[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Alice Ferrazzi]

commit:     b8a9123d2e639a06e18b9a738f628c907dfdb686
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 10 13:02:20 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sun Dec 10 13:02:20 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b8a9123d

linux kernel 4.14.5

 0000_README             |    4 +
 1004_linux-4.14.5.patch | 2342 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2346 insertions(+)

diff --git a/0000_README b/0000_README
index 6749ad6..797ac0c 100644
--- a/0000_README
+++ b/0000_README
@@ -59,6 +59,10 @@ Patch:  1003_linux-4.14.4.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.4
 
+Patch:  1004_linux-4.14.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.5
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1004_linux-4.14.5.patch b/1004_linux-4.14.5.patch
new file mode 100644
index 0000000..e762dc5
--- /dev/null
+++ b/1004_linux-4.14.5.patch
@@ -0,0 +1,2342 @@
+diff --git a/Documentation/devicetree/bindings/timer/renesas,cmt.txt b/Documentation/devicetree/bindings/timer/renesas,cmt.txt
+index 6ca6b9e582a0..d740989eb569 100644
+--- a/Documentation/devicetree/bindings/timer/renesas,cmt.txt
++++ b/Documentation/devicetree/bindings/timer/renesas,cmt.txt
+@@ -20,16 +20,16 @@ Required Properties:
+ 		(CMT1 on sh73a0 and r8a7740)
+ 		This is a fallback for the above renesas,cmt-48-* entries.
+ 
+-    - "renesas,cmt0-r8a73a4" for the 32-bit CMT0 device included in r8a73a4.
+-    - "renesas,cmt1-r8a73a4" for the 48-bit CMT1 device included in r8a73a4.
+-    - "renesas,cmt0-r8a7790" for the 32-bit CMT0 device included in r8a7790.
+-    - "renesas,cmt1-r8a7790" for the 48-bit CMT1 device included in r8a7790.
+-    - "renesas,cmt0-r8a7791" for the 32-bit CMT0 device included in r8a7791.
+-    - "renesas,cmt1-r8a7791" for the 48-bit CMT1 device included in r8a7791.
+-    - "renesas,cmt0-r8a7793" for the 32-bit CMT0 device included in r8a7793.
+-    - "renesas,cmt1-r8a7793" for the 48-bit CMT1 device included in r8a7793.
+-    - "renesas,cmt0-r8a7794" for the 32-bit CMT0 device included in r8a7794.
+-    - "renesas,cmt1-r8a7794" for the 48-bit CMT1 device included in r8a7794.
++    - "renesas,r8a73a4-cmt0" for the 32-bit CMT0 device included in r8a73a4.
++    - "renesas,r8a73a4-cmt1" for the 48-bit CMT1 device included in r8a73a4.
++    - "renesas,r8a7790-cmt0" for the 32-bit CMT0 device included in r8a7790.
++    - "renesas,r8a7790-cmt1" for the 48-bit CMT1 device included in r8a7790.
++    - "renesas,r8a7791-cmt0" for the 32-bit CMT0 device included in r8a7791.
++    - "renesas,r8a7791-cmt1" for the 48-bit CMT1 device included in r8a7791.
++    - "renesas,r8a7793-cmt0" for the 32-bit CMT0 device included in r8a7793.
++    - "renesas,r8a7793-cmt1" for the 48-bit CMT1 device included in r8a7793.
++    - "renesas,r8a7794-cmt0" for the 32-bit CMT0 device included in r8a7794.
++    - "renesas,r8a7794-cmt1" for the 48-bit CMT1 device included in r8a7794.
+ 
+     - "renesas,rcar-gen2-cmt0" for 32-bit CMT0 devices included in R-Car Gen2.
+     - "renesas,rcar-gen2-cmt1" for 48-bit CMT1 devices included in R-Car Gen2.
+@@ -46,7 +46,7 @@ Required Properties:
+ Example: R8A7790 (R-Car H2) CMT0 and CMT1 nodes
+ 
+ 	cmt0: timer@ffca0000 {
+-		compatible = "renesas,cmt0-r8a7790", "renesas,rcar-gen2-cmt0";
++		compatible = "renesas,r8a7790-cmt0", "renesas,rcar-gen2-cmt0";
+ 		reg = <0 0xffca0000 0 0x1004>;
+ 		interrupts = <0 142 IRQ_TYPE_LEVEL_HIGH>,
+ 			     <0 142 IRQ_TYPE_LEVEL_HIGH>;
+@@ -55,7 +55,7 @@ Example: R8A7790 (R-Car H2) CMT0 and CMT1 nodes
+ 	};
+ 
+ 	cmt1: timer@e6130000 {
+-		compatible = "renesas,cmt1-r8a7790", "renesas,rcar-gen2-cmt1";
++		compatible = "renesas,r8a7790-cmt1", "renesas,rcar-gen2-cmt1";
+ 		reg = <0 0xe6130000 0 0x1004>;
+ 		interrupts = <0 120 IRQ_TYPE_LEVEL_HIGH>,
+ 			     <0 121 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/Makefile b/Makefile
+index ba1648c093fe..43ac7bdb10ad 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 057370a0ac4e..400b9e1b2f27 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -91,7 +91,7 @@ config STATIC_KEYS_SELFTEST
+ config OPTPROBES
+ 	def_bool y
+ 	depends on KPROBES && HAVE_OPTPROBES
+-	depends on !PREEMPT
++	select TASKS_RCU if PREEMPT
+ 
+ config KPROBES_ON_FTRACE
+ 	def_bool y
+diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
+index 8d1408583cf4..b523a604cb87 100644
+--- a/arch/m68k/mm/mcfmmu.c
++++ b/arch/m68k/mm/mcfmmu.c
+@@ -170,7 +170,7 @@ void __init cf_bootmem_alloc(void)
+ 	max_pfn = max_low_pfn = PFN_DOWN(_ramend);
+ 	high_memory = (void *)_ramend;
+ 
+-	m68k_virt_to_node_shift = fls(_ramend - _rambase - 1) - 6;
++	m68k_virt_to_node_shift = fls(_ramend - 1) - 6;
+ 	module_fixup(NULL, __start_fixup, __stop_fixup);
+ 
+ 	/* setup bootmem data */
+diff --git a/arch/mips/include/asm/Kbuild b/arch/mips/include/asm/Kbuild
+index 7c8aab23bce8..b1f66699677d 100644
+--- a/arch/mips/include/asm/Kbuild
++++ b/arch/mips/include/asm/Kbuild
+@@ -16,7 +16,6 @@ generic-y += qrwlock.h
+ generic-y += qspinlock.h
+ generic-y += sections.h
+ generic-y += segment.h
+-generic-y += serial.h
+ generic-y += trace_clock.h
+ generic-y += unaligned.h
+ generic-y += user.h
+diff --git a/arch/mips/include/asm/serial.h b/arch/mips/include/asm/serial.h
+new file mode 100644
+index 000000000000..1d830c6666c2
+--- /dev/null
++++ b/arch/mips/include/asm/serial.h
+@@ -0,0 +1,22 @@
++/*
++ * Copyright (C) 2017 MIPS Tech, LLC
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++#ifndef __ASM__SERIAL_H
++#define __ASM__SERIAL_H
++
++#ifdef CONFIG_MIPS_GENERIC
++/*
++ * Generic kernels cannot know a correct value for all platforms at
++ * compile time. Set it to 0 to prevent 8250_early using it
++ */
++#define BASE_BAUD 0
++#else
++#include <asm-generic/serial.h>
++#endif
++
++#endif /* __ASM__SERIAL_H */
+diff --git a/arch/powerpc/kernel/kprobes-ftrace.c b/arch/powerpc/kernel/kprobes-ftrace.c
+index 6c089d9757c9..2d81404f818c 100644
+--- a/arch/powerpc/kernel/kprobes-ftrace.c
++++ b/arch/powerpc/kernel/kprobes-ftrace.c
+@@ -65,6 +65,7 @@ void kprobe_ftrace_handler(unsigned long nip, unsigned long parent_nip,
+ 	/* Disable irq for emulating a breakpoint and avoiding preempt */
+ 	local_irq_save(flags);
+ 	hard_irq_disable();
++	preempt_disable();
+ 
+ 	p = get_kprobe((kprobe_opcode_t *)nip);
+ 	if (unlikely(!p) || kprobe_disabled(p))
+@@ -86,12 +87,18 @@ void kprobe_ftrace_handler(unsigned long nip, unsigned long parent_nip,
+ 		kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+ 		if (!p->pre_handler || !p->pre_handler(p, regs))
+ 			__skip_singlestep(p, regs, kcb, orig_nip);
+-		/*
+-		 * If pre_handler returns !0, it sets regs->nip and
+-		 * resets current kprobe.
