ b/drivers/target/iscsi/cxgbit/cxgbit_cm.c +@@ -1832,7 +1832,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb) + + while (credits) { + struct sk_buff *p = cxgbit_sock_peek_wr(csk); +- const u32 csum = (__force u32)p->csum; ++ u32 csum; + + if (unlikely(!p)) { + pr_err("csk 0x%p,%u, cr %u,%u+%u, empty.\n", +@@ -1841,6 +1841,7 @@ static void cxgbit_fw4_ack(struct cxgbit_sock *csk, struct sk_buff *skb) + break; + } + ++ csum = (__force u32)p->csum; + if (unlikely(credits < csum)) { + pr_warn("csk 0x%p,%u, cr %u,%u+%u, < %u.\n", + csk, csk->tid, +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 5cd6bdfa068f..d436a1534fc2 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -142,9 +142,20 @@ static void __iomem *ring_options_base(struct tb_ring *ring) + return io; + } + +-static void ring_iowrite16desc(struct tb_ring *ring, u32 value, u32 offset) ++static void ring_iowrite_cons(struct tb_ring *ring, u16 cons) + { +- iowrite16(value, ring_desc_base(ring) + offset); ++ /* ++ * The other 16-bits in the register is read-only and writes to it ++ * are ignored by the hardware so we can save one ioread32() by ++ * filling the read-only bits with zeroes. ++ */ ++ iowrite32(cons, ring_desc_base(ring) + 8); ++} ++ ++static void ring_iowrite_prod(struct tb_ring *ring, u16 prod) ++{ ++ /* See ring_iowrite_cons() above for explanation */ ++ iowrite32(prod << 16, ring_desc_base(ring) + 8); + } + + static void ring_iowrite32desc(struct tb_ring *ring, u32 value, u32 offset) +@@ -196,7 +207,10 @@ static void ring_write_descriptors(struct tb_ring *ring) + descriptor->sof = frame->sof; + } + ring->head = (ring->head + 1) % ring->size; +- ring_iowrite16desc(ring, ring->head, ring->is_tx ? 10 : 8); ++ if (ring->is_tx) ++ ring_iowrite_prod(ring, ring->head); ++ else ++ ring_iowrite_cons(ring, ring->head); + } + } + +@@ -660,7 +674,7 @@ void tb_ring_stop(struct tb_ring *ring) + + ring_iowrite32options(ring, 0, 0); + ring_iowrite64desc(ring, 0, 0); +- ring_iowrite16desc(ring, 0, ring->is_tx ? 10 : 8); ++ ring_iowrite32desc(ring, 0, 8); + ring_iowrite32desc(ring, 0, 12); + ring->head = 0; + ring->tail = 0; +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index bb63519db7ae..c943716c019e 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -968,6 +968,11 @@ static int __init n_hdlc_init(void) + + } /* end of init_module() */ + ++#ifdef CONFIG_SPARC ++#undef __exitdata ++#define __exitdata ++#endif ++ + static const char hdlc_unregister_ok[] __exitdata = + KERN_INFO "N_HDLC: line discipline unregistered\n"; + static const char hdlc_unregister_fail[] __exitdata = +diff --git a/drivers/tty/serial/owl-uart.c b/drivers/tty/serial/owl-uart.c +index 29a6dc6a8d23..73fcc6bdb031 100644 +--- a/drivers/tty/serial/owl-uart.c ++++ b/drivers/tty/serial/owl-uart.c +@@ -742,7 +742,7 @@ static int __init owl_uart_init(void) + return ret; + } + +-static void __init owl_uart_exit(void) ++static void __exit owl_uart_exit(void) + { + platform_driver_unregister(&owl_uart_platform_driver); + uart_unregister_driver(&owl_uart_driver); +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index 372cc7ff228f..ebea4a9d8e69 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -328,6 +328,7 @@ struct sc16is7xx_port { + struct kthread_worker kworker; + struct task_struct *kworker_task; + struct kthread_work irq_work; ++ struct mutex efr_lock; + struct sc16is7xx_one p[0]; + }; + +@@ -499,6 +500,21 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) + div /= 4; + } + ++ /* In an amazing feat of design, the Enhanced Features Register shares ++ * the address of the Interrupt Identification Register, and is ++ * switched in by writing a magic value (0xbf) to the Line Control ++ * Register. Any interrupt firing during this time will see the EFR ++ * where it expects the IIR to be, leading to "Unexpected interrupt" ++ * messages. ++ * ++ * Prevent this possibility by claiming a mutex while accessing the ++ * EFR, and claiming the same mutex from within the interrupt handler. ++ * This is similar to disabling the interrupt, but that doesn't work ++ * because the bulk of the interrupt processing is run as a workqueue ++ * job in thread context. ++ */ ++ mutex_lock(&s->efr_lock); ++ + lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG); + + /* Open the LCR divisors for configuration */ +@@ -514,6 +530,8 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud) + /* Put LCR back to the normal mode */ + sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + ++ mutex_unlock(&s->efr_lock); ++ + sc16is7xx_port_update(port, SC16IS7XX_MCR_REG, + SC16IS7XX_MCR_CLKSEL_BIT, + prescaler); +@@ -696,6 +714,8 @@ static void sc16is7xx_ist(struct kthread_work *ws) + { + struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); + ++ mutex_lock(&s->efr_lock); ++ + while (1) { + bool keep_polling = false; + int i; +@@ -705,6 +725,8 @@ static void sc16is7xx_ist(struct kthread_work *ws) + if (!keep_polling) + break; + } ++ ++ mutex_unlock(&s->efr_lock); + } + + static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) +@@ -899,6 +921,9 @@ static void sc16is7xx_set_termios(struct uart_port *port, + if (!(termios->c_cflag & CREAD)) + port->ignore_status_mask |= SC16IS7XX_LSR_BRK_ERROR_MASK; + ++ /* As above, claim the mutex while accessing the EFR. */ ++ mutex_lock(&s->efr_lock); ++ + sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, + SC16IS7XX_LCR_CONF_MODE_B); + +@@ -920,6 +945,8 @@ static void sc16is7xx_set_termios(struct uart_port *port, + /* Update LCR register */ + sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr); + ++ mutex_unlock(&s->efr_lock); ++ + /* Get baud rate generator configuration */ + baud = uart_get_baud_rate(port, termios, old, + port->uartclk / 16 / 4 / 0xffff, +@@ -1185,6 +1212,7 @@ static int sc16is7xx_probe(struct device *dev, + s->regmap = regmap; + s->devtype = devtype; + dev_set_drvdata(dev, s); ++ mutex_init(&s->efr_lock); + + kthread_init_worker(&s->kworker); + kthread_init_work(&s->irq_work, sc16is7xx_ist); +diff --git a/drivers/tty/serial/serial_mctrl_gpio.c b/drivers/tty/serial/serial_mctrl_gpio.c +index 07f318603e74..af0412a784d2 100644 +--- a/drivers/tty/serial/serial_mctrl_gpio.c ++++ b/drivers/tty/serial/serial_mctrl_gpio.c +@@ -60,6 +60,9 @@ EXPORT_SYMBOL_GPL(mctrl_gpio_set); + struct gpio_desc *mctrl_gpio_to_gpiod(struct mctrl_gpios *gpios, + enum mctrl_gpio_idx gidx) + { ++ if (gpios == NULL) ++ return NULL; ++ + return gpios->gpio[gidx]; + } + EXPORT_SYMBOL_GPL(mctrl_gpio_to_gpiod); +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 8018f813972e..d5fbd36cf462 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -107,6 +107,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem); + static void hub_release(struct kref *kref); + static int usb_reset_and_verify_device(struct usb_device *udev); + static int hub_port_disable(struct usb_hub *hub, int port1, int set_state); ++static bool hub_port_warm_reset_required(struct usb_hub *hub, int port1, ++ u16 portstatus); + + static inline char *portspeed(struct usb_hub *hub, int portstatus) + { +@@ -1111,6 +1113,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + USB_PORT_FEAT_ENABLE); + } + ++ /* Make sure a warm-reset request is handled by port_event */ ++ if (type == HUB_RESUME && ++ hub_port_warm_reset_required(hub, port1, portstatus)) ++ set_bit(port1, hub->event_bits); ++ + /* + * Add debounce if USB3 link is in polling/link training state. + * Link will automatically transition to Enabled state after +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index aad7edc29bdd..a5c8329fd462 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -3568,6 +3568,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + u32 port_status; + u32 speed; + u32 pcgctl; ++ u32 pwr; + + switch (typereq) { + case ClearHubFeature: +@@ -3616,8 +3617,11 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + dev_dbg(hsotg->dev, + "ClearPortFeature USB_PORT_FEAT_POWER\n"); + hprt0 = dwc2_read_hprt0(hsotg); ++ pwr = hprt0 & HPRT0_PWR; + hprt0 &= ~HPRT0_PWR; + dwc2_writel(hsotg, hprt0, HPRT0); ++ if (pwr) ++ dwc2_vbus_supply_exit(hsotg); + break; + + case USB_PORT_FEAT_INDICATOR: +@@ -3827,8 +3831,11 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + dev_dbg(hsotg->dev, + "SetPortFeature - USB_PORT_FEAT_POWER\n"); + hprt0 = dwc2_read_hprt0(hsotg); ++ pwr = hprt0 & HPRT0_PWR; + hprt0 |= HPRT0_PWR; + dwc2_writel(hsotg, hprt0, HPRT0); ++ if (!pwr) ++ dwc2_vbus_supply_init(hsotg); + break; + + case USB_PORT_FEAT_RESET: +@@ -3845,6 +3852,7 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + dwc2_writel(hsotg, 0, PCGCTL); + + hprt0 = dwc2_read_hprt0(hsotg); ++ pwr = hprt0 & HPRT0_PWR; + /* Clear suspend bit if resetting from suspend state */ + hprt0 &= ~HPRT0_SUSP; + +@@ -3858,6 +3866,8 @@ static int dwc2_hcd_hub_control(struct dwc2_hsotg *hsotg, u16 typereq, + dev_dbg(hsotg->dev, + "In host mode, hprt0=%08x\n", hprt0); + dwc2_writel(hsotg, hprt0, HPRT0); ++ if (!pwr) ++ dwc2_vbus_supply_init(hsotg); + } + + /* Clear reset bit in 10ms (FS/LS) or 50ms (HS) */ +@@ -4400,6 +4410,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd) + struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd); + struct usb_bus *bus = hcd_to_bus(hcd); + unsigned long flags; ++ u32 hprt0; + int ret; + + dev_dbg(hsotg->dev, "DWC OTG HCD START\n"); +@@ -4416,12 +4427,16 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd) + + dwc2_hcd_reinit(hsotg); + +- /* enable external vbus supply before resuming root hub */ +- spin_unlock_irqrestore(&hsotg->lock, flags); +- ret = dwc2_vbus_supply_init(hsotg); +- if (ret) +- return ret; +- spin_lock_irqsave(&hsotg->lock, flags); ++ hprt0 = dwc2_read_hprt0(hsotg); ++ /* Has vbus power been turned on in dwc2_core_host_init ? */ ++ if (hprt0 & HPRT0_PWR) { ++ /* Enable external vbus supply before resuming root hub */ ++ spin_unlock_irqrestore(&hsotg->lock, flags); ++ ret = dwc2_vbus_supply_init(hsotg); ++ if (ret) ++ return ret; ++ spin_lock_irqsave(&hsotg->lock, flags); ++ } + + /* Initialize and connect root hub if one is not already attached */ + if (bus->root_hub) { +@@ -4443,6 +4458,7 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd) + { + struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd); + unsigned long flags; ++ u32 hprt0; + + /* Turn off all host-specific interrupts */ + dwc2_disable_host_interrupts(hsotg); +@@ -4451,6 +4467,7 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd) + synchronize_irq(hcd->irq); + + spin_lock_irqsave(&hsotg->lock, flags); ++ hprt0 = dwc2_read_hprt0(hsotg); + /* Ensure hcd is disconnected */ + dwc2_hcd_disconnect(hsotg, true); + dwc2_hcd_stop(hsotg); +@@ -4459,7 +4476,9 @@ static void _dwc2_hcd_stop(struct usb_hcd *hcd) + clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); + spin_unlock_irqrestore(&hsotg->lock, flags); + +- dwc2_vbus_supply_exit(hsotg); ++ /* keep balanced supply init/exit by checking HPRT0_PWR */ ++ if (hprt0 & HPRT0_PWR) ++ dwc2_vbus_supply_exit(hsotg); + + usleep_range(1000, 3000); + } +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index e7461c995116..54de73255064 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -375,19 +375,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd, + + trace_dwc3_gadget_ep_cmd(dep, cmd, params, cmd_status); + +- if (ret == 0) { +- switch (DWC3_DEPCMD_CMD(cmd)) { +- case DWC3_DEPCMD_STARTTRANSFER: +- dep->flags |= DWC3_EP_TRANSFER_STARTED; +- dwc3_gadget_ep_get_transfer_index(dep); +- break; +- case DWC3_DEPCMD_ENDTRANSFER: +- dep->flags &= ~DWC3_EP_TRANSFER_STARTED; +- break; +- default: +- /* nothing */ +- break; +- } ++ if (ret == 0 && DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_STARTTRANSFER) { ++ dep->flags |= DWC3_EP_TRANSFER_STARTED; ++ dwc3_gadget_ep_get_transfer_index(dep); + } + + if (unlikely(susphy)) { +@@ -1410,7 +1400,10 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, + goto out0; + + dwc3_gadget_move_cancelled_request(req); +- goto out0; ++ if (dep->flags & DWC3_EP_TRANSFER_STARTED) ++ goto out0; ++ else ++ goto out1; + } + dev_err(dwc->dev, "request %pK was not queued to %s\n", + request, ep->name); +@@ -1418,6 +1411,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, + goto out0; + } + ++out1: + dwc3_gadget_giveback(dep, req, -ECONNRESET); + + out0: +@@ -2413,7 +2407,8 @@ static void dwc3_endpoint_interrupt(struct dwc3 *dwc, + cmd = DEPEVT_PARAMETER_CMD(event->parameters); + + if (cmd == DWC3_DEPCMD_ENDTRANSFER) { +- dep->flags &= ~DWC3_EP_END_TRANSFER_PENDING; ++ dep->flags &= ~(DWC3_EP_END_TRANSFER_PENDING | ++ DWC3_EP_TRANSFER_STARTED); + dwc3_gadget_ep_cleanup_cancelled_requests(dep); + } + break; +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index af88b48c1cea..aa31d36bed00 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -98,6 +98,17 @@ int usb_ep_enable(struct usb_ep *ep) + if (ep->enabled) + goto out; + ++ /* UDC drivers can't handle endpoints with maxpacket size 0 */ ++ if (usb_endpoint_maxp(ep->desc) == 0) { ++ /* ++ * We should log an error message here, but we can't call ++ * dev_err() because there's no way to find the gadget ++ * given only ep. ++ */ ++ ret = -EINVAL; ++ goto out; ++ } ++ + ret = ep->ops->enable(ep, ep->desc); + if (ret) + goto out; +diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c +index 7ba6afc7ef23..76c3f29562d2 100644 +--- a/drivers/usb/host/xhci-debugfs.c ++++ b/drivers/usb/host/xhci-debugfs.c +@@ -202,10 +202,10 @@ static void xhci_ring_dump_segment(struct seq_file *s, + trb = &seg->trbs[i]; + dma = seg->dma + i * sizeof(*trb); + seq_printf(s, "%pad: %s\n", &dma, +- xhci_decode_trb(trb->generic.field[0], +- trb->generic.field[1], +- trb->generic.field[2], +- trb->generic.field[3])); ++ xhci_decode_trb(le32_to_cpu(trb->generic.field[0]), ++ le32_to_cpu(trb->generic.field[1]), ++ le32_to_cpu(trb->generic.field[2]), ++ le32_to_cpu(trb->generic.field[3]))); + } + } + +@@ -263,10 +263,10 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused) + xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); + slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx); + seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma, +- xhci_decode_slot_context(slot_ctx->dev_info, +- slot_ctx->dev_info2, +- slot_ctx->tt_info, +- slot_ctx->dev_state)); ++ xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info), ++ le32_to_cpu(slot_ctx->dev_info2), ++ le32_to_cpu(slot_ctx->tt_info), ++ le32_to_cpu(slot_ctx->dev_state))); + + return 0; + } +@@ -286,10 +286,10 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused) + ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci); + dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params); + seq_printf(s, "%pad: %s\n", &dma, +- xhci_decode_ep_context(ep_ctx->ep_info, +- ep_ctx->ep_info2, +- ep_ctx->deq, +- ep_ctx->tx_info)); ++ xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info), ++ le32_to_cpu(ep_ctx->ep_info2), ++ le64_to_cpu(ep_ctx->deq), ++ le32_to_cpu(ep_ctx->tx_info))); + } + + return 0; +diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c +index 6b3a6fd7d271..320b06e0724b 100644 +--- a/drivers/usb/misc/ldusb.c ++++ b/drivers/usb/misc/ldusb.c +@@ -495,11 +495,11 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count, + retval = -EFAULT; + goto unlock_exit; + } +- dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size; +- + retval = bytes_to_read; + + spin_lock_irq(&dev->rbsl); ++ dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size; ++ + if (dev->buffer_overflow) { + dev->buffer_overflow = 0; + spin_unlock_irq(&dev->rbsl); +@@ -580,7 +580,7 @@ static ssize_t ld_usb_write(struct file *file, const char __user *buffer, + 1 << 8, 0, + dev->interrupt_out_buffer, + bytes_to_write, +- USB_CTRL_SET_TIMEOUT * HZ); ++ USB_CTRL_SET_TIMEOUT); + if (retval < 0) + dev_err(&dev->intf->dev, + "Couldn't submit HID_REQ_SET_REPORT %d\n", +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c +index 62dab2441ec4..23061f1526b4 100644 +--- a/drivers/usb/misc/legousbtower.c ++++ b/drivers/usb/misc/legousbtower.c +@@ -878,7 +878,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + get_version_reply, + sizeof(*get_version_reply), + 1000); +- if (result < sizeof(*get_version_reply)) { ++ if (result != sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); +diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c +index 1c7b46a8620c..16b275123f10 100644 +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -571,6 +571,10 @@ static int firm_send_command(struct usb_serial_port *port, __u8 command, + + command_port = port->serial->port[COMMAND_PORT]; + command_info = usb_get_serial_port_data(command_port); ++ ++ if (command_port->bulk_out_size < datasize + 1) ++ return -EIO; ++ + mutex_lock(&command_info->mutex); + command_info->command_finished = false; + +@@ -644,6 +648,7 @@ static void firm_setup_port(struct tty_struct *tty) + struct device *dev = &port->dev; + struct whiteheat_port_settings port_settings; + unsigned int cflag = tty->termios.c_cflag; ++ speed_t baud; + + port_settings.port = port->port_number + 1; + +@@ -704,11 +709,13 @@ static void firm_setup_port(struct tty_struct *tty) + dev_dbg(dev, "%s - XON = %2x, XOFF = %2x\n", __func__, port_settings.xon, port_settings.xoff); + + /* get the baud rate wanted */ +- port_settings.baud = tty_get_baud_rate(tty); +- dev_dbg(dev, "%s - baud rate = %d\n", __func__, port_settings.baud); ++ baud = tty_get_baud_rate(tty); ++ port_settings.baud = cpu_to_le32(baud); ++ dev_dbg(dev, "%s - baud rate = %u\n", __func__, baud); + + /* fixme: should set validated settings */ +- tty_encode_baud_rate(tty, port_settings.baud, port_settings.baud); ++ tty_encode_baud_rate(tty, baud, baud); ++ + /* handle any settings that aren't specified in the tty structure */ + port_settings.lloop = 0; + +diff --git a/drivers/usb/serial/whiteheat.h b/drivers/usb/serial/whiteheat.h +index 72c1b0cf4063..56a3e8323f33 100644 +--- a/drivers/usb/serial/whiteheat.h ++++ b/drivers/usb/serial/whiteheat.h +@@ -87,7 +87,7 @@ struct whiteheat_simple { + + struct whiteheat_port_settings { + __u8 port; /* port number (1 to N) */ +- __u32 baud; /* any value 7 - 460800, firmware calculates ++ __le32 baud; /* any value 7 - 460800, firmware calculates + best fit; arrives little endian */ + __u8 bits; /* 5, 6, 7, or 8 */ + __u8 stop; /* 1 or 2, default 1 (2 = 1.5 if bits = 5) */ +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 59d82b45e758..f287ee8183df 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -65,7 +65,6 @@ static const char* host_info(struct Scsi_Host *host) + static int slave_alloc (struct scsi_device *sdev) + { + struct us_data *us = host_to_us(sdev->host); +- int maxp; + + /* + * Set the INQUIRY transfer length to 36. We don't use any of +@@ -74,15 +73,6 @@ static int slave_alloc (struct scsi_device *sdev) + */ + sdev->inquiry_len = 36; + +- /* +- * USB has unusual scatter-gather requirements: the length of each +- * scatterlist element except the last must be divisible by the +- * Bulk maxpacket value. Fortunately this value is always a +- * power of 2. Inform the block layer about this requirement. +- */ +- maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0); +- blk_queue_virt_boundary(sdev->request_queue, maxp - 1); +- + /* + * Some host controllers may have alignment requirements. + * We'll play it safe by requiring 512-byte alignment always. +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 5b1d09367475..bad391da4b8e 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -796,29 +796,9 @@ static int uas_slave_alloc(struct scsi_device *sdev) + { + struct uas_dev_info *devinfo = + (struct uas_dev_info *)sdev->host->hostdata; +- int maxp; + + sdev->hostdata = devinfo; + +- /* +- * We have two requirements here. We must satisfy the requirements +- * of the physical HC and the demands of the protocol, as we +- * definitely want no additional memory allocation in this path +- * ruling out using bounce buffers. +- * +- * For a transmission on USB to continue we must never send +- * a package that is smaller than maxpacket. Hence the length of each +- * scatterlist element except the last must be divisible by the +- * Bulk maxpacket value. +- * If the HC does not ensure that through SG, +- * the upper layer must do that. We must assume nothing +- * about the capabilities off the HC, so we use the most +- * pessimistic requirement. +- */ +- +- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0); +- blk_queue_virt_boundary(sdev->request_queue, maxp - 1); +- + /* + * The protocol has no requirements on alignment in the strict sense. + * Controllers may or may not have alignment restrictions. +diff --git a/drivers/virt/vboxguest/vboxguest_utils.c b/drivers/virt/vboxguest/vboxguest_utils.c +index bf4474214b4d..92091006589a 100644 +--- a/drivers/virt/vboxguest/vboxguest_utils.c ++++ b/drivers/virt/vboxguest/vboxguest_utils.c +@@ -217,6 +217,8 @@ static int hgcm_call_preprocess_linaddr( + if (!bounce_buf) + return -ENOMEM; + ++ *bounce_buf_ret = bounce_buf; ++ + if (copy_in) { + ret = copy_from_user(bounce_buf, (void __user *)buf, len); + if (ret) +@@ -225,7 +227,6 @@ static int hgcm_call_preprocess_linaddr( + memset(bounce_buf, 0, len); + } + +- *bounce_buf_ret = bounce_buf; + hgcm_call_add_pagelist_size(bounce_buf, len, extra); + return 0; + } +diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c +index 7cde3f46ad26..e996174cbfc0 100644 +--- a/fs/binfmt_script.c ++++ b/fs/binfmt_script.c +@@ -14,13 +14,30 @@ + #include <linux/err.h> + #include <linux/fs.h> + ++static inline bool spacetab(char c) { return c == ' ' || c == '\t'; } ++static inline char *next_non_spacetab(char *first, const char *last) ++{ ++ for (; first <= last; first++) ++ if (!spacetab(*first)) ++ return first; ++ return NULL; ++} ++static inline char *next_terminator(char *first, const char *last) ++{ ++ for (; first <= last; first++) ++ if (spacetab(*first) || !*first) ++ return first; ++ return NULL; ++} ++ + static int load_script(struct linux_binprm *bprm) + { + const char *i_arg, *i_name; +- char *cp; ++ char *cp, *buf_end; + struct file *file; + int retval; + ++ /* Not ours to exec if we don't start with "#!". */ + if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!')) + return -ENOEXEC; + +@@ -33,18 +50,40 @@ static int load_script(struct linux_binprm *bprm) + if (bprm->interp_flags & BINPRM_FLAGS_PATH_INACCESSIBLE) + return -ENOENT; + +- /* +- * This section does the #! interpretation. +- * Sorta complicated, but hopefully it will work. -TYT +- */ +- ++ /* Release since we are not mapping a binary into memory. */ + allow_write_access(bprm->file); + fput(bprm->file); + bprm->file = NULL; + +- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0'; +- if ((cp = strchr(bprm->buf, '\n')) == NULL) +- cp = bprm->buf+BINPRM_BUF_SIZE-1; ++ /* ++ * This section handles parsing the #! line into separate ++ * interpreter path and argument strings. We must be careful ++ * because bprm->buf is not yet guaranteed to be NUL-terminated ++ * (though the buffer will have trailing NUL padding when the ++ * file size was smaller than the buffer size). ++ * ++ * We do not want to exec a truncated interpreter path, so either ++ * we find a newline (which indicates nothing is truncated), or ++ * we find a space/tab/NUL after the interpreter path (which ++ * itself may be preceded by spaces/tabs). Truncating the ++ * arguments is fine: the interpreter can re-read the script to ++ * parse them on its own. ++ */ ++ buf_end = bprm->buf + sizeof(bprm->buf) - 1; ++ cp = strnchr(bprm->buf, sizeof(bprm->buf), '\n'); ++ if (!cp) { ++ cp = next_non_spacetab(bprm->buf + 2, buf_end); ++ if (!cp) ++ return -ENOEXEC; /* Entire buf is spaces/tabs */ ++ /* ++ * If there is no later space/tab/NUL we must assume the ++ * interpreter path is truncated. ++ */ ++ if (!next_terminator(cp, buf_end)) ++ return -ENOEXEC; ++ cp = buf_end; ++ } ++ /* NUL-terminate the buffer and any trailing spaces/tabs. */ + *cp = '\0'; + while (cp > bprm->buf) { + cp--; +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index