+-		 */
++		else {
++			/*
++			 * If pre_handler returns !0, it sets regs->nip and
++			 * resets current kprobe. In this case, we still need
++			 * to restore irq, but not preemption.
++			 */
++			local_irq_restore(flags);
++			return;
++		}
+ 	}
+ end:
++	preempt_enable_no_resched();
+ 	local_irq_restore(flags);
+ }
+ NOKPROBE_SYMBOL(kprobe_ftrace_handler);
+diff --git a/arch/powerpc/kernel/optprobes.c b/arch/powerpc/kernel/optprobes.c
+index 91e037ab20a1..60ba7f1370a8 100644
+--- a/arch/powerpc/kernel/optprobes.c
++++ b/arch/powerpc/kernel/optprobes.c
+@@ -115,7 +115,6 @@ static unsigned long can_optimize(struct kprobe *p)
+ static void optimized_callback(struct optimized_kprobe *op,
+ 			       struct pt_regs *regs)
+ {
+-	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ 	unsigned long flags;
+ 
+ 	/* This is possible if op is under delayed unoptimizing */
+@@ -124,13 +123,14 @@ static void optimized_callback(struct optimized_kprobe *op,
+ 
+ 	local_irq_save(flags);
+ 	hard_irq_disable();
++	preempt_disable();
+ 
+ 	if (kprobe_running()) {
+ 		kprobes_inc_nmissed_count(&op->kp);
+ 	} else {
+ 		__this_cpu_write(current_kprobe, &op->kp);
+ 		regs->nip = (unsigned long)op->kp.addr;
+-		kcb->kprobe_status = KPROBE_HIT_ACTIVE;
++		get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
+ 		opt_pre_handler(&op->kp, regs);
+ 		__this_cpu_write(current_kprobe, NULL);
+ 	}
+@@ -140,6 +140,7 @@ static void optimized_callback(struct optimized_kprobe *op,
+ 	 * local_irq_restore() will re-enable interrupts,
+ 	 * if they were hard disabled.
+ 	 */
++	preempt_enable_no_resched();
+ 	local_irq_restore(flags);
+ }
+ NOKPROBE_SYMBOL(optimized_callback);
+diff --git a/arch/s390/include/asm/pci_insn.h b/arch/s390/include/asm/pci_insn.h
+index 419e83fa4721..ba22a6ea51a1 100644
+--- a/arch/s390/include/asm/pci_insn.h
++++ b/arch/s390/include/asm/pci_insn.h
+@@ -82,6 +82,6 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range);
+ int zpci_load(u64 *data, u64 req, u64 offset);
+ int zpci_store(u64 data, u64 req, u64 offset);
+ int zpci_store_block(const u64 *data, u64 req, u64 offset);
+-void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc);
++int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc);
+ 
+ #endif
+diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h
+index ea8896ba5afc..2502d05403ef 100644
+--- a/arch/s390/include/asm/runtime_instr.h
++++ b/arch/s390/include/asm/runtime_instr.h
+@@ -86,6 +86,8 @@ static inline void restore_ri_cb(struct runtime_instr_cb *cb_next,
+ 		load_runtime_instr_cb(&runtime_instr_empty_cb);
+ }
+ 
+-void exit_thread_runtime_instr(void);
++struct task_struct;
++
++void runtime_instr_release(struct task_struct *tsk);
+ 
+ #endif /* _RUNTIME_INSTR_H */
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index 203b7cd7c348..7d4c5500c6c2 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -49,10 +49,8 @@ extern void kernel_thread_starter(void);
+  */
+ void exit_thread(struct task_struct *tsk)
+ {
+-	if (tsk == current) {
+-		exit_thread_runtime_instr();
++	if (tsk == current)
+ 		exit_thread_gs();
+-	}
+ }
+ 
+ void flush_thread(void)
+@@ -65,6 +63,7 @@ void release_thread(struct task_struct *dead_task)
+ 
+ void arch_release_task_struct(struct task_struct *tsk)
+ {
++	runtime_instr_release(tsk);
+ }
+ 
+ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 1427d60ce628..56e0190d6e65 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -1172,26 +1172,37 @@ static int s390_gs_cb_set(struct task_struct *target,
+ 			  unsigned int pos, unsigned int count,
+ 			  const void *kbuf, const void __user *ubuf)
+ {
+-	struct gs_cb *data = target->thread.gs_cb;
++	struct gs_cb gs_cb = { }, *data = NULL;
+ 	int rc;
+ 
+ 	if (!MACHINE_HAS_GS)
+ 		return -ENODEV;
+-	if (!data) {
++	if (!target->thread.gs_cb) {
+ 		data = kzalloc(sizeof(*data), GFP_KERNEL);
+ 		if (!data)
+ 			return -ENOMEM;
+-		data->gsd = 25;
+-		target->thread.gs_cb = data;
+-		if (target == current)
+-			__ctl_set_bit(2, 4);
+-	} else if (target == current) {
+-		save_gs_cb(data);
+ 	}
++	if (!target->thread.gs_cb)
++		gs_cb.gsd = 25;
++	else if (target == current)
++		save_gs_cb(&gs_cb);
++	else
++		gs_cb = *target->thread.gs_cb;
+ 	rc = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+-				data, 0, sizeof(struct gs_cb));
+-	if (target == current)
+-		restore_gs_cb(data);
++				&gs_cb, 0, sizeof(gs_cb));
++	if (rc) {
++		kfree(data);
++		return -EFAULT;
++	}
++	preempt_disable();
++	if (!target->thread.gs_cb)
++		target->thread.gs_cb = data;
++	*target->thread.gs_cb = gs_cb;
++	if (target == current) {
++		__ctl_set_bit(2, 4);
++		restore_gs_cb(target->thread.gs_cb);
++	}
++	preempt_enable();
+ 	return rc;
+ }
+ 
+diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
+index d85c64821a6b..94c9ba72cf83 100644
+--- a/arch/s390/kernel/runtime_instr.c
++++ b/arch/s390/kernel/runtime_instr.c
+@@ -21,11 +21,24 @@
+ /* empty control block to disable RI by loading it */
+ struct runtime_instr_cb runtime_instr_empty_cb;
+ 
++void runtime_instr_release(struct task_struct *tsk)
++{
++	kfree(tsk->thread.ri_cb);
++}
++
+ static void disable_runtime_instr(void)
+ {
+-	struct pt_regs *regs = task_pt_regs(current);
++	struct task_struct *task = current;
++	struct pt_regs *regs;
+ 
++	if (!task->thread.ri_cb)
++		return;
++	regs = task_pt_regs(task);
++	preempt_disable();
+ 	load_runtime_instr_cb(&runtime_instr_empty_cb);
++	kfree(task->thread.ri_cb);
++	task->thread.ri_cb = NULL;
++	preempt_enable();
+ 
+ 	/*
+ 	 * Make sure the RI bit is deleted from the PSW. If the user did not
+@@ -46,19 +59,6 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb)
+ 	cb->valid = 1;
+ }
+ 
+-void exit_thread_runtime_instr(void)
+-{
+-	struct task_struct *task = current;
+-
+-	preempt_disable();
+-	if (!task->thread.ri_cb)
+-		return;
+-	disable_runtime_instr();
+-	kfree(task->thread.ri_cb);
+-	task->thread.ri_cb = NULL;
+-	preempt_enable();
+-}
+-
+ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+ {
+ 	struct runtime_instr_cb *cb;
+@@ -67,7 +67,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (command == S390_RUNTIME_INSTR_STOP) {
+-		exit_thread_runtime_instr();
++		disable_runtime_instr();
+ 		return 0;
+ 	}
+ 
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index a25d95a6612d..0fe649c0d542 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -368,7 +368,8 @@ static void zpci_irq_handler(struct airq_struct *airq)
+ 				/* End of second scan with interrupts on. */
+ 				break;
+ 			/* First scan complete, reenable interrupts. */
+-			zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC);
++			if (zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC))
++				break;
+ 			si = 0;
+ 			continue;
+ 		}
+@@ -956,7 +957,7 @@ static int __init pci_base_init(void)
+ 	if (!s390_pci_probe)
+ 		return 0;
+ 
+-	if (!test_facility(69) || !test_facility(71) || !test_facility(72))
++	if (!test_facility(69) || !test_facility(71))
+ 		return 0;
+ 
+ 	rc = zpci_debug_init();
+diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c
+index ea34086c8674..81b840bc6e4e 100644
+--- a/arch/s390/pci/pci_insn.c
++++ b/arch/s390/pci/pci_insn.c
+@@ -7,6 +7,7 @@
+ #include <linux/export.h>
+ #include <linux/errno.h>
+ #include <linux/delay.h>
++#include <asm/facility.h>
+ #include <asm/pci_insn.h>
+ #include <asm/pci_debug.h>
+ #include <asm/processor.h>
+@@ -91,11 +92,14 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range)
+ }
+ 
+ /* Set Interruption Controls */
+-void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc)
++int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc)
+ {
++	if (!test_facility(72))
++		return -EIO;
+ 	asm volatile (
+ 		"	.insn	rsy,0xeb00000000d1,%[ctl],%[isc],%[u]\n"
+ 		: : [ctl] "d" (ctl), [isc] "d" (isc << 27), [u] "Q" (*unused));
++	return 0;
+ }
+ 
+ /* PCI Load */
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 2fdb23313dd5..9bceea6a5852 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -56,7 +56,7 @@ config X86
+ 	select ARCH_HAS_KCOV			if X86_64
+ 	select ARCH_HAS_PMEM_API		if X86_64
+ 	# Causing hangs/crashes, see the commit that added this change for details.
+-	select ARCH_HAS_REFCOUNT		if BROKEN
++	select ARCH_HAS_REFCOUNT
+ 	select ARCH_HAS_UACCESS_FLUSHCACHE	if X86_64
+ 	select ARCH_HAS_SET_MEMORY
+ 	select ARCH_HAS_SG_CHAIN
+diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h
+index ff871210b9f2..4e44250e7d0d 100644
+--- a/arch/x86/include/asm/refcount.h
++++ b/arch/x86/include/asm/refcount.h
+@@ -15,7 +15,7 @@
+  * back to the regular execution flow in .text.
+  */
+ #define _REFCOUNT_EXCEPTION				\
+-	".pushsection .text.unlikely\n"			\
++	".pushsection .text..refcount\n"		\
+ 	"111:\tlea %[counter], %%" _ASM_CX "\n"		\
+ 	"112:\t" ASM_UD0 "\n"				\
+ 	ASM_UNREACHABLE					\
+diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h
+index 91dfcafe27a6..bad25bb80679 100644
+--- a/arch/x86/include/asm/syscalls.h
++++ b/arch/x86/include/asm/syscalls.h
+@@ -21,7 +21,7 @@ asmlinkage long sys_ioperm(unsigned long, unsigned long, int);
+ asmlinkage long sys_iopl(unsigned int);
+ 
+ /* kernel/ldt.c */
+-asmlinkage int sys_modify_ldt(int, void __user *, unsigned long);
++asmlinkage long sys_modify_ldt(int, void __user *, unsigned long);
+ 
+ /* kernel/signal.c */
+ asmlinkage long sys_rt_sigreturn(void);
+diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c
+index cd5fc61ba450..88dcf8479013 100644
+--- a/arch/x86/kernel/cpu/intel_rdt.c
++++ b/arch/x86/kernel/cpu/intel_rdt.c
+@@ -267,6 +267,7 @@ static void rdt_get_cdp_l3_config(int type)
+ 	r->num_closid = r_l3->num_closid / 2;
+ 	r->cache.cbm_len = r_l3->cache.cbm_len;
+ 	r->default_ctrl = r_l3->default_ctrl;
++	r->cache.shareable_bits = r_l3->cache.shareable_bits;
+ 	r->data_width = (r->cache.cbm_len + 3) / 4;
+ 	r->alloc_capable = true;
+ 	/*
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index a869d4a073c5..3d433af856a5 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -1081,6 +1081,7 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ 	struct dentry *dentry;
+ 	int ret;
+ 
++	cpus_read_lock();
+ 	mutex_lock(&rdtgroup_mutex);
+ 	/*
+ 	 * resctrl file system can only be mounted once.
+@@ -1130,12 +1131,12 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ 		goto out_mondata;
+ 
+ 	if (rdt_alloc_capable)
+-		static_branch_enable(&rdt_alloc_enable_key);
++		static_branch_enable_cpuslocked(&rdt_alloc_enable_key);
+ 	if (rdt_mon_capable)
+-		static_branch_enable(&rdt_mon_enable_key);
++		static_branch_enable_cpuslocked(&rdt_mon_enable_key);
+ 
+ 	if (rdt_alloc_capable || rdt_mon_capable)
+-		static_branch_enable(&rdt_enable_key);
++		static_branch_enable_cpuslocked(&rdt_enable_key);
+ 
+ 	if (is_mbm_enabled()) {
+ 		r = &rdt_resources_all[RDT_RESOURCE_L3];
+@@ -1157,6 +1158,7 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ 	cdp_disable();
+ out:
+ 	mutex_unlock(&rdtgroup_mutex);
++	cpus_read_unlock();
+ 
+ 	return dentry;
+ }
+diff --git a/arch/x86/kernel/kprobes/ftrace.c b/arch/x86/kernel/kprobes/ftrace.c
+index 041f7b6dfa0f..bcfee4f69b0e 100644
+--- a/arch/x86/kernel/kprobes/ftrace.c
++++ b/arch/x86/kernel/kprobes/ftrace.c
+@@ -26,7 +26,7 @@
+ #include "common.h"
+ 
+ static nokprobe_inline
+-int __skip_singlestep(struct kprobe *p, struct pt_regs *regs,
++void __skip_singlestep(struct kprobe *p, struct pt_regs *regs,
+ 		      struct kprobe_ctlblk *kcb, unsigned long orig_ip)
+ {
+ 	/*
+@@ -41,20 +41,21 @@ int __skip_singlestep(struct kprobe *p, struct pt_regs *regs,
+ 	__this_cpu_write(current_kprobe, NULL);
+ 	if (orig_ip)
+ 		regs->ip = orig_ip;
+-	return 1;
+ }
+ 
+ int skip_singlestep(struct kprobe *p, struct pt_regs *regs,
+ 		    struct kprobe_ctlblk *kcb)
+ {
+-	if (kprobe_ftrace(p))
+-		return __skip_singlestep(p, regs, kcb, 0);
+-	else
+-		return 0;
++	if (kprobe_ftrace(p)) {
++		__skip_singlestep(p, regs, kcb, 0);
++		preempt_enable_no_resched();
++		return 1;
++	}
++	return 0;
+ }
+ NOKPROBE_SYMBOL(skip_singlestep);
+ 
+-/* Ftrace callback handler for kprobes */
++/* Ftrace callback handler for kprobes -- called under preepmt disabed */
+ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
+ 			   struct ftrace_ops *ops, struct pt_regs *regs)
+ {
+@@ -77,13 +78,17 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
+ 		/* Kprobe handler expects regs->ip = ip + 1 as breakpoint hit */
+ 		regs->ip = ip + sizeof(kprobe_opcode_t);
+ 
++		/* To emulate trap based kprobes, preempt_disable here */
++		preempt_disable();
+ 		__this_cpu_write(current_kprobe, p);
+ 		kcb->kprobe_status = KPROBE_HIT_ACTIVE;
+-		if (!p->pre_handler || !p->pre_handler(p, regs))
++		if (!p->pre_handler || !p->pre_handler(p, regs)) {
+ 			__skip_singlestep(p, regs, kcb, orig_ip);
++			preempt_enable_no_resched();
++		}
+ 		/*
+ 		 * If pre_handler returns !0, it sets regs->ip and
+-		 * resets current kprobe.