faca485ccd8f..cc2d268e2cd7 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2747,8 +2747,7 @@ int btrfs_subvolume_reserve_metadata(struct btrfs_root *root, + int nitems, bool use_global_rsv); + void btrfs_subvolume_release_metadata(struct btrfs_fs_info *fs_info, + struct btrfs_block_rsv *rsv); +-void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes, +- bool qgroup_free); ++void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes); + + int btrfs_delalloc_reserve_metadata(struct btrfs_inode *inode, u64 num_bytes); + void btrfs_delalloc_release_metadata(struct btrfs_inode *inode, u64 num_bytes, +@@ -3178,6 +3177,9 @@ void btrfs_destroy_inode(struct inode *inode); + int btrfs_drop_inode(struct inode *inode); + int __init btrfs_init_cachep(void); + void __cold btrfs_destroy_cachep(void); ++struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location, ++ struct btrfs_root *root, int *new, ++ struct btrfs_path *path); + struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, + struct btrfs_root *root, int *was_new); + struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 72c745682996..024dd336b20a 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -5980,8 +5980,7 @@ void btrfs_delalloc_release_metadata(struct btrfs_inode *inode, u64 num_bytes, + * temporarily tracked outstanding_extents. This _must_ be used in conjunction + * with btrfs_delalloc_reserve_metadata. + */ +-void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes, +- bool qgroup_free) ++void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes) + { + struct btrfs_fs_info *fs_info = inode->root->fs_info; + unsigned num_extents; +@@ -5995,7 +5994,7 @@ void btrfs_delalloc_release_extents(struct btrfs_inode *inode, u64 num_bytes, + if (btrfs_is_testing(fs_info)) + return; + +- btrfs_inode_rsv_release(inode, qgroup_free); ++ btrfs_inode_rsv_release(inode, true); + } + + /** +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 4870440d6424..a456801e0cd5 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1591,7 +1591,6 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb, + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_root *root = BTRFS_I(inode)->root; + struct page **pages = NULL; +- struct extent_state *cached_state = NULL; + struct extent_changeset *data_reserved = NULL; + u64 release_bytes = 0; + u64 lockstart; +@@ -1612,6 +1611,7 @@ static noinline ssize_t btrfs_buffered_write(struct kiocb *iocb, + + while (iov_iter_count(i) > 0) { + size_t offset = pos & (PAGE_SIZE - 1); ++ struct extent_state *cached_state = NULL; + size_t sector_offset; + size_t write_bytes = min(iov_iter_count(i), + nrptrs * (size_t)PAGE_SIZE - +@@ -1692,7 +1692,7 @@ again: + force_page_uptodate); + if (ret) { + btrfs_delalloc_release_extents(BTRFS_I(inode), +- reserve_bytes, true); ++ reserve_bytes); + break; + } + +@@ -1704,7 +1704,7 @@ again: + if (extents_locked == -EAGAIN) + goto again; + btrfs_delalloc_release_extents(BTRFS_I(inode), +- reserve_bytes, true); ++ reserve_bytes); + ret = extents_locked; + break; + } +@@ -1758,11 +1758,21 @@ again: + if (copied > 0) + ret = btrfs_dirty_pages(inode, pages, dirty_pages, + pos, copied, &cached_state); ++ ++ /* ++ * If we have not locked the extent range, because the range's ++ * start offset is >= i_size, we might still have a non-NULL ++ * cached extent state, acquired while marking the extent range ++ * as delalloc through btrfs_dirty_pages(). Therefore free any ++ * possible cached extent state to avoid a memory leak. ++ */ + if (extents_locked) + unlock_extent_cached(&BTRFS_I(inode)->io_tree, + lockstart, lockend, &cached_state); +- btrfs_delalloc_release_extents(BTRFS_I(inode), reserve_bytes, +- true); ++ else ++ free_extent_state(cached_state); ++ ++ btrfs_delalloc_release_extents(BTRFS_I(inode), reserve_bytes); + if (ret) { + btrfs_drop_pages(pages, num_pages); + break; +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 4381e0aba8c0..ec01bd38d675 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -75,7 +75,8 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root, + * sure NOFS is set to keep us from deadlocking. + */ + nofs_flag = memalloc_nofs_save(); +- inode = btrfs_iget(fs_info->sb, &location, root, NULL); ++ inode = btrfs_iget_path(fs_info->sb, &location, root, NULL, path); ++ btrfs_release_path(path); + memalloc_nofs_restore(nofs_flag); + if (IS_ERR(inode)) + return inode; +@@ -839,6 +840,25 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info, + path->search_commit_root = 1; + path->skip_locking = 1; + ++ /* ++ * We must pass a path with search_commit_root set to btrfs_iget in ++ * order to avoid a deadlock when allocating extents for the tree root. ++ * ++ * When we are COWing an extent buffer from the tree root, when looking ++ * for a free extent, at extent-tree.c:find_free_extent(), we can find ++ * block group without its free space cache loaded. When we find one ++ * we must load its space cache which requires reading its free space ++ * cache's inode item from the root tree. If this inode item is located ++ * in the same leaf that we started COWing before, then we end up in ++ * deadlock on the extent buffer (trying to read lock it when we ++ * previously write locked it). ++ * ++ * It's safe to read the inode item using the commit root because ++ * block groups, once loaded, stay in memory forever (until they are ++ * removed) as well as their space caches once loaded. New block groups ++ * once created get their ->cached field set to BTRFS_CACHE_FINISHED so ++ * we will never try to read their inode item while the fs is mounted. ++ */ + inode = lookup_free_space_inode(fs_info, block_group, path); + if (IS_ERR(inode)) { + btrfs_free_path(path); +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index ffca2abf13d0..e1b50c62ba65 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -483,12 +483,13 @@ again: + ret = btrfs_prealloc_file_range_trans(inode, trans, 0, 0, prealloc, + prealloc, prealloc, &alloc_hint); + if (ret) { +- btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc, true); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc); ++ btrfs_delalloc_release_metadata(BTRFS_I(inode), prealloc, true); + goto out_put; + } + + ret = btrfs_write_out_ino_cache(root, trans, path, inode); +- btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc, false); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), prealloc); + out_put: + iput(inode); + out_release: +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 37332f83a3a9..f0f7bc5d2e4a 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -2166,7 +2166,7 @@ again: + + ClearPageChecked(page); + set_page_dirty(page); +- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, false); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE); + out: + unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end, + &cached_state); +@@ -3607,10 +3607,11 @@ static noinline int acls_after_inode_item(struct extent_buffer *leaf, + /* + * read an inode from the btree into the in-memory inode + */ +-static int btrfs_read_locked_inode(struct inode *inode) ++static int btrfs_read_locked_inode(struct inode *inode, ++ struct btrfs_path *in_path) + { + struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); +- struct btrfs_path *path; ++ struct btrfs_path *path = in_path; + struct extent_buffer *leaf; + struct btrfs_inode_item *inode_item; + struct btrfs_root *root = BTRFS_I(inode)->root; +@@ -3626,15 +3627,18 @@ static int btrfs_read_locked_inode(struct inode *inode) + if (!ret) + filled = true; + +- path = btrfs_alloc_path(); +- if (!path) +- return -ENOMEM; ++ if (!path) { ++ path = btrfs_alloc_path(); ++ if (!path) ++ return -ENOMEM; ++ } + + memcpy(&location, &BTRFS_I(inode)->location, sizeof(location)); + + ret = btrfs_lookup_inode(NULL, root, path, &location, 0); + if (ret) { +- btrfs_free_path(path); ++ if (path != in_path) ++ btrfs_free_path(path); + return ret; + } + +@@ -3774,7 +3778,8 @@ cache_acl: + btrfs_ino(BTRFS_I(inode)), + root->root_key.objectid, ret); + } +- btrfs_free_path(path); ++ if (path != in_path) ++ btrfs_free_path(path); + + if (!maybe_acls) + cache_no_acl(inode); +@@ -4918,7 +4923,7 @@ again: + if (!page) { + btrfs_delalloc_release_space(inode, data_reserved, + block_start, blocksize, true); +- btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize, true); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize); + ret = -ENOMEM; + goto out; + } +@@ -4986,7 +4991,7 @@ out_unlock: + if (ret) + btrfs_delalloc_release_space(inode, data_reserved, block_start, + blocksize, true); +- btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize, (ret != 0)); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), blocksize); + unlock_page(page); + put_page(page); + out: +@@ -5716,8 +5721,9 @@ static struct inode *btrfs_iget_locked(struct super_block *s, + /* Get an inode object given its location and corresponding root. + * Returns in *is_new if the inode was read from disk + */ +-struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, +- struct btrfs_root *root, int *new) ++struct inode *btrfs_iget_path(struct super_block *s, struct btrfs_key *location, ++ struct btrfs_root *root, int *new, ++ struct btrfs_path *path) + { + struct inode *inode; + +@@ -5728,7 +5734,7 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, + if (inode->i_state & I_NEW) { + int ret; + +- ret = btrfs_read_locked_inode(inode); ++ ret = btrfs_read_locked_inode(inode, path); + if (!ret) { + inode_tree_add(inode); + unlock_new_inode(inode); +@@ -5750,6 +5756,12 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, + return inode; + } + ++struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location, ++ struct btrfs_root *root, int *new) ++{ ++ return btrfs_iget_path(s, location, root, new, NULL); ++} ++ + static struct inode *new_simple_dir(struct super_block *s, + struct btrfs_key *key, + struct btrfs_root *root) +@@ -8660,7 +8672,7 @@ static ssize_t btrfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + } else if (ret >= 0 && (size_t)ret < count) + btrfs_delalloc_release_space(inode, data_reserved, + offset, count - (size_t)ret, true); +- btrfs_delalloc_release_extents(BTRFS_I(inode), count, false); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), count); + } + out: + if (wakeup) +@@ -9013,7 +9025,7 @@ again: + unlock_extent_cached(io_tree, page_start, page_end, &cached_state); + + if (!ret2) { +- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, true); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE); + sb_end_pagefault(inode->i_sb); + extent_changeset_free(data_reserved); + return VM_FAULT_LOCKED; +@@ -9022,7 +9034,7 @@ again: + out_unlock: + unlock_page(page); + out: +- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, (ret != 0)); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE); + btrfs_delalloc_release_space(inode, data_reserved, page_start, + reserved_space, (ret != 0)); + out_noreserve: +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 0eb333c62fe4..7592beb53fc4 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -1359,8 +1359,7 @@ again: + unlock_page(pages[i]); + put_page(pages[i]); + } +- btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT, +- false); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT); + extent_changeset_free(data_reserved); + return i_done; + out: +@@ -1371,8 +1370,7 @@ out: + btrfs_delalloc_release_space(inode, data_reserved, + start_index << PAGE_SHIFT, + page_cnt << PAGE_SHIFT, true); +- btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT, +- true); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), page_cnt << PAGE_SHIFT); + extent_changeset_free(data_reserved); + return ret; + +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index 3ea2008dcde3..cdd6d5021000 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3259,7 +3259,7 @@ int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes, + return 0; + + BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize)); +- trace_qgroup_meta_reserve(root, type, (s64)num_bytes); ++ trace_qgroup_meta_reserve(root, (s64)num_bytes, type); + ret = qgroup_reserve(root, num_bytes, enforce, type); + if (ret < 0) + return ret; +@@ -3306,7 +3306,7 @@ void __btrfs_qgroup_free_meta(struct btrfs_root *root, int num_bytes, + */ + num_bytes = sub_root_meta_rsv(root, num_bytes, type); + BUG_ON(num_bytes != round_down(num_bytes, fs_info->nodesize)); +- trace_qgroup_meta_reserve(root, type, -(s64)num_bytes); ++ trace_qgroup_meta_reserve(root, -(s64)num_bytes, type); + btrfs_qgroup_free_refroot(fs_info, root->objectid, num_bytes, type); + } + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index bccd9dede2af..b4958f724ce5 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -3188,7 +3188,7 @@ static int relocate_file_extent_cluster(struct inode *inode, + btrfs_delalloc_release_metadata(BTRFS_I(inode), + PAGE_SIZE, true); + btrfs_delalloc_release_extents(BTRFS_I(inode), +- PAGE_SIZE, true); ++ PAGE_SIZE); + ret = -ENOMEM; + goto out; + } +@@ -3209,7 +3209,7 @@ static int relocate_file_extent_cluster(struct inode *inode, + btrfs_delalloc_release_metadata(BTRFS_I(inode), + PAGE_SIZE, true); + btrfs_delalloc_release_extents(BTRFS_I(inode), +- PAGE_SIZE, true); ++ PAGE_SIZE); + ret = -EIO; + goto out; + } +@@ -3238,7 +3238,7 @@ static int relocate_file_extent_cluster(struct inode *inode, + btrfs_delalloc_release_metadata(BTRFS_I(inode), + PAGE_SIZE, true); + btrfs_delalloc_release_extents(BTRFS_I(inode), +- PAGE_SIZE, true); ++ PAGE_SIZE); + + clear_extent_bits(&BTRFS_I(inode)->io_tree, + page_start, page_end, +@@ -3254,8 +3254,7 @@ static int relocate_file_extent_cluster(struct inode *inode, + put_page(page); + + index++; +- btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE, +- false); ++ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE); + balance_dirty_pages_ratelimited(inode->i_mapping); + btrfs_throttle(fs_info); + } +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 86a54b809c48..8b9471904f67 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -1521,9 +1521,10 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) + + /* set up first two iov for signature check and to get credits */ + rdata->iov[0].iov_base = buf; +- rdata->iov[0].iov_len = 4; +- rdata->iov[1].iov_base = buf + 4; +- rdata->iov[1].iov_len = server->total_read - 4; ++ rdata->iov[0].iov_len = server->vals->header_preamble_size; ++ rdata->iov[1].iov_base = buf + server->vals->header_preamble_size; ++ rdata->iov[1].iov_len = ++ server->total_read - server->vals->header_preamble_size; + cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n", + rdata->iov[0].iov_base, rdata->iov[0].iov_len); + cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n", +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 966e493c82e5..7e85070d010f 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -930,6 +930,26 @@ cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid) + return 0; + } + ++static void ++smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server) ++{ ++ struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer; ++ ++ /* ++ * SMB1 does not use credits. ++ */ ++ if (server->vals->header_preamble_size) ++ return; ++ ++ if (shdr->CreditRequest) { ++ spin_lock(&server->req_lock); ++ server->credits += le16_to_cpu(shdr->CreditRequest); ++ spin_unlock(&server->req_lock); ++ wake_up(&server->request_q); ++ } ++} ++ ++ + static int + cifs_demultiplex_thread(void *p) + { +@@ -1059,6 +1079,7 @@ next_pdu: + } else if (server->ops->is_oplock_break && + server->ops->is_oplock_break(bufs[i], + server)) { ++ smb2_add_credits_from_hdr(bufs[i], server); + cifs_dbg(FYI, "Received oplock break\n"); + } else { + cifs_dbg(VFS, "No task to wake, unknown frame " +@@ -1070,6 +1091,7 @@ next_pdu: + if (server->ops->dump_detail) + server->ops->dump_detail(bufs[i], + server); ++ smb2_add_credits_from_hdr(bufs[i], server); + cifs_dump_mids(server); + #endif /* CIFS_DEBUG2 */ + } +diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c +index fdd908e4a26b..66c10121a6ea 100644 +--- a/fs/cifs/netmisc.c ++++ b/fs/cifs/netmisc.c +@@ -130,10 +130,6 @@ static const struct smb_to_posix_error mapping_table_ERRSRV[] = { + {0, 0} + }; + +-static const struct smb_to_posix_error mapping_table_ERRHRD[] = { +- {0, 0} +-}; +- + /* + * Convert a string containing text IPv4 or IPv6 address to binary form. + * +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 0a7ed2e3ad4f..e311f58dc1c8 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -659,13 +659,6 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) + if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK) + return false; + +- if (rsp->sync_hdr.CreditRequest) { +- spin_lock(&server->req_lock); +- server->credits += le16_to_cpu(rsp->sync_hdr.CreditRequest); +- spin_unlock(&server->req_lock); +- wake_up(&server->request_q); +- } +- + if (rsp->StructureSize != + smb2_rsp_struct_sizes[SMB2_OPLOCK_BREAK_HE]) { + if (le16_to_cpu(rsp->StructureSize) == 44) +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index f0d966da7f37..6fc16329ceb4 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -3000,10 +3000,10 @@ handle_read_data(struct TCP_Server_Info *server, struct mid_q_entry *mid, + + /* set up first two iov to get credits */ + rdata->iov[0].iov_base = buf; +- rdata->iov[0].iov_len = 4; +- rdata->iov[1].iov_base = buf + 4; ++ rdata->iov[0].iov_len = 0; ++ rdata->iov[1].iov_base = buf; + rdata->iov[1].iov_len = +- min_t(unsigned int, buf_len, server->vals->read_rsp_size) - 4; ++ min_t(unsigned int, buf_len, server->vals->read_rsp_size); + cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n", + rdata->iov[0].iov_base, rdata->iov[0].iov_len); + cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n", +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index abb6fcff0a1d..783c54bb2ce7 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -132,6 +132,7 @@ static long swap_inode_boot_loader(struct super_block *sb, + + if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) || + IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) || ++ (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL) || + ext4_has_inline_data(inode)) { + err = -EINVAL; + goto journal_err_out; +diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c +index 0b224f4a4a65..2c3be4c3c626 100644 +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -226,6 +226,9 @@ static void recover_inode(struct inode *inode, struct page *page) + + F2FS_I(inode)->i_advise = raw->i_advise; + F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags); ++ f2fs_set_inode_flags(inode); ++ F2FS_I(inode)->i_gc_failures[GC_FAILURE_PIN] = ++ le16_to_cpu(raw->i_gc_failures); + + recover_inline_flags(inode, raw); + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 6851afc3bf80..d9106bbe7df6 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1886,6 +1886,12 @@ void f2fs_quota_off_umount(struct super_block *sb) + set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK); + } + } ++ /* ++ * In case of checkpoint=disable, we must flush quota blocks. ++ * This can cause NULL exception for node_inode in end_io, since ++ * put_super already dropped it. ++ */ ++ sync_filesystem(sb); + } + + static void f2fs_truncate_quota_inode_pages(struct super_block *sb) +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 82a13221775e..e7a2a988533d 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1665,6 +1665,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, + if (attr->ia_valid & ATTR_SIZE) + is_truncate = true; + ++ /* Flush dirty data/metadata before non-truncate SETATTR */ ++ if (is_wb && S_ISREG(inode->i_mode) && ++ attr->ia_valid & ++ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET | ++ ATTR_TIMES_SET)) { ++ err = write_inode_now(inode, true); ++ if (err) ++ return err; ++ ++ fuse_set_nowrite(inode); ++ fuse_release_nowrite(inode); ++ } ++ + if (is_truncate) { + fuse_set_nowrite(inode); + set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 96d46b3ad235..3964325432ae 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -202,7 +202,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) + { + struct fuse_conn *fc = get_fuse_conn(inode); + int err; +- bool lock_inode = (file->f_flags & O_TRUNC) && ++ bool is_wb_truncate = (file->f_flags & O_TRUNC) && + fc->atomic_o_trunc && + fc->writeback_cache; + +@@ -210,16 +210,20 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) + if (err) + return err; + +- if (lock_inode) ++ if (is_wb_truncate) { + inode_lock(inode); ++ fuse_set_nowrite(inode); ++ } + + err = fuse_do_open(fc, get_node_id(inode), file, isdir); + + if (!err) + fuse_finish_open(inode, file); + +- if (lock_inode) ++ if (is_wb_truncate) { ++ fuse_release_nowrite(inode); + inode_unlock(inode); ++ } + + return err; + } +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 1624618c2bc7..825a8c52165a 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -1154,7 +1154,7 @@ bool nfs4_refresh_delegation_stateid(nfs4_stateid *dst, struct inode *inode) + if (delegation != NULL && + nfs4_stateid_match_other(dst, &delegation->stateid)) { + dst->seqid = delegation->stateid.seqid; +- return ret; ++ ret = true; + } + rcu_read_unlock(); + out: +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 621e3cf90f4e..75faef7af22d 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5943,6 +5943,7 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, + } + status = task->tk_status; + if (setclientid.sc_cred) { ++ kfree(clp->cl_acceptor); + clp->cl_acceptor = rpcauth_stringify_acceptor(setclientid.sc_cred); + put_rpccred(setclientid.sc_cred); + } +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index c36ef75f2054..b3086e99420c 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -2613,7 +2613,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; +- } while (refcount_read(&clp->cl_count) > 1); ++ } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + + out_error: +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 5ab997912d8d..117ffd90419e 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -783,7 +783,6 @@ static void nfs_inode_remove_request(struct nfs_page *req) + struct nfs_inode *nfsi = NFS_I(inode); + struct nfs_page *head; + +- atomic_long_dec(&nfsi->nrequests); + if (nfs_page_group_sync_on_bit(req, PG_REMOVE)) { + head = req->wb_head; + +@@ -796,8 +795,10 @@ static void nfs_inode_remove_request(struct nfs_page *req) + spin_unlock(&mapping->private_lock); + } + +- if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) ++ if (test_and_clear_bit(PG_INODE_REF, &req->wb_flags)) { + nfs_release_request(req); ++ atomic_long_dec(&nfsi->nrequests); ++ } + } + + static void +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 7578bd507c70..543efa3e5655 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2056,7 +2056,8 @@ out_write_size: + inode->i_mtime = inode->i_ctime = current_time(inode); + di->i_mtime = di->i_ctime = cpu_to_le64(inode->i_mtime.tv_sec); + di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec); +- ocfs2_update_inode_fsync_trans(handle, inode, 1); ++ if (handle) ++ ocfs2_update_inode_fsync_trans(handle, inode, 1); + } + if (handle) + ocfs2_journal_dirty(handle, wc->w_di_bh); +@@ -2153,13 +2154,30 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock, + struct ocfs2_dio_write_ctxt *dwc = NULL; + struct buffer_head *di_bh = NULL; + u64 p_blkno; +- loff_t pos = iblock << inode->i_sb->s_blocksize_bits; ++ unsigned int i_blkbits = inode->i_sb->s_blocksize_bits; ++ loff_t pos = iblock << i_blkbits; ++ sector_t endblk = (i_size_read(inode) - 1) >> i_blkbits; + unsigned len, total_len = bh_result->b_size; + int ret = 0, first_get_block = 0; + + len = osb->s_clustersize - (pos & (osb->s_clustersize - 1)); + len = min(total_len, len); + ++ /* ++ * bh_result->b_size is count in get_more_blocks according to write ++ * "pos" and "end", we need map twice to return different buffer state: ++ * 1. area in file size, not set NEW; ++ * 2. area