++		 * resets current kprobe, and keep preempt count +1.
+ 		 */
+ 	}
+ end:
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 4d17bacf4030..ae5615b03def 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -13,6 +13,7 @@
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/smp.h>
++#include <linux/syscalls.h>
+ #include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/uaccess.h>
+@@ -295,8 +296,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 	return error;
+ }
+ 
+-asmlinkage int sys_modify_ldt(int func, void __user *ptr,
+-			      unsigned long bytecount)
++SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr ,
++		unsigned long , bytecount)
+ {
+ 	int ret = -ENOSYS;
+ 
+@@ -314,5 +315,14 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr,
+ 		ret = write_ldt(ptr, bytecount, 0);
+ 		break;
+ 	}
+-	return ret;
++	/*
++	 * The SYSCALL_DEFINE() macros give us an 'unsigned long'
++	 * return type, but tht ABI for sys_modify_ldt() expects
++	 * 'int'.  This cast gives us an int-sized value in %rax
++	 * for the return code.  The 'unsigned' is necessary so
++	 * the compiler does not try to sign-extend the negative
++	 * return codes into the high half of the register when
++	 * taking the value from int->long.
++	 */
++	return (unsigned int)ret;
+ }
+diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
+index c3521e2be396..30bc4812ceb8 100644
+--- a/arch/x86/mm/extable.c
++++ b/arch/x86/mm/extable.c
+@@ -67,17 +67,22 @@ bool ex_handler_refcount(const struct exception_table_entry *fixup,
+ 	 * wrapped around) will be set. Additionally, seeing the refcount
+ 	 * reach 0 will set ZF (Zero Flag: result was zero). In each of
+ 	 * these cases we want a report, since it's a boundary condition.
+-	 *
++	 * The SF case is not reported since it indicates post-boundary
++	 * manipulations below zero or above INT_MAX. And if none of the
++	 * flags are set, something has gone very wrong, so report it.
+ 	 */
+ 	if (regs->flags & (X86_EFLAGS_OF | X86_EFLAGS_ZF)) {
+ 		bool zero = regs->flags & X86_EFLAGS_ZF;
+ 
+ 		refcount_error_report(regs, zero ? "hit zero" : "overflow");
++	} else if ((regs->flags & X86_EFLAGS_SF) == 0) {
++		/* Report if none of OF, ZF, nor SF are set. */
++		refcount_error_report(regs, "unexpected saturation");
+ 	}
+ 
+ 	return true;
+ }
+-EXPORT_SYMBOL_GPL(ex_handler_refcount);
++EXPORT_SYMBOL(ex_handler_refcount);
+ 
+ /*
+  * Handler for when we fail to restore a task's FPU state.  We should never get
+diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c
+index 836a1eb5df43..3ee234b6234d 100644
+--- a/arch/x86/um/ldt.c
++++ b/arch/x86/um/ldt.c
+@@ -6,6 +6,7 @@
+ #include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/slab.h>
++#include <linux/syscalls.h>
+ #include <linux/uaccess.h>
+ #include <asm/unistd.h>
+ #include <os.h>
+@@ -369,7 +370,9 @@ void free_ldt(struct mm_context *mm)
+ 	mm->arch.ldt.entry_count = 0;
+ }
+ 
+-int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
++SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr ,
++		unsigned long , bytecount)
+ {
+-	return do_modify_ldt_skas(func, ptr, bytecount);
++	/* See non-um modify_ldt() for why we do this cast */
++	return (unsigned int)do_modify_ldt_skas(func, ptr, bytecount);
+ }
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index fddf76ef5bd6..88b4bbe58100 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1947,6 +1947,26 @@ static void binder_send_failed_reply(struct binder_transaction *t,
+ 	}
+ }
+ 
++/**
++ * binder_cleanup_transaction() - cleans up undelivered transaction
++ * @t:		transaction that needs to be cleaned up
++ * @reason:	reason the transaction wasn't delivered
++ * @error_code:	error to return to caller (if synchronous call)
++ */
++static void binder_cleanup_transaction(struct binder_transaction *t,
++				       const char *reason,
++				       uint32_t error_code)
++{
++	if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
++		binder_send_failed_reply(t, error_code);
++	} else {
++		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
++			"undelivered transaction %d, %s\n",
++			t->debug_id, reason);
++		binder_free_transaction(t);
++	}
++}
++
+ /**
+  * binder_validate_object() - checks for a valid metadata object in a buffer.
+  * @buffer:	binder_buffer that we're parsing.
+@@ -4015,12 +4035,20 @@ static int binder_thread_read(struct binder_proc *proc,
+ 		if (put_user(cmd, (uint32_t __user *)ptr)) {
+ 			if (t_from)
+ 				binder_thread_dec_tmpref(t_from);
++
++			binder_cleanup_transaction(t, "put_user failed",
++						   BR_FAILED_REPLY);
++
+ 			return -EFAULT;
+ 		}
+ 		ptr += sizeof(uint32_t);
+ 		if (copy_to_user(ptr, &tr, sizeof(tr))) {
+ 			if (t_from)
+ 				binder_thread_dec_tmpref(t_from);
++
++			binder_cleanup_transaction(t, "copy_to_user failed",
++						   BR_FAILED_REPLY);
++
+ 			return -EFAULT;
+ 		}
+ 		ptr += sizeof(tr);
+@@ -4090,15 +4118,9 @@ static void binder_release_work(struct binder_proc *proc,
+ 			struct binder_transaction *t;
+ 
+ 			t = container_of(w, struct binder_transaction, work);
+-			if (t->buffer->target_node &&
+-			    !(t->flags & TF_ONE_WAY)) {
+-				binder_send_failed_reply(t, BR_DEAD_REPLY);
+-			} else {
+-				binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+-					"undelivered transaction %d\n",
+-					t->debug_id);
+-				binder_free_transaction(t);
+-			}
++
++			binder_cleanup_transaction(t, "process died.",
++						   BR_DEAD_REPLY);
+ 		} break;
+ 		case BINDER_WORK_RETURN_ERROR: {
+ 			struct binder_error *e = container_of(
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index e8ca5e2cf1e5..70f8904f46a3 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -921,7 +921,7 @@ static int pm_genpd_prepare(struct device *dev)
+ 	genpd_unlock(genpd);
+ 
+ 	ret = pm_generic_prepare(dev);
+-	if (ret) {
++	if (ret < 0) {
+ 		genpd_lock(genpd);
+ 
+ 		genpd->prepared_count--;
+@@ -929,7 +929,8 @@ static int pm_genpd_prepare(struct device *dev)
+ 		genpd_unlock(genpd);
+ 	}
+ 
+-	return ret;
++	/* Never return 1, as genpd don't cope with the direct_complete path. */
++	return ret >= 0 ? 0 : ret;
+ }
+ 
+ /**
+diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
+index fd4b7f684bd0..14e2419063e9 100644
+--- a/drivers/clocksource/arm_arch_timer.c
++++ b/drivers/clocksource/arm_arch_timer.c
+@@ -1268,10 +1268,6 @@ arch_timer_mem_find_best_frame(struct arch_timer_mem *timer_mem)
+ 
+ 	iounmap(cntctlbase);
+ 
+-	if (!best_frame)
+-		pr_err("Unable to find a suitable frame in timer @ %pa\n",
+-			&timer_mem->cntctlbase);
+-
+ 	return best_frame;
+ }
+ 
+@@ -1372,6 +1368,8 @@ static int __init arch_timer_mem_of_init(struct device_node *np)
+ 
+ 	frame = arch_timer_mem_find_best_frame(timer_mem);
+ 	if (!frame) {
++		pr_err("Unable to find a suitable frame in timer @ %pa\n",
++			&timer_mem->cntctlbase);
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
+@@ -1420,7 +1418,7 @@ arch_timer_mem_verify_cntfrq(struct arch_timer_mem *timer_mem)
+ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ {
+ 	struct arch_timer_mem *timers, *timer;
+-	struct arch_timer_mem_frame *frame;
++	struct arch_timer_mem_frame *frame, *best_frame = NULL;
+ 	int timer_count, i, ret = 0;
+ 
+ 	timers = kcalloc(platform_timer_count, sizeof(*timers),
+@@ -1432,14 +1430,6 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ 	if (ret || !timer_count)
+ 		goto out;
+ 
+-	for (i = 0; i < timer_count; i++) {
+-		ret = arch_timer_mem_verify_cntfrq(&timers[i]);
+-		if (ret) {
+-			pr_err("Disabling MMIO timers due to CNTFRQ mismatch\n");
+-			goto out;
+-		}
+-	}
+-
+ 	/*
+ 	 * While unlikely, it's theoretically possible that none of the frames
+ 	 * in a timer expose the combination of feature we want.
+@@ -1448,12 +1438,26 @@ static int __init arch_timer_mem_acpi_init(int platform_timer_count)
+ 		timer = &timers[i];
+ 
+ 		frame = arch_timer_mem_find_best_frame(timer);
+-		if (frame)
+-			break;
++		if (!best_frame)
++			best_frame = frame;
++
++		ret = arch_timer_mem_verify_cntfrq(timer);
++		if (ret) {
++			pr_err("Disabling MMIO timers due to CNTFRQ mismatch\n");
++			goto out;
++		}
++
++		if (!best_frame) /* implies !frame */
++			/*
++			 * Only complain about missing suitable frames if we
++			 * haven't already found one in a previous iteration.
++			 */
++			pr_err("Unable to find a suitable frame in timer @ %pa\n",
++				&timer->cntctlbase);
+ 	}
+ 
+-	if (frame)
+-		ret = arch_timer_mem_frame_register(frame);
++	if (best_frame)
++		ret = arch_timer_mem_frame_register(best_frame);
+ out:
+ 	kfree(timers);
+ 	return ret;
+diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
+index 52a75053ee03..f47c54546752 100644
+--- a/drivers/cpuidle/cpuidle-arm.c
++++ b/drivers/cpuidle/cpuidle-arm.c
+@@ -104,13 +104,13 @@ static int __init arm_idle_init(void)
+ 		ret = dt_init_idle_driver(drv, arm_idle_state_match, 1);
+ 		if (ret <= 0) {
+ 			ret = ret ? : -ENODEV;
+-			goto init_fail;
++			goto out_kfree_drv;
+ 		}
+ 
+ 		ret = cpuidle_register_driver(drv);
+ 		if (ret) {
+ 			pr_err("Failed to register cpuidle driver\n");
+-			goto init_fail;
++			goto out_kfree_drv;
+ 		}
+ 
+ 		/*
+@@ -128,14 +128,14 @@ static int __init arm_idle_init(void)
+ 
+ 		if (ret) {
+ 			pr_err("CPU %d failed to init idle CPU ops\n", cpu);
+-			goto out_fail;
++			goto out_unregister_drv;
+ 		}
+ 
+ 		dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ 		if (!dev) {
+ 			pr_err("Failed to allocate cpuidle device\n");
+ 			ret = -ENOMEM;
+-			goto out_fail;
++			goto out_unregister_drv;
+ 		}
+ 		dev->cpu = cpu;
+ 
+@@ -143,21 +143,25 @@ static int __init arm_idle_init(void)
+ 		if (ret) {
+ 			pr_err("Failed to register cpuidle device for CPU %d\n",
+ 			       cpu);
+-			kfree(dev);
+-			goto out_fail;
++			goto out_kfree_dev;
+ 		}
+ 	}
+ 
+ 	return 0;
+-init_fail:
++
++out_kfree_dev:
++	kfree(dev);
++out_unregister_drv:
++	cpuidle_unregister_driver(drv);
++out_kfree_drv:
+ 	kfree(drv);
+ out_fail:
+ 	while (--cpu >= 0) {
+ 		dev = per_cpu(cpuidle_devices, cpu);
++		drv = cpuidle_get_cpu_driver(dev);
+ 		cpuidle_unregister_device(dev);
+-		kfree(dev);
+-		drv = cpuidle_get_driver();
+ 		cpuidle_unregister_driver(drv);
++		kfree(dev);
+ 		kfree(drv);
+ 	}
+ 
+diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
+index 38cc7389a6c1..24f83f9eeaed 100644
+--- a/drivers/dma-buf/sw_sync.c
++++ b/drivers/dma-buf/sw_sync.c
+@@ -321,8 +321,16 @@ static int sw_sync_debugfs_open(struct inode *inode, struct file *file)
+ static int sw_sync_debugfs_release(struct inode *inode, struct file *file)
+ {
+ 	struct sync_timeline *obj = file->private_data;
++	struct sync_pt *pt, *next;
++
++	spin_lock_irq(&obj->lock);
++
++	list_for_each_entry_safe(pt, next, &obj->pt_list, link) {
++		dma_fence_set_error(&pt->base, -ENOENT);
++		dma_fence_signal_locked(&pt->base);
++	}
+ 
+-	smp_wmb();
++	spin_unlock_irq(&obj->lock);
+ 
+ 	sync_timeline_put(obj);
+ 	return 0;
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 6241fa787d66..cd9d6ba03579 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2498,6 +2498,7 @@ static int ibridge_mci_bind_devs(struct mem_ctl_info *mci,
+ 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA:
+ 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TA:
+ 			pvt->pci_ta = pdev;
++			break;
+ 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_RAS:
+ 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_RAS:
+ 			pvt->pci_ras = pdev;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+index 87801faaf264..712ad8c2bdc5 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -697,7 +697,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
+ 			  struct amdgpu_queue_mgr *mgr);
+ int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
+ 			 struct amdgpu_queue_mgr *mgr,
+-			 int hw_ip, int instance, int ring,
++			 u32 hw_ip, u32 instance, u32 ring,
+ 			 struct amdgpu_ring **out_ring);
+ 
+ /*
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
+index befc09b68543..b293380bd46c 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_queue_mgr.c
+@@ -63,7 +63,7 @@ static int amdgpu_update_cached_map(struct amdgpu_queue_mapper *mapper,
+ 
+ static int amdgpu_identity_map(struct amdgpu_device *adev,
+ 			       struct amdgpu_queue_mapper *mapper,
+-			       int ring,
++			       u32 ring,
+ 			       struct amdgpu_ring **out_ring)
+ {
+ 	switch (mapper->hw_ip) {
+@@ -121,7 +121,7 @@ static enum amdgpu_ring_type amdgpu_hw_ip_to_ring_type(int hw_ip)
+ 
+ static int amdgpu_lru_map(struct amdgpu_device *adev,
+ 			  struct amdgpu_queue_mapper *mapper,
+-			  int user_ring,
++			  u32 user_ring,
+ 			  struct amdgpu_ring **out_ring)
+ {
+ 	int r, i, j;
+@@ -208,7 +208,7 @@ int amdgpu_queue_mgr_fini(struct amdgpu_device *adev,
+  */
+ int amdgpu_queue_mgr_map(struct amdgpu_device *adev,
+ 			 struct amdgpu_queue_mgr *mgr,
+-			 int hw_ip, int instance, int ring,
++			 u32 hw_ip, u32 instance, u32 ring,
+ 			 struct amdgpu_ring **out_ring)
+ {
+ 	int r, ip_num_rings;
+diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+index 58e9e0601a61..faf17b83b910 100644
+--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_drv.c
+@@ -210,7 +210,6 @@ static int fsl_dcu_drm_pm_suspend(struct device *dev)
+ 		return PTR_ERR(fsl_dev->state);
+ 	}
+ 
+-	clk_disable_unprepare(fsl_dev->pix_clk);