out file size, set NEW. ++ * ++ * iblock endblk ++ * |--------|---------|---------|--------- ++ * |<-------area in file------->| ++ */ ++ ++ if ((iblock <= endblk) && ++ ((iblock + ((len - 1) >> i_blkbits)) > endblk)) ++ len = (endblk - iblock + 1) << i_blkbits; ++ + mlog(0, "get block of %lu at %llu:%u req %u\n", + inode->i_ino, pos, len, total_len); + +@@ -2243,6 +2261,9 @@ static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock, + if (desc->c_needs_zero) + set_buffer_new(bh_result); + ++ if (iblock > endblk) ++ set_buffer_new(bh_result); ++ + /* May sleep in end_io. It should not happen in a irq context. So defer + * it to dio work queue. */ + set_buffer_defer_completion(bh_result); +diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c +index 994726ada857..a6c328211dcc 100644 +--- a/fs/ocfs2/ioctl.c ++++ b/fs/ocfs2/ioctl.c +@@ -290,7 +290,7 @@ static int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb, + if (inode_alloc) + inode_lock(inode_alloc); + +- if (o2info_coherent(&fi->ifi_req)) { ++ if (inode_alloc && o2info_coherent(&fi->ifi_req)) { + status = ocfs2_inode_lock(inode_alloc, &bh, 0); + if (status < 0) { + mlog_errno(status); +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index c146e12a8601..0d80e0df6c24 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1498,18 +1498,6 @@ static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc, + return loc->xl_ops->xlo_check_space(loc, xi); + } + +-static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash) +-{ +- loc->xl_ops->xlo_add_entry(loc, name_hash); +- loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash); +- /* +- * We can't leave the new entry's xe_name_offset at zero or +- * add_namevalue() will go nuts. We set it to the size of our +- * storage so that it can never be less than any other entry. +- */ +- loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size); +-} +- + static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc, + struct ocfs2_xattr_info *xi) + { +@@ -2141,29 +2129,31 @@ static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc, + if (rc) + goto out; + +- if (loc->xl_entry) { +- if (ocfs2_xa_can_reuse_entry(loc, xi)) { +- orig_value_size = loc->xl_entry->xe_value_size; +- rc = ocfs2_xa_reuse_entry(loc, xi, ctxt); +- if (rc) +- goto out; +- goto alloc_value; +- } ++ if (!loc->xl_entry) { ++ rc = -EINVAL; ++ goto out; ++ } + +- if (!ocfs2_xattr_is_local(loc->xl_entry)) { +- orig_clusters = ocfs2_xa_value_clusters(loc); +- rc = ocfs2_xa_value_truncate(loc, 0, ctxt); +- if (rc) { +- mlog_errno(rc); +- ocfs2_xa_cleanup_value_truncate(loc, +- "overwriting", +- orig_clusters); +- goto out; +- } ++ if (ocfs2_xa_can_reuse_entry(loc, xi)) { ++ orig_value_size = loc->xl_entry->xe_value_size; ++ rc = ocfs2_xa_reuse_entry(loc, xi, ctxt); ++ if (rc) ++ goto out; ++ goto alloc_value; ++ } ++ ++ if (!ocfs2_xattr_is_local(loc->xl_entry)) { ++ orig_clusters = ocfs2_xa_value_clusters(loc); ++ rc = ocfs2_xa_value_truncate(loc, 0, ctxt); ++ if (rc) { ++ mlog_errno(rc); ++ ocfs2_xa_cleanup_value_truncate(loc, ++ "overwriting", ++ orig_clusters); ++ goto out; + } +- ocfs2_xa_wipe_namevalue(loc); +- } else +- ocfs2_xa_add_entry(loc, name_hash); ++ } ++ ocfs2_xa_wipe_namevalue(loc); + + /* + * If we get here, we have a blank entry. Fill it. We grow our +diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h +index df528a623548..ea985aa7a6c5 100644 +--- a/include/net/llc_conn.h ++++ b/include/net/llc_conn.h +@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk); + + /* Access to a connection */ + int llc_conn_state_process(struct sock *sk, struct sk_buff *skb); +-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); ++void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); + void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb); + void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit); + void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit); +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index c44da48de7df..c9cd5086bd54 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -421,6 +421,11 @@ static inline struct Qdisc *qdisc_root(const struct Qdisc *qdisc) + return q; + } + ++static inline struct Qdisc *qdisc_root_bh(const struct Qdisc *qdisc) ++{ ++ return rcu_dereference_bh(qdisc->dev_queue->qdisc); ++} ++ + static inline struct Qdisc *qdisc_root_sleeping(const struct Qdisc *qdisc) + { + return qdisc->dev_queue->qdisc_sleeping; +diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h +index 0fe169c6afd8..a08916eb7615 100644 +--- a/include/trace/events/rxrpc.h ++++ b/include/trace/events/rxrpc.h +@@ -527,10 +527,10 @@ TRACE_EVENT(rxrpc_local, + ); + + TRACE_EVENT(rxrpc_peer, +- TP_PROTO(struct rxrpc_peer *peer, enum rxrpc_peer_trace op, ++ TP_PROTO(unsigned int peer_debug_id, enum rxrpc_peer_trace op, + int usage, const void *where), + +- TP_ARGS(peer, op, usage, where), ++ TP_ARGS(peer_debug_id, op, usage, where), + + TP_STRUCT__entry( + __field(unsigned int, peer ) +@@ -540,7 +540,7 @@ TRACE_EVENT(rxrpc_peer, + ), + + TP_fast_assign( +- __entry->peer = peer->debug_id; ++ __entry->peer = peer_debug_id; + __entry->op = op; + __entry->usage = usage; + __entry->where = where; +diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c +index 0796f938c4f0..54eb9457b21d 100644 +--- a/kernel/sched/cputime.c ++++ b/kernel/sched/cputime.c +@@ -739,7 +739,7 @@ void vtime_account_system(struct task_struct *tsk) + + write_seqcount_begin(&vtime->seqcount); + /* We might have scheduled out from guest path */ +- if (current->flags & PF_VCPU) ++ if (tsk->flags & PF_VCPU) + vtime_account_guest(tsk, vtime); + else + __vtime_account_system(tsk, vtime); +@@ -782,7 +782,7 @@ void vtime_guest_enter(struct task_struct *tsk) + */ + write_seqcount_begin(&vtime->seqcount); + __vtime_account_system(tsk, vtime); +- current->flags |= PF_VCPU; ++ tsk->flags |= PF_VCPU; + write_seqcount_end(&vtime->seqcount); + } + EXPORT_SYMBOL_GPL(vtime_guest_enter); +@@ -793,7 +793,7 @@ void vtime_guest_exit(struct task_struct *tsk) + + write_seqcount_begin(&vtime->seqcount); + vtime_account_guest(tsk, vtime); +- current->flags &= ~PF_VCPU; ++ tsk->flags &= ~PF_VCPU; + write_seqcount_end(&vtime->seqcount); + } + EXPORT_SYMBOL_GPL(vtime_guest_exit); +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 27b17ea44f74..bdd7f3d78724 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -5766,6 +5766,7 @@ waitagain: + sizeof(struct trace_iterator) - + offsetof(struct trace_iterator, seq)); + cpumask_clear(iter->started); ++ trace_seq_init(&iter->seq); + iter->pos = -1; + + trace_event_read_lock(); +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index 36f244125d24..f5941837c3ad 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -35,6 +35,7 @@ + #include <linux/kref.h> + #include <linux/list.h> + #include <linux/lockdep.h> ++#include <linux/mutex.h> + #include <linux/netdevice.h> + #include <linux/netlink.h> + #include <linux/pkt_sched.h> +@@ -379,14 +380,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) + unsigned char *ogm_buff; + u32 random_seqno; + ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + /* randomize initial seqno to avoid collision */ + get_random_bytes(&random_seqno, sizeof(random_seqno)); + atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno); + + hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN; + ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC); +- if (!ogm_buff) ++ if (!ogm_buff) { ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + return -ENOMEM; ++ } + + hard_iface->bat_iv.ogm_buff = ogm_buff; + +@@ -398,35 +403,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface) + batadv_ogm_packet->reserved = 0; + batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE; + ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + return 0; + } + + static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface) + { ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ + kfree(hard_iface->bat_iv.ogm_buff); + hard_iface->bat_iv.ogm_buff = NULL; ++ ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface) + { + struct batadv_ogm_packet *batadv_ogm_packet; +- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; ++ void *ogm_buff; + +- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ ++ ogm_buff = hard_iface->bat_iv.ogm_buff; ++ if (!ogm_buff) ++ goto unlock; ++ ++ batadv_ogm_packet = ogm_buff; + ether_addr_copy(batadv_ogm_packet->orig, + hard_iface->net_dev->dev_addr); + ether_addr_copy(batadv_ogm_packet->prev_sender, + hard_iface->net_dev->dev_addr); ++ ++unlock: ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + static void + batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface) + { + struct batadv_ogm_packet *batadv_ogm_packet; +- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff; ++ void *ogm_buff; + +- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff; ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ ++ ogm_buff = hard_iface->bat_iv.ogm_buff; ++ if (!ogm_buff) ++ goto unlock; ++ ++ batadv_ogm_packet = ogm_buff; + batadv_ogm_packet->ttl = BATADV_TTL; ++ ++unlock: ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); + } + + /* when do we schedule our own ogm to be sent */ +@@ -924,7 +953,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface) + } + } + +-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) ++/** ++ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer ++ * @hard_iface: interface whose ogm buffer should be transmitted ++ */ ++static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) + { + struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface); + unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff; +@@ -935,9 +968,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) + u16 tvlv_len = 0; + unsigned long send_time; + +- if (hard_iface->if_status == BATADV_IF_NOT_IN_USE || +- hard_iface->if_status == BATADV_IF_TO_BE_REMOVED) +- return; ++ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); + + /* the interface gets activated here to avoid race conditions between + * the moment of activating the interface in +@@ -1005,6 +1036,17 @@ out: + batadv_hardif_put(primary_if); + } + ++static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface) ++{ ++ if (hard_iface->if_status == BATADV_IF_NOT_IN_USE || ++ hard_iface->if_status == BATADV_IF_TO_BE_REMOVED) ++ return; ++ ++ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex); ++ batadv_iv_ogm_schedule_buff(hard_iface); ++ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex); ++} ++ + /** + * batadv_iv_ogm_orig_update() - use OGM to update corresponding data in an + * originator +diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c +index 36f0962040d1..c4e0435c952d 100644 +--- a/net/batman-adv/hard-interface.c ++++ b/net/batman-adv/hard-interface.c +@@ -29,6 +29,7 @@ + #include <linux/kernel.h> + #include <linux/kref.h> + #include <linux/list.h> ++#include <linux/mutex.h> + #include <linux/netdevice.h> + #include <linux/printk.h> + #include <linux/rculist.h> +@@ -933,6 +934,7 @@ batadv_hardif_add_interface(struct net_device *net_dev) + INIT_LIST_HEAD(&hard_iface->list); + INIT_HLIST_HEAD(&hard_iface->neigh_list); + ++ mutex_init(&hard_iface->bat_iv.ogm_buff_mutex); + spin_lock_init(&hard_iface->neigh_list_lock); + kref_init(&hard_iface->refcount); + +diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h +index fdba8a144d73..87e54f8a3f83 100644 +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -91,6 +91,9 @@ struct batadv_hard_iface_bat_iv { + + /** @ogm_seqno: OGM sequence number - used to identify each OGM */ + atomic_t ogm_seqno; ++ ++ /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */ ++ struct mutex ogm_buff_mutex; + }; + + /** +diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c +index 4d78375f9872..647c0554d04c 100644 +--- a/net/llc/llc_c_ac.c ++++ b/net/llc/llc_c_ac.c +@@ -372,6 +372,7 @@ int llc_conn_ac_send_i_cmd_p_set_1(struct sock *sk, struct sk_buff *skb) + llc_pdu_init_as_i_cmd(skb, 1, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { ++ skb_get(skb); + llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } +@@ -389,7 +390,8 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb) + llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { +- rc = llc_conn_send_pdu(sk, skb); ++ skb_get(skb); ++ llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } + return rc; +@@ -406,6 +408,7 @@ int llc_conn_ac_send_i_xxx_x_set_0(struct sock *sk, struct sk_buff *skb) + llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { ++ skb_get(skb); + llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } +@@ -916,7 +919,8 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk, + llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { +- rc = llc_conn_send_pdu(sk, skb); ++ skb_get(skb); ++ llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } + return rc; +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 4ff89cb7c86f..ed2aca12460c 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -30,7 +30,7 @@ + #endif + + static int llc_find_offset(int state, int ev_type); +-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb); ++static void llc_conn_send_pdus(struct sock *sk); + static int llc_conn_service(struct sock *sk, struct sk_buff *skb); + static int llc_exec_conn_trans_actions(struct sock *sk, + struct llc_conn_state_trans *trans, +@@ -193,11 +193,11 @@ out_skb_put: + return rc; + } + +-int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) ++void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) + { + /* queue PDU to send to MAC layer */ + skb_queue_tail(&sk->sk_write_queue, skb); +- return llc_conn_send_pdus(sk, skb); ++ llc_conn_send_pdus(sk); + } + + /** +@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit) + if (howmany_resend > 0) + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; + /* any PDUs to re-send are queued up; start sending to MAC */ +- llc_conn_send_pdus(sk, NULL); ++ llc_conn_send_pdus(sk); + out:; + } + +@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit) + if (howmany_resend > 0) + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; + /* any PDUs to re-send are queued up; start sending to MAC */ +- llc_conn_send_pdus(sk, NULL); ++ llc_conn_send_pdus(sk); + out:; + } + +@@ -340,16 +340,12 @@ out: + /** + * llc_conn_send_pdus - Sends queued PDUs + * @sk: active connection +- * @hold_skb: the skb held by caller, or NULL if does not care + * +- * Sends queued pdus to MAC layer for transmission. When @hold_skb is +- * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent +- * successfully, or 1 for failure. ++ * Sends queued pdus to MAC layer for transmission. + */ +-static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb) ++static void llc_conn_send_pdus(struct sock *sk) + { + struct sk_buff *skb; +- int ret = 0; + + while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) { + struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb); +@@ -361,20 +357,10 @@ static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb) + skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb); + if (!skb2) + break; +- dev_queue_xmit(skb2); +- } else { +- bool is_target = skb == hold_skb; +- int rc; +- +- if (is_target) +- skb_get(skb); +- rc = dev_queue_xmit(skb); +- if (is_target) +- ret = rc; ++ skb = skb2; + } ++ dev_queue_xmit(skb); + } +- +- return ret; + } + + /** +diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c +index a94bd56bcac6..7ae4cc684d3a 100644 +--- a/net/llc/llc_s_ac.c ++++ b/net/llc/llc_s_ac.c +@@ -58,8 +58,10 @@ int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb) + ev->daddr.lsap, LLC_PDU_CMD); + llc_pdu_init_as_ui_cmd(skb); + rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); +- if (likely(!rc)) ++ if (likely(!rc)) { ++ skb_get(skb); + rc = dev_queue_xmit(skb); ++ } + return rc; + } + +@@ -81,8 +83,10 @@ int llc_sap_action_send_xid_c(struct llc_sap *sap, struct sk_buff *skb) + ev->daddr.lsap, LLC_PDU_CMD); + llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0); + rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); +- if (likely(!rc)) ++ if (likely(!rc)) { ++ skb_get(skb); + rc = dev_queue_xmit(skb); ++ } + return rc; + } + +@@ -135,8 +139,10 @@ int llc_sap_action_send_test_c(struct llc_sap *sap, struct sk_buff *skb) + ev->daddr.lsap, LLC_PDU_CMD); + llc_pdu_init_as_test_cmd(skb); + rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac); +- if (likely(!rc)) ++ if (likely(!rc)) { ++ skb_get(skb); + rc = dev_queue_xmit(skb); ++ } + return rc; + } + +diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c +index a7f7b8ff4729..be419062e19a 100644 +--- a/net/llc/llc_sap.c ++++ b/net/llc/llc_sap.c +@@ -197,29 +197,22 @@ out: + * After executing actions of the event, upper layer will be indicated + * if needed(on receiving an UI frame). sk can be null for the + * datalink_proto case. ++ * ++ * This function always consumes a reference to the skb. + */ + static void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb) + { + struct llc_sap_state_ev *ev = llc_sap_ev(skb); + +- /* +- * We have to hold the skb, because llc_sap_next_state +- * will kfree it in the sending path and we need to +- * look at the skb->cb, where we encode llc_sap_state_ev. +- */ +- skb_get(skb); + ev->ind_cfm_flag = 0; + llc_sap_next_state(sap, skb); +- if (ev->ind_cfm_flag == LLC_IND) { +- if (skb->sk->sk_state == TCP_LISTEN) +- kfree_skb(skb); +- else { +- llc_save_primitive(skb->sk, skb, ev->prim); + +- /* queue skb to the user. */ +- if (sock_queue_rcv_skb(skb->sk, skb)) +- kfree_skb(skb); +- } ++ if (ev->ind_cfm_flag == LLC_IND && skb->sk->sk_state != TCP_LISTEN) { ++ llc_save_primitive(skb->sk, skb, ev->prim); ++ ++ /* queue skb to the user. */ ++ if (sock_queue_rcv_skb(skb->sk, skb) == 0) ++ return; + } + kfree_skb(skb); + } +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +index 4f01321e793c..794e0335a864 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +@@ -235,6 +235,9 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + else + ether_addr_copy(e.ether, eth_hdr(skb)->h_dest); + ++ if (is_zero_ether_addr(e.ether)) ++ return -EINVAL; ++ + return adtfn(set, &e, &ext, &opt->ext, opt->cmdflags); + } + +diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c +index 16ec822e4044..25560ea742d6 100644 +--- a/net/netfilter/ipset/ip_set_hash_ipmac.c ++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c +@@ -36,9 +36,6 @@ MODULE_ALIAS("ip_set_hash:ip,mac"); + /* Type specific function prefix */ + #define HTYPE hash_ipmac + +-/* Zero valued element is not supported */ +-static const unsigned char invalid_ether[ETH_ALEN] = { 0 }; +- + /* IPv4 variant */ + + /* Member elements */ +@@ -104,7 +101,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, + else + ether_addr_copy(e.ether, eth_hdr(skb)->h_dest); + +- if (ether_addr_equal(e.ether, invalid_ether)) ++ if (is_zero_ether_addr(e.ether)) + return -EINVAL; + + ip4addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip); +@@ -140,7 +137,7 @@ hash_ipmac4_uadt(struct ip_set *set, struct nlattr *tb[], + if (ret) + return ret; + memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN); +- if (ether_addr_equal(e.ether, invalid_ether)) ++ if (is_zero_ether_addr(e.ether)) + return -IPSET_ERR_HASH_ELEM; + + return adtfn(set, &e, &ext, &ext, flags); +@@ -220,7 +217,7 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, + else + ether_addr_copy(e.ether, eth_hdr(skb)->h_dest); + +- if (ether_addr_equal(e.ether, invalid_ether)) ++ if (is_zero_ether_addr(e.ether)) + return -EINVAL; + + ip6addrptr(skb, opt->flags & IPSET_DIM_ONE_SRC, &e.ip.in6); +@@ -260,7 +257,7 @@ hash_ipmac6_uadt(struct ip_set *set, struct nlattr *tb[], + return ret; + + memcpy(e.ether, nla_data(tb[IPSET_ATTR_ETHER]), ETH_ALEN); +- if (ether_addr_equal(e.ether, invalid_ether)) ++ if (is_zero_ether_addr(e.ether)) + return -IPSET_ERR_HASH_ELEM; + + return adtfn(set, &e, &ext, &ext, flags); +diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c +index 71547e8673b9..b91b090217cd 100644 +--- a/net/rxrpc/peer_object.c ++++ b/net/rxrpc/peer_object.c +@@ -220,7 +220,7 @@ struct rxrpc_peer *rxrpc_alloc_peer(struct rxrpc_local *local, gfp_t gfp) + peer = kzalloc(sizeof(struct rxrpc_peer), gfp); + if (peer) { + atomic_set(&peer->usage, 1); +- peer->local = local; ++ peer->local = rxrpc_get_local(local); + INIT_HLIST_HEAD(&peer->error_targets); + peer->service_conns = RB_ROOT; + seqlock_init(&peer->service_conn_lock); +@@ -311,7 +311,6 @@ void rxrpc_new_incoming_peer(struct rxrpc_sock *rx, struct rxrpc_local *local, + unsigned long hash_key; + + hash_key = rxrpc_peer_hash_key(local, &peer->srx); +- peer->local = local; + rxrpc_init_peer(rx, peer, hash_key); + + spin_lock(&rxnet->peer_hash_lock); +@@ -386,7 +385,7 @@ struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *peer) + int n; + + n = atomic_inc_return(&peer->usage); +- trace_rxrpc_peer(peer, rxrpc_peer_got, n, here); ++ trace_rxrpc_peer(peer->debug_id, rxrpc_peer_got, n, here); + return peer; + } + +@@ -400,7 +399,7 @@ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *peer) + if (peer) { + int n = atomic_fetch_add_unless(&peer->usage, 1, 0); + if (n > 0) +- trace_rxrpc_peer(peer, rxrpc_peer_got, n + 1, here); ++ trace_rxrpc_peer(peer->debug_id, rxrpc_peer_got, n + 1, here); + else + peer = NULL; + } +@@ -421,6 +420,7 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) + list_del_init(&peer->keepalive_link); + spin_unlock_bh(&rxnet->peer_hash_lock); + ++ rxrpc_put_local(peer->local); + kfree_rcu(peer, rcu); + } + +@@ -430,11 +430,13 @@ static void __rxrpc_put_peer(struct rxrpc_peer *peer) + void rxrpc_put_peer(struct rxrpc_peer *peer) + { + const void *here = __builtin_return_address(0); ++ unsigned int debug_id; + int n; + + if (peer) { ++ debug_id = peer->debug_id; + n = atomic_dec_return(&peer->usage); +- trace_rxrpc_peer(peer, rxrpc_peer_put, n, here); ++ trace_rxrpc_peer(debug_id, rxrpc_peer_put, n, here); + if (n == 0) + __rxrpc_put_peer(peer); + } +@@ -447,13 +449,15 @@ void rxrpc_put_peer(struct rxrpc_peer *peer) + void rxrpc_put_peer_locked(struct rxrpc_peer *peer) + { + const void *here = __builtin_return_address(0); ++ unsigned int debug_id = peer->debug_id; + int n; + + n = atomic_dec_return(&peer->usage); +- trace_rxrpc_peer(peer, rxrpc_peer_put, n, here); ++ trace_rxrpc_peer(debug_id, rxrpc_peer_put, n, here); + if (n == 0) { + hash_del_rcu(&peer->hash_link); + list_del_init(&peer->keepalive_link); ++ rxrpc_put_local(peer->local); + kfree_rcu(peer, rcu); + } + } +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 5d6ab4f6fd7a..3e54ead1e921 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -661,6 +661,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) + case RXRPC_CALL_SERVER_PREALLOC: + case RXRPC_CALL_SERVER_SECURING: + case RXRPC_CALL_SERVER_ACCEPTING: ++ rxrpc_put_call(call, rxrpc_call_put); + ret = -EBUSY; + goto error_release_sock; + default: +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index 86350fe5cfc8..15f8f24c190d 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -474,7 +474,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + * skb will be queued. + */ + if (count > 1 && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) { +- struct Qdisc *rootq = qdisc_root(sch); ++ struct Qdisc *rootq = qdisc_root_bh(sch); + u32 dupsave = q->duplicate; /* prevent duplicating a dup... */ + + q->duplicate = 0; +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index a28d6456e93e..2ef1f56504cb 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -284,7 +284,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, + [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, + .len = IEEE80211_MAX_MESH_ID_LEN }, +- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, ++ [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY, ++ .len = ETH_ALEN }, + + [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, + [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, +diff --git a/samples/bpf/bpf_load.c