+ 	clk_disable_unprepare(fsl_dev->clk);
+ 
+ 	return 0;
+@@ -233,6 +232,7 @@ static int fsl_dcu_drm_pm_resume(struct device *dev)
+ 	if (fsl_dev->tcon)
+ 		fsl_tcon_bypass_enable(fsl_dev->tcon);
+ 	fsl_dcu_drm_init_planes(fsl_dev->drm);
++	enable_irq(fsl_dev->irq);
+ 	drm_atomic_helper_resume(fsl_dev->drm, fsl_dev->state);
+ 
+ 	console_lock();
+@@ -240,7 +240,6 @@ static int fsl_dcu_drm_pm_resume(struct device *dev)
+ 	console_unlock();
+ 
+ 	drm_kms_helper_poll_enable(fsl_dev->drm);
+-	enable_irq(fsl_dev->irq);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h
+index 4efa2bd4f6d8..fa613bd209e3 100644
+--- a/drivers/hwmon/pmbus/pmbus.h
++++ b/drivers/hwmon/pmbus/pmbus.h
+@@ -404,9 +404,9 @@ extern const struct regulator_ops pmbus_regulator_ops;
+ /* Function declarations */
+ 
+ void pmbus_clear_cache(struct i2c_client *client);
+-int pmbus_set_page(struct i2c_client *client, u8 page);
+-int pmbus_read_word_data(struct i2c_client *client, u8 page, u8 reg);
+-int pmbus_write_word_data(struct i2c_client *client, u8 page, u8 reg, u16 word);
++int pmbus_set_page(struct i2c_client *client, int page);
++int pmbus_read_word_data(struct i2c_client *client, int page, u8 reg);
++int pmbus_write_word_data(struct i2c_client *client, int page, u8 reg, u16 word);
+ int pmbus_read_byte_data(struct i2c_client *client, int page, u8 reg);
+ int pmbus_write_byte(struct i2c_client *client, int page, u8 value);
+ int pmbus_write_byte_data(struct i2c_client *client, int page, u8 reg,
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 302f0aef59de..52a58b8b6e1b 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -136,13 +136,13 @@ void pmbus_clear_cache(struct i2c_client *client)
+ }
+ EXPORT_SYMBOL_GPL(pmbus_clear_cache);
+ 
+-int pmbus_set_page(struct i2c_client *client, u8 page)
++int pmbus_set_page(struct i2c_client *client, int page)
+ {
+ 	struct pmbus_data *data = i2c_get_clientdata(client);
+ 	int rv = 0;
+ 	int newpage;
+ 
+-	if (page != data->currpage) {
++	if (page >= 0 && page != data->currpage) {
+ 		rv = i2c_smbus_write_byte_data(client, PMBUS_PAGE, page);
+ 		newpage = i2c_smbus_read_byte_data(client, PMBUS_PAGE);
+ 		if (newpage != page)
+@@ -158,11 +158,9 @@ int pmbus_write_byte(struct i2c_client *client, int page, u8 value)
+ {
+ 	int rv;
+ 
+-	if (page >= 0) {
+-		rv = pmbus_set_page(client, page);
+-		if (rv < 0)
+-			return rv;
+-	}
++	rv = pmbus_set_page(client, page);
++	if (rv < 0)
++		return rv;
+ 
+ 	return i2c_smbus_write_byte(client, value);
+ }
+@@ -186,7 +184,8 @@ static int _pmbus_write_byte(struct i2c_client *client, int page, u8 value)
+ 	return pmbus_write_byte(client, page, value);
+ }
+ 
+-int pmbus_write_word_data(struct i2c_client *client, u8 page, u8 reg, u16 word)
++int pmbus_write_word_data(struct i2c_client *client, int page, u8 reg,
++			  u16 word)
+ {
+ 	int rv;
+ 
+@@ -219,7 +218,7 @@ static int _pmbus_write_word_data(struct i2c_client *client, int page, int reg,
+ 	return pmbus_write_word_data(client, page, reg, word);
+ }
+ 
+-int pmbus_read_word_data(struct i2c_client *client, u8 page, u8 reg)
++int pmbus_read_word_data(struct i2c_client *client, int page, u8 reg)
+ {
+ 	int rv;
+ 
+@@ -255,11 +254,9 @@ int pmbus_read_byte_data(struct i2c_client *client, int page, u8 reg)
+ {
+ 	int rv;
+ 
+-	if (page >= 0) {
+-		rv = pmbus_set_page(client, page);
+-		if (rv < 0)
+-			return rv;
+-	}
++	rv = pmbus_set_page(client, page);
++	if (rv < 0)
++		return rv;
+ 
+ 	return i2c_smbus_read_byte_data(client, reg);
+ }
+diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
+index e0dc20488335..9ac2fb032df6 100644
+--- a/drivers/iio/adc/ti-ads1015.c
++++ b/drivers/iio/adc/ti-ads1015.c
+@@ -369,6 +369,7 @@ int ads1015_get_adc_result(struct ads1015_data *data, int chan, int *val)
+ 
+ 		conv_time = DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr_old]);
+ 		conv_time += DIV_ROUND_UP(USEC_PER_SEC, data->data_rate[dr]);
++		conv_time += conv_time / 10; /* 10% internal clock inaccuracy */
+ 		usleep_range(conv_time, conv_time + 1);
+ 		data->conv_invalid = false;
+ 	}
+diff --git a/drivers/iio/multiplexer/iio-mux.c b/drivers/iio/multiplexer/iio-mux.c
+index 37ba007f8dca..74831fcd0313 100644
+--- a/drivers/iio/multiplexer/iio-mux.c
++++ b/drivers/iio/multiplexer/iio-mux.c
+@@ -285,6 +285,9 @@ static int mux_configure_channel(struct device *dev, struct mux *mux,
+ 	child->ext_info_cache = devm_kzalloc(dev,
+ 					     sizeof(*child->ext_info_cache) *
+ 					     num_ext_info, GFP_KERNEL);
++	if (!child->ext_info_cache)
++		return -ENOMEM;
++
+ 	for (i = 0; i < num_ext_info; ++i) {
+ 		child->ext_info_cache[i].size = -1;
+ 
+@@ -309,6 +312,9 @@ static int mux_configure_channel(struct device *dev, struct mux *mux,
+ 
+ 		child->ext_info_cache[i].data = devm_kmemdup(dev, page, ret + 1,
+ 							     GFP_KERNEL);
++		if (!child->ext_info_cache[i].data)
++			return -ENOMEM;
++
+ 		child->ext_info_cache[i].data[ret] = 0;
+ 		child->ext_info_cache[i].size = ret;
+ 	}
+diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
+index fc73e56eb1e2..92c483ec6cb2 100644
+--- a/drivers/mmc/host/sdhci-msm.c
++++ b/drivers/mmc/host/sdhci-msm.c
+@@ -1251,6 +1251,21 @@ static int sdhci_msm_probe(struct platform_device *pdev)
+ 			       CORE_VENDOR_SPEC_CAPABILITIES0);
+ 	}
+ 
++	/*
++	 * Power on reset state may trigger power irq if previous status of
++	 * PWRCTL was either BUS_ON or IO_HIGH_V. So before enabling pwr irq
++	 * interrupt in GIC, any pending power irq interrupt should be
++	 * acknowledged. Otherwise power irq interrupt handler would be
++	 * fired prematurely.
++	 */
++	sdhci_msm_voltage_switch(host);
++
++	/*
++	 * Ensure that above writes are propogated before interrupt enablement
++	 * in GIC.
++	 */
++	mb();
++
+ 	/* Setup IRQ for handling power/voltage tasks with PMIC */
+ 	msm_host->pwr_irq = platform_get_irq_byname(pdev, "pwr_irq");
+ 	if (msm_host->pwr_irq < 0) {
+@@ -1260,6 +1275,9 @@ static int sdhci_msm_probe(struct platform_device *pdev)
+ 		goto clk_disable;
+ 	}
+ 
++	/* Enable pwr irq interrupts */
++	writel_relaxed(INT_MASK, msm_host->core_mem + CORE_PWRCTL_MASK);
++
+ 	ret = devm_request_threaded_irq(&pdev->dev, msm_host->pwr_irq, NULL,
+ 					sdhci_msm_pwr_irq, IRQF_ONESHOT,
+ 					dev_name(&pdev->dev), host);
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index 9c4e6199b854..3a6d49f07e22 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -1113,8 +1113,11 @@ static int tmio_mmc_init_ocr(struct tmio_mmc_host *host)
+ {
+ 	struct tmio_mmc_data *pdata = host->pdata;
+ 	struct mmc_host *mmc = host->mmc;
++	int err;
+ 
+-	mmc_regulator_get_supply(mmc);
++	err = mmc_regulator_get_supply(mmc);
++	if (err)
++		return err;
+ 
+ 	/* use ocr_mask if no regulator */
+ 	if (!mmc->ocr_avail)
+diff --git a/drivers/pci/dwc/pci-dra7xx.c b/drivers/pci/dwc/pci-dra7xx.c
+index 34427a6a15af..362607f727ee 100644
+--- a/drivers/pci/dwc/pci-dra7xx.c
++++ b/drivers/pci/dwc/pci-dra7xx.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include <linux/delay.h>
++#include <linux/device.h>
+ #include <linux/err.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+@@ -594,6 +595,7 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ 	int i;
+ 	int phy_count;
+ 	struct phy **phy;
++	struct device_link **link;
+ 	void __iomem *base;
+ 	struct resource *res;
+ 	struct dw_pcie *pci;
+@@ -649,11 +651,21 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ 	if (!phy)
+ 		return -ENOMEM;
+ 
++	link = devm_kzalloc(dev, sizeof(*link) * phy_count, GFP_KERNEL);
++	if (!link)
++		return -ENOMEM;
++
+ 	for (i = 0; i < phy_count; i++) {
+ 		snprintf(name, sizeof(name), "pcie-phy%d", i);
+ 		phy[i] = devm_phy_get(dev, name);
+ 		if (IS_ERR(phy[i]))
+ 			return PTR_ERR(phy[i]);
++
++		link[i] = device_link_add(dev, &phy[i]->dev, DL_FLAG_STATELESS);
++		if (!link[i]) {
++			ret = -EINVAL;
++			goto err_link;
++		}
+ 	}
+ 
+ 	dra7xx->base = base;
+@@ -732,6 +744,10 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ 	pm_runtime_disable(dev);
+ 	dra7xx_pcie_disable_phy(dra7xx);
+ 
++err_link:
++	while (--i >= 0)
++		device_link_del(link[i]);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
+index f20b4d66c75f..4a39b54732d0 100644
+--- a/drivers/s390/cio/vfio_ccw_cp.c
++++ b/drivers/s390/cio/vfio_ccw_cp.c
+@@ -330,6 +330,8 @@ static void ccwchain_cda_free(struct ccwchain *chain, int idx)
+ {
+ 	struct ccw1 *ccw = chain->ch_ccw + idx;
+ 
++	if (ccw_is_test(ccw) || ccw_is_noop(ccw) || ccw_is_tic(ccw))
++		return;
+ 	if (!ccw->count)
+ 		return;
+ 
+diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
+index 6ab4c7700228..68cfc351b47f 100644
+--- a/drivers/spi/spi-axi-spi-engine.c
++++ b/drivers/spi/spi-axi-spi-engine.c
+@@ -553,7 +553,7 @@ static int spi_engine_probe(struct platform_device *pdev)
+ 
+ static int spi_engine_remove(struct platform_device *pdev)
+ {
+-	struct spi_master *master = platform_get_drvdata(pdev);
++	struct spi_master *master = spi_master_get(platform_get_drvdata(pdev));
+ 	struct spi_engine *spi_engine = spi_master_get_devdata(master);
+ 	int irq = platform_get_irq(pdev, 0);
+ 
+@@ -561,6 +561,8 @@ static int spi_engine_remove(struct platform_device *pdev)
+ 
+ 	free_irq(irq, master);
+ 
++	spi_master_put(master);
++
+ 	writel_relaxed(0xff, spi_engine->base + SPI_ENGINE_REG_INT_PENDING);
+ 	writel_relaxed(0x00, spi_engine->base + SPI_ENGINE_REG_INT_ENABLE);
+ 	writel_relaxed(0x01, spi_engine->base + SPI_ENGINE_REG_RESET);
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index 0eb1e9583485..837bb95eea62 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -900,7 +900,7 @@ static int sh_msiof_transfer_one(struct spi_master *master,
+ 				break;
+ 			copy32 = copy_bswap32;
+ 		} else if (bits <= 16) {
+-			if (l & 1)
++			if (l & 3)
+ 				break;
+ 			copy32 = copy_wswap32;
+ 		} else {
+diff --git a/drivers/staging/ccree/ssi_hash.c b/drivers/staging/ccree/ssi_hash.c
+index 13291aeaf350..f72ca485c86f 100644
+--- a/drivers/staging/ccree/ssi_hash.c
++++ b/drivers/staging/ccree/ssi_hash.c
+@@ -1790,9 +1790,12 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
+ 	}
+ 	in += sizeof(u32);
+ 
+-	rc = ssi_hash_init(state, ctx);
+-	if (rc)
+-		goto out;
++	/* call init() to allocate bufs if the user hasn't */
++	if (!state->digest_buff) {
++		rc = ssi_hash_init(state, ctx);
++		if (rc)
++			goto out;
++	}
+ 
+ 	dma_sync_single_for_cpu(dev, state->digest_buff_dma_addr,
+ 				ctx->inter_digestsize, DMA_BIDIRECTIONAL);
+diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
+index 26017fe9df93..8e84b2e7f5bd 100644
+--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c
+@@ -131,6 +131,8 @@ static struct sk_buff *build_linear_skb(struct dpaa2_eth_priv *priv,
+ 	u16 fd_offset = dpaa2_fd_get_offset(fd);
+ 	u32 fd_length = dpaa2_fd_get_len(fd);
+ 
++	ch->buf_count--;
++
+ 	skb = build_skb(fd_vaddr, DPAA2_ETH_RX_BUF_SIZE +
+ 			SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
+ 	if (unlikely(!skb))
+@@ -139,8 +141,6 @@ static struct sk_buff *build_linear_skb(struct dpaa2_eth_priv *priv,
+ 	skb_reserve(skb, fd_offset);
+ 	skb_put(skb, fd_length);
+ 
+-	ch->buf_count--;
+-
+ 	return skb;
+ }
+ 
+@@ -178,8 +178,15 @@ static struct sk_buff *build_frag_skb(struct dpaa2_eth_priv *priv,
+ 			/* We build the skb around the first data buffer */
+ 			skb = build_skb(sg_vaddr, DPAA2_ETH_RX_BUF_SIZE +
+ 				SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
+-			if (unlikely(!skb))
+-				return NULL;
++			if (unlikely(!skb)) {
++				/* We still need to subtract the buffers used
++				 * by this FD from our software counter
++				 */
++				while (!dpaa2_sg_is_final(&sgt[i]) &&
++				       i < DPAA2_ETH_MAX_SG_ENTRIES)
++					i++;
++				break;
++			}
+ 
+ 			sg_offset = dpaa2_sg_get_offset(sge);
+ 			skb_reserve(skb, sg_offset);
+diff --git a/drivers/staging/fsl-mc/bus/dpio/dpio-service.c b/drivers/staging/fsl-mc/bus/dpio/dpio-service.c
+index f8096828f5b7..a609ec82daf3 100644
+--- a/drivers/staging/fsl-mc/bus/dpio/dpio-service.c
++++ b/drivers/staging/fsl-mc/bus/dpio/dpio-service.c
+@@ -76,7 +76,7 @@ static inline struct dpaa2_io *service_select_by_cpu(struct dpaa2_io *d,
+ 	if (d)
+ 		return d;
+ 
+-	if (unlikely(cpu >= num_possible_cpus()))
++	if (cpu != DPAA2_IO_ANY_CPU && cpu >= num_possible_cpus())
+ 		return NULL;
+ 
+ 	/*
+@@ -121,7 +121,7 @@ struct dpaa2_io *dpaa2_io_create(const struct dpaa2_io_desc *desc)
+ 		return NULL;
+ 
+ 	/* check if CPU is out of range (-1 means any cpu) */
+-	if (desc->cpu >= num_possible_cpus()) {
++	if (desc->cpu != DPAA2_IO_ANY_CPU && desc->cpu >= num_possible_cpus()) {
+ 		kfree(obj);
+ 		return NULL;
+ 	}
+diff --git a/drivers/staging/fsl-mc/include/dpaa2-io.h b/drivers/staging/fsl-mc/include/dpaa2-io.h
+index c5646096c5d4..afc2d060d077 100644
+--- a/drivers/staging/fsl-mc/include/dpaa2-io.h
++++ b/drivers/staging/fsl-mc/include/dpaa2-io.h
+@@ -54,6 +54,8 @@ struct device;
+  * for dequeue.