b/samples/bpf/bpf_load.c +index 5061a2ec4564..176c04a454dc 100644 +--- a/samples/bpf/bpf_load.c ++++ b/samples/bpf/bpf_load.c +@@ -59,7 +59,9 @@ static int write_kprobe_events(const char *val) + { + int fd, ret, flags; + +- if ((val != NULL) && (val[0] == '\0')) ++ if (val == NULL) ++ return -1; ++ else if (val[0] == '\0') + flags = O_WRONLY | O_TRUNC; + else + flags = O_WRONLY | O_APPEND; +diff --git a/scripts/setlocalversion b/scripts/setlocalversion +index 71f39410691b..365b3c2b8f43 100755 +--- a/scripts/setlocalversion ++++ b/scripts/setlocalversion +@@ -73,8 +73,16 @@ scm_version() + printf -- '-svn%s' "`git svn find-rev $head`" + fi + +- # Check for uncommitted changes +- if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then ++ # Check for uncommitted changes. ++ # First, with git-status, but --no-optional-locks is only ++ # supported in git >= 2.14, so fall back to git-diff-index if ++ # it fails. Note that git-diff-index does not refresh the ++ # index, so it may give misleading results. See ++ # git-update-index(1), git-diff-index(1), and git-status(1). ++ if { ++ git --no-optional-locks status -uno --porcelain 2>/dev/null || ++ git diff-index --name-only HEAD ++ } | grep -qvE '^(.. )?scripts/package'; then + printf '%s' -dirty + fi + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 61a0cec6e1f6..ec74705f003b 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -240,7 +240,8 @@ static int snd_timer_check_master(struct snd_timer_instance *master) + return 0; + } + +-static int snd_timer_close_locked(struct snd_timer_instance *timeri); ++static int snd_timer_close_locked(struct snd_timer_instance *timeri, ++ struct device **card_devp_to_put); + + /* + * open a timer instance +@@ -252,21 +253,23 @@ int snd_timer_open(struct snd_timer_instance **ti, + { + struct snd_timer *timer; + struct snd_timer_instance *timeri = NULL; ++ struct device *card_dev_to_put = NULL; + int err; + ++ mutex_lock(®ister_mutex); + if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) { + /* open a slave instance */ + if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE || + tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) { + pr_debug("ALSA: timer: invalid slave class %i\n", + tid->dev_sclass); +- return -EINVAL; ++ err = -EINVAL; ++ goto unlock; + } +- mutex_lock(®ister_mutex); + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { +- mutex_unlock(®ister_mutex); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto unlock; + } + timeri->slave_class = tid->dev_sclass; + timeri->slave_id = tid->device; +@@ -274,16 +277,13 @@ int snd_timer_open(struct snd_timer_instance **ti, + list_add_tail(&timeri->open_list, &snd_timer_slave_list); + err = snd_timer_check_slave(timeri); + if (err < 0) { +- snd_timer_close_locked(timeri); ++ snd_timer_close_locked(timeri, &card_dev_to_put); + timeri = NULL; + } +- mutex_unlock(®ister_mutex); +- *ti = timeri; +- return err; ++ goto unlock; + } + + /* open a master instance */ +- mutex_lock(®ister_mutex); + timer = snd_timer_find(tid); + #ifdef CONFIG_MODULES + if (!timer) { +@@ -294,25 +294,26 @@ int snd_timer_open(struct snd_timer_instance **ti, + } + #endif + if (!timer) { +- mutex_unlock(®ister_mutex); +- return -ENODEV; ++ err = -ENODEV; ++ goto unlock; + } + if (!list_empty(&timer->open_list_head)) { + timeri = list_entry(timer->open_list_head.next, + struct snd_timer_instance, open_list); + if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) { +- mutex_unlock(®ister_mutex); +- return -EBUSY; ++ err = -EBUSY; ++ timeri = NULL; ++ goto unlock; + } + } + if (timer->num_instances >= timer->max_instances) { +- mutex_unlock(®ister_mutex); +- return -EBUSY; ++ err = -EBUSY; ++ goto unlock; + } + timeri = snd_timer_instance_new(owner, timer); + if (!timeri) { +- mutex_unlock(®ister_mutex); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto unlock; + } + /* take a card refcount for safe disconnection */ + if (timer->card) +@@ -321,16 +322,16 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = slave_id; + + if (list_empty(&timer->open_list_head) && timer->hw.open) { +- int err = timer->hw.open(timer); ++ err = timer->hw.open(timer); + if (err) { + kfree(timeri->owner); + kfree(timeri); ++ timeri = NULL; + + if (timer->card) +- put_device(&timer->card->card_dev); ++ card_dev_to_put = &timer->card->card_dev; + module_put(timer->module); +- mutex_unlock(®ister_mutex); +- return err; ++ goto unlock; + } + } + +@@ -338,10 +339,15 @@ int snd_timer_open(struct snd_timer_instance **ti, + timer->num_instances++; + err = snd_timer_check_master(timeri); + if (err < 0) { +- snd_timer_close_locked(timeri); ++ snd_timer_close_locked(timeri, &card_dev_to_put); + timeri = NULL; + } ++ ++ unlock: + mutex_unlock(®ister_mutex); ++ /* put_device() is called after unlock for avoiding deadlock */ ++ if (card_dev_to_put) ++ put_device(card_dev_to_put); + *ti = timeri; + return err; + } +@@ -351,7 +357,8 @@ EXPORT_SYMBOL(snd_timer_open); + * close a timer instance + * call this with register_mutex down. + */ +-static int snd_timer_close_locked(struct snd_timer_instance *timeri) ++static int snd_timer_close_locked(struct snd_timer_instance *timeri, ++ struct device **card_devp_to_put) + { + struct snd_timer *timer = NULL; + struct snd_timer_instance *slave, *tmp; +@@ -403,7 +410,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri) + timer->hw.close(timer); + /* release a card refcount for safe disconnection */ + if (timer->card) +- put_device(&timer->card->card_dev); ++ *card_devp_to_put = &timer->card->card_dev; + module_put(timer->module); + } + +@@ -415,14 +422,18 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri) + */ + int snd_timer_close(struct snd_timer_instance *timeri) + { ++ struct device *card_dev_to_put = NULL; + int err; + + if (snd_BUG_ON(!timeri)) + return -ENXIO; + + mutex_lock(®ister_mutex); +- err = snd_timer_close_locked(timeri); ++ err = snd_timer_close_locked(timeri, &card_dev_to_put); + mutex_unlock(®ister_mutex); ++ /* put_device() is called after unlock for avoiding deadlock */ ++ if (card_dev_to_put) ++ put_device(card_dev_to_put); + return err; + } + EXPORT_SYMBOL(snd_timer_close); +diff --git a/sound/firewire/bebob/bebob_stream.c b/sound/firewire/bebob/bebob_stream.c +index 4d3034a68bdf..be2c056eb62d 100644 +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -253,8 +253,7 @@ end: + return err; + } + +-static unsigned int +-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) ++static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) + { + unsigned int sec, sections, ch, channels; + unsigned int pcm, midi, location; +diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c +index e858b6fa0c3a..74244d8e2909 100644 +--- a/sound/hda/hdac_controller.c ++++ b/sound/hda/hdac_controller.c +@@ -443,8 +443,6 @@ static void azx_int_disable(struct hdac_bus *bus) + list_for_each_entry(azx_dev, &bus->stream_list, list) + snd_hdac_stream_updateb(azx_dev, SD_CTL, SD_INT_MASK, 0); + +- synchronize_irq(bus->irq); +- + /* disable SIE for all streams */ + snd_hdac_chip_writeb(bus, INTCTL, 0); + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index bfc45086cf79..0b24c5ce2fd6 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1455,9 +1455,9 @@ static int azx_free(struct azx *chip) + } + + if (bus->chip_init) { +- azx_stop_chip(chip); + azx_clear_irq_pending(chip); + azx_stop_all_streams(chip); ++ azx_stop_chip(chip); + } + + if (bus->irq >= 0) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index dd46354270d0..7e86aeb3ec33 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -421,6 +421,9 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + case 0x10ec0672: + alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ + break; ++ case 0x10ec0623: ++ alc_update_coef_idx(codec, 0x19, 1<<13, 0); ++ break; + case 0x10ec0668: + alc_update_coef_idx(codec, 0x7, 3<<13, 0); + break; +@@ -2908,6 +2911,7 @@ enum { + ALC269_TYPE_ALC225, + ALC269_TYPE_ALC294, + ALC269_TYPE_ALC300, ++ ALC269_TYPE_ALC623, + ALC269_TYPE_ALC700, + }; + +@@ -2943,6 +2947,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec) + case ALC269_TYPE_ALC225: + case ALC269_TYPE_ALC294: + case ALC269_TYPE_ALC300: ++ case ALC269_TYPE_ALC623: + case ALC269_TYPE_ALC700: + ssids = alc269_ssids; + break; +@@ -3458,7 +3463,9 @@ static void alc294_init(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; + +- if (!spec->done_hp_init) { ++ /* required only at boot or S4 resume time */ ++ if (!spec->done_hp_init || ++ codec->core.dev.power.power_state.event == PM_EVENT_RESTORE) { + alc294_hp_init(codec); + spec->done_hp_init = true; + } +@@ -5251,6 +5258,17 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec, + } + } + ++static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1); ++ snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP); ++} ++ + static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec, + const struct hda_fixup *fix, + int action) +@@ -5633,6 +5651,7 @@ enum { + ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + ALC275_FIXUP_DELL_XPS, + ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, ++ ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2, + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, +@@ -6350,6 +6369,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc256_fixup_dell_xps_13_headphone_noise2, ++ .chained = true, ++ .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE ++ }, + [ALC293_FIXUP_LENOVO_SPK_NOISE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_disable_aamix, +@@ -6792,17 +6817,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), +- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP), +- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), +@@ -6978,6 +7003,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +@@ -7761,6 +7788,9 @@ static int patch_alc269(struct hda_codec *codec) + spec->codec_variant = ALC269_TYPE_ALC300; + spec->gen.mixer_nid = 0; /* no loopback on ALC300 */ + break; ++ case 0x10ec0623: ++ spec->codec_variant = ALC269_TYPE_ALC623; ++ break; + case 0x10ec0700: + case 0x10ec0701: + case 0x10ec0703: +@@ -8879,6 +8909,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { + HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269), ++ HDA_CODEC_ENTRY(0x10ec0623, "ALC623", patch_alc269), + HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861), + HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd), + HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861), +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 60d00091f64b..c102c0377ad9 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1343,7 +1343,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + struct usb_interface *iface; + + /* Playback Designs */ +- if (USB_ID_VENDOR(chip->usb_id) == 0x23ba) { ++ if (USB_ID_VENDOR(chip->usb_id) == 0x23ba && ++ USB_ID_PRODUCT(chip->usb_id) < 0x0110) { + switch (fp->altsetting) { + case 1: + fp->dsd_dop = true; +@@ -1360,37 +1361,19 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + /* XMOS based USB DACs */ + switch (chip->usb_id) { + case USB_ID(0x1511, 0x0037): /* AURALiC VEGA */ +- case USB_ID(0x20b1, 0x0002): /* Wyred 4 Sound DAC-2 DSD */ +- case USB_ID(0x20b1, 0x2004): /* Matrix Audio X-SPDIF 2 */ +- case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */ +- case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */ +- case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */ +- case USB_ID(0x22d9, 0x0436): /* OPPO Sonica */ +- case USB_ID(0x22d9, 0x0461): /* OPPO UDP-205 */ + case USB_ID(0x2522, 0x0012): /* LH Labs VI DAC Infinity */ + case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ + if (fp->altsetting == 2) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; + +- case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */ +- case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */ +- case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */ ++ case USB_ID(0x10cb, 0x0103): /* The Bit Opus #3; with fp->dsd_raw */ + case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */ ++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */ + case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */ + case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */ +- case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */ +- case USB_ID(0x20b1, 0x2005): /* Denafrips Ares DAC */ +- case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */ +- case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */ +- case USB_ID(0x20b1, 0x3021): /* Eastern El. MiniMax Tube DAC Supreme */ +- case USB_ID(0x20b1, 0x3023): /* Aune X1S 32BIT/384 DSD DAC */ +- case USB_ID(0x20b1, 0x302d): /* Unison Research Unico CD Due */ +- case USB_ID(0x20b1, 0x307b): /* CH Precision C1 DAC */ +- case USB_ID(0x20b1, 0x3086): /* Singxer F-1 converter board */ +- case USB_ID(0x22d9, 0x0426): /* OPPO HA-2 */ + case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */ + case USB_ID(0x249c, 0x9326): /* M2Tech Young MkIII */ + case USB_ID(0x2616, 0x0106): /* PS Audio NuWave DAC */ +@@ -1445,9 +1428,13 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + * from XMOS/Thesycon + */ + switch (USB_ID_VENDOR(chip->usb_id)) { +- case 0x20b1: /* XMOS based devices */ + case 0x152a: /* Thesycon devices */ ++ case 0x20b1: /* XMOS based devices */ ++ case 0x22d9: /* Oppo */ ++ case 0x23ba: /* Playback Designs */ + case 0x25ce: /* Mytek devices */ ++ case 0x278b: /* Rotel? */ ++ case 0x292b: /* Gustard/Ess based devices */ + case 0x2ab6: /* T+A devices */ + case 0x3842: /* EVGA */ + case 0xc502: /* HiBy devices */ +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index ed61fb3a46c0..5b2cd5e58df0 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -20,7 +20,13 @@ MAKEFLAGS += --no-print-directory + LIBFILE = $(OUTPUT)libsubcmd.a + + CFLAGS := $(EXTRA_WARNINGS) $(EXTRA_CFLAGS) +-CFLAGS += -ggdb3 -Wall -Wextra -std=gnu99 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -fPIC ++CFLAGS += -ggdb3 -Wall -Wextra -std=gnu99 -fPIC ++ ++ifeq ($(DEBUG),0) ++ ifeq ($(feature-fortify-source), 1) ++ CFLAGS += -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 ++ endif ++endif + + ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 +diff --git a/tools/perf/arch/powerpc/util/header.c b/tools/perf/arch/powerpc/util/header.c +index 0b242664f5ea..e46be9ef5a68 100644 +--- a/tools/perf/arch/powerpc/util/header.c ++++ b/tools/perf/arch/powerpc/util/header.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #include <sys/types.h> ++#include <errno.h> + #include <unistd.h> + #include <stdio.h> + #include <stdlib.h> +@@ -31,7 +32,7 @@ get_cpuid(char *buffer, size_t sz) + buffer[nb-1] = '\0'; + return 0; + } +- return -1; ++ return ENOBUFS; + } + + char * +diff --git a/tools/perf/arch/s390/util/header.c b/tools/perf/arch/s390/util/header.c +index 163b92f33998..cc72554c362a 100644 +--- a/tools/perf/arch/s390/util/header.c ++++ b/tools/perf/arch/s390/util/header.c +@@ -11,6 +11,7 @@ + */ + + #include <sys/types.h> ++#include <errno.h> + #include <unistd.h> + #include <stdio.h> + #include <string.h> +@@ -56,7 +57,7 @@ int get_cpuid(char *buffer, size_t sz) + + sysinfo = fopen(SYSINFO, "r"); + if (sysinfo == NULL) +- return -1; ++ return errno; + + while ((read = getline(&line, &line_sz, sysinfo)) != -1) { + if (!strncmp(line, SYSINFO_MANU, strlen(SYSINFO_MANU))) { +@@ -91,7 +92,7 @@ int get_cpuid(char *buffer, size_t sz) + + /* Missing manufacturer, type or model information should not happen */ + if (!manufacturer[0] || !type[0] || !model[0]) +- return -1; ++ return EINVAL; + + /* + * Scan /proc/service_levels and return the CPU-MF counter facility +@@ -135,14 +136,14 @@ skip_sysinfo: + else + nbytes = snprintf(buffer, sz, "%s,%s,%s", manufacturer, type, + model); +- return (nbytes >= sz) ? -1 : 0; ++ return (nbytes >= sz) ? ENOBUFS : 0; + } + + char *get_cpuid_str(struct perf_pmu *pmu __maybe_unused) + { + char *buf = malloc(128); + +- if (buf && get_cpuid(buf, 128) < 0) ++ if (buf && get_cpuid(buf, 128)) + zfree(&buf); + return buf; + } +diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c +index fb0d71afee8b..2a5daec6fb8b 100644 +--- a/tools/perf/arch/x86/util/header.c ++++ b/tools/perf/arch/x86/util/header.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #include <sys/types.h> ++#include <errno.h> + #include <unistd.h> + #include <stdio.h> + #include <stdlib.h> +@@ -56,7 +57,7 @@ __get_cpuid(char *buffer, size_t sz, const char *fmt) + buffer[nb-1] = '\0'; + return 0; + } +- return -1; ++ return ENOBUFS; + } + + int +diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c +index 2b1ef704169f..952e2228f6c6 100644 +--- a/tools/perf/builtin-kvm.c ++++ b/tools/perf/builtin-kvm.c +@@ -699,14 +699,15 @@ static int process_sample_event(struct perf_tool *tool, + + static int cpu_isa_config(struct perf_kvm_stat *kvm) + { +- char buf[64], *cpuid; ++ char buf[128], *cpuid; + int err; + + if (kvm->live) { + err = get_cpuid(buf, sizeof(buf)); + if (err != 0) { +- pr_err("Failed to look up CPU type\n"); +- return err; ++ pr_err("Failed to look up CPU type: %s\n", ++ str_error_r(err, buf, sizeof(buf))); ++ return -err; + } + cpuid = buf; + } else +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 53c11fc0855e..d20f851796c5 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -1021,7 +1021,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + continue; + + insn = 0; +- for (off = 0;; off += ilen) { ++ for (off = 0; off < (unsigned)len; off += ilen) { + uint64_t ip = start + off; + + printed += ip__fprintf_sym(ip, thread, x.cpumode, x.cpu, &lastsym, attr, fp); +@@ -1029,6 +1029,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + printed += ip__fprintf_jump(ip, &br->entries[i], &x, buffer + off, len - off, insn, fp); + break; + } else { ++ ilen = 0; + printed += fprintf(fp, "\t%016" PRIx64 "\t%s\n", ip, + dump_insn(&x, ip, buffer + off, len - off, &ilen)); + if (ilen == 0) +@@ -1036,6 +1037,8 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + insn++; + } + } ++ if (off != (unsigned)len) ++ printed += fprintf(fp, "\tmismatch of LBR data and executable\n"); + } + + /* +@@ -1066,6 +1069,7 @@ static int perf_sample__fprintf_brstackinsn(struct perf_sample *sample, + goto out; + } + for (off = 0; off <= end - start; off += ilen) { ++ ilen = 0; + printed += fprintf(fp, "\t%016" PRIx64 "\t%s\n", start + off, + dump_insn(&x, start + off, buffer + off, len - off, &ilen)); + if (ilen == 0) +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index 6b36b7110669..6cd9623ebc93 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -446,12 +446,12 @@ static struct fixed { + const char *name; + const char *event; + } fixed[] = { +- { "inst_retired.any", "event=0xc0" }, +- { "inst_retired.any_p", "event=0xc0" }, +- { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" }, +- { "cpu_clk_unhalted.thread", "event=0x3c" }, +- { "cpu_clk_unhalted.core", "event=0x3c" }, +- { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" }, ++ { "inst_retired.any", "event=0xc0,period=2000003" }, ++ { "inst_retired.any_p", "event=0xc0,period=2000003" }, ++ { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03,period=2000003" }, ++ { "cpu_clk_unhalted.thread", "event=0x3c,period=2000003" }, ++ { "cpu_clk_unhalted.core", "event=0x3c,period=2000003" }, ++ { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1,period=2000003" }, + { NULL, NULL}, + }; + +diff --git a/tools/perf/tests/perf-hooks.c b/tools/perf/tests/perf-hooks.c +index a693bcf017ea..44c16fd11bf6 100644 +--- a/tools/perf/tests/perf-hooks.c ++++ b/tools/perf/tests/perf-hooks.c +@@ -20,12 +20,11 @@ static void sigsegv_handler(int sig __maybe_unused) + static void the_hook(void *_hook_flags) + { + int *hook_flags = _hook_flags; +- int *p = NULL; + + *hook_flags = 1234; + + /* Generate a segfault, test perf_hooks__recover */ +- *p = 0; ++ raise(SIGSEGV); + } + + int test__perf_hooks(struct test *test __maybe_unused, int subtest __maybe_unused) +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index daea1fdf7385..6958d7eed5be 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -1614,7 +1614,7 @@ static int dso__disassemble_filename(struct dso *dso, char *filename, size_t fil + + build_id_path = strdup(filename); + if (!build_id_path) +- return -1; ++ return ENOMEM; + + /* + * old style build-id cache has name of XX/XXXXXXX.. while +@@ -1871,11 +1871,11 @@ int symbol__annotate(struct symbol *sym, struct map *map, + int err; + + if (!arch_name) +- return -1; ++ return errno; + + args.arch = arch = arch__find(arch_name); + if (arch == NULL) +- return -ENOTSUP; ++ return ENOTSUP; + + if (parch) + *parch = arch; +@@ -2732,7 +2732,7 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev + + notes->offsets = zalloc(size * sizeof(struct annotation_line *)); + if (notes->offsets == NULL) +- return -1; ++ return ENOMEM; + + if (perf_evsel__is_group_event(evsel)) + nr_pcnt = evsel->nr_members; +@@ -2757,7 +2757,7 @@ int symbol__annotate2(struct symbol *sym, struct map *map, struct perf_evsel *ev + + out_free_offsets: + zfree(¬es->offsets); +- return -1; ++ return err; + } + + #define ANNOTATION__CFG(n) \ +diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c +index 6a6929f208b4..1117ab86ebd3 100644 +--- a/tools/perf/util/map.c ++++ b/tools/perf/util/map.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #include "symbol.h" ++#include <assert.h> + #include <errno.h> + #include <inttypes.h> + #include <limits.h> +@@ -751,6 +752,8 @@ static int maps__fixup_overlappings(struct maps *maps, struct map *map, FILE *fp + } + + after->start = map->end; ++ after->pgoff += map->end - pos->start; ++ assert(pos->map_ip(pos, map->end) == after->map_ip(after, map->end)); + __map_groups__insert(pos->groups, after); + if (verbose >= 2 && !use_browser) + map__fprintf(after, fp); +diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c +index 71cf7e77291a..823bbc741ad7 100644 +--- a/tools/power/x86/turbostat/turbostat.c ++++ b/tools/power/x86/turbostat/turbostat.c +@@ -1953,11 +1953,12 @@ done: + #define PCL_7S 11 /* PC7 Shrink */ + #define PCL__8 12 /* PC8 */ + #define PCL__9 13 /* PC9 */ +-#define PCLUNL 14 /* Unlimited */ ++#define PCL_10 14 /* PC10 */ ++#define PCLUNL 15 /* Unlimited */ + + int pkg_cstate_limit = PCLUKN; + char *pkg_cstate_limit_strings[] = { "reserved", "unknown", "pc0", "pc1", "pc2", +- "pc3", "pc4", "pc6", "pc6n", "pc6r", "pc7", "pc7s", "pc8", "pc9", "unlimited"}; ++ "pc3", "pc4", "pc6", "pc6n", "pc6r", "pc7", "pc7s", "pc8", "pc9", "pc10", "unlimited"}; + + int nhm_pkg_cstate_limits[16] = {PCL__0, PCL__1, PCL__3, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; + int snb_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCL__7, PCL_7S, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; +@@ -1965,7 +1966,7 @@ int hsw_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL__3, PCL__6, PCL__7, PCL_7S, + int slv_pkg_cstate_limits[16] = {PCL__0, PCL__1, PCLRSV, PCLRSV, PCL__4, PCLRSV, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCL__6, PCL__7}; + int amt_pkg_cstate_limits[16] = {PCLUNL, PCL__1, PCL__2, PCLRSV, PCLRSV, PCLRSV, PCL__6, PCL__7, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; + int phi_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCLRSV, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; +-int bxt_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; ++int glm_pkg_cstate_limits[16] = {PCLUNL, PCL__1, PCL__3, PCL__6, PCL__7, PCL_7S, PCL__8, PCL__9, PCL_10, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; + int skx_pkg_cstate_limits[16] = {PCL__0, PCL__2, PCL_6N, PCL_6R, PCLRSV, PCLRSV, PCLRSV, PCLUNL, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV, PCLRSV}; + + +@@ -3165,7 +3166,7 @@ int probe_nhm_msrs(unsigned int family, unsigned int model) + case INTEL_FAM6_ATOM_GOLDMONT: /* BXT */ + case INTEL_FAM6_ATOM_GOLDMONT_PLUS: + case INTEL_FAM6_ATOM_GOLDMONT_X: /* DNV */ +- pkg_cstate_limits = bxt_pkg_cstate_limits; ++ pkg_cstate_limits = glm_pkg_cstate_limits; + break; + default: + return 0; |