+  */
+ 
++#define DPAA2_IO_ANY_CPU	-1
++
+ /**
+  * struct dpaa2_io_desc - The DPIO descriptor
+  * @receives_notifications: Use notificaton mode. Non-zero if the DPIO
+@@ -91,8 +93,8 @@ irqreturn_t dpaa2_io_irq(struct dpaa2_io *obj);
+  * @cb:           The callback to be invoked when the notification arrives
+  * @is_cdan:      Zero for FQDAN, non-zero for CDAN
+  * @id:           FQID or channel ID, needed for rearm
+- * @desired_cpu:  The cpu on which the notifications will show up. -1 means
+- *                any CPU.
++ * @desired_cpu:  The cpu on which the notifications will show up. Use
++ *                DPAA2_IO_ANY_CPU if don't care
+  * @dpio_id:      The dpio index
+  * @qman64:       The 64-bit context value shows up in the FQDAN/CDAN.
+  * @node:         The list node
+diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c
+index 08e255884206..93e86798ec1c 100644
+--- a/drivers/staging/greybus/loopback.c
++++ b/drivers/staging/greybus/loopback.c
+@@ -1042,8 +1042,10 @@ static int gb_loopback_fn(void *data)
+ 			else if (type == GB_LOOPBACK_TYPE_SINK)
+ 				error = gb_loopback_async_sink(gb, size);
+ 
+-			if (error)
++			if (error) {
+ 				gb->error++;
++				gb->iteration_count++;
++			}
+ 		} else {
+ 			/* We are effectively single threaded here */
+ 			if (type == GB_LOOPBACK_TYPE_PING)
+diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme.c b/drivers/staging/rtl8188eu/core/rtw_mlme.c
+index f663e6c41f8a..f6d71587b803 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
++++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
+@@ -106,10 +106,10 @@ void rtw_free_mlme_priv_ie_data(struct mlme_priv *pmlmepriv)
+ 
+ void rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
+ {
+-	rtw_free_mlme_priv_ie_data(pmlmepriv);
+-
+-	if (pmlmepriv)
++	if (pmlmepriv) {
++		rtw_free_mlme_priv_ie_data(pmlmepriv);
+ 		vfree(pmlmepriv->free_bss_buf);
++	}
+ }
+ 
+ struct wlan_network *_rtw_alloc_network(struct mlme_priv *pmlmepriv)
+diff --git a/drivers/staging/rtlwifi/phydm/phydm_dig.c b/drivers/staging/rtlwifi/phydm/phydm_dig.c
+index 31a4f3fcad19..c88b9788363a 100644
+--- a/drivers/staging/rtlwifi/phydm/phydm_dig.c
++++ b/drivers/staging/rtlwifi/phydm/phydm_dig.c
+@@ -490,6 +490,8 @@ void odm_pause_dig(void *dm_void, enum phydm_pause_type pause_type,
+ 				break;
+ 		}
+ 
++		/* pin max_level to be >= 0 */
++		max_level = max_t(s8, 0, max_level);
+ 		/* write IGI of lower level */
+ 		odm_write_dig(dm, dig_tab->pause_dig_value[max_level]);
+ 		ODM_RT_TRACE(dm, ODM_COMP_DIG,
+diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c
+index 8e24da16752c..a2cc54866e79 100644
+--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
+@@ -419,7 +419,7 @@ static bool _rtl8822be_send_bcn_or_cmd_packet(struct ieee80211_hw *hw,
+ 		dma_addr = rtlpriv->cfg->ops->get_desc(
+ 				hw, (u8 *)pbd_desc, true, HW_DESC_TXBUFF_ADDR);
+ 
+-		pci_unmap_single(rtlpci->pdev, dma_addr, skb->len,
++		pci_unmap_single(rtlpci->pdev, dma_addr, pskb->len,
+ 				 PCI_DMA_TODEVICE);
+ 		kfree_skb(pskb);
+ 
+diff --git a/drivers/tty/serial/8250/8250_early.c b/drivers/tty/serial/8250/8250_early.c
+index af72ec32e404..f135c1846477 100644
+--- a/drivers/tty/serial/8250/8250_early.c
++++ b/drivers/tty/serial/8250/8250_early.c
+@@ -125,12 +125,14 @@ static void __init init_port(struct earlycon_device *device)
+ 	serial8250_early_out(port, UART_FCR, 0);	/* no fifo */
+ 	serial8250_early_out(port, UART_MCR, 0x3);	/* DTR + RTS */
+ 
+-	divisor = DIV_ROUND_CLOSEST(port->uartclk, 16 * device->baud);
+-	c = serial8250_early_in(port, UART_LCR);
+-	serial8250_early_out(port, UART_LCR, c | UART_LCR_DLAB);
+-	serial8250_early_out(port, UART_DLL, divisor & 0xff);
+-	serial8250_early_out(port, UART_DLM, (divisor >> 8) & 0xff);
+-	serial8250_early_out(port, UART_LCR, c & ~UART_LCR_DLAB);
++	if (port->uartclk && device->baud) {
++		divisor = DIV_ROUND_CLOSEST(port->uartclk, 16 * device->baud);
++		c = serial8250_early_in(port, UART_LCR);
++		serial8250_early_out(port, UART_LCR, c | UART_LCR_DLAB);
++		serial8250_early_out(port, UART_DLL, divisor & 0xff);
++		serial8250_early_out(port, UART_DLM, (divisor >> 8) & 0xff);
++		serial8250_early_out(port, UART_LCR, c & ~UART_LCR_DLAB);
++	}
+ }
+ 
+ int __init early_serial8250_setup(struct earlycon_device *device,
+diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
+index 4bd376c08b59..ba4af5434b91 100644
+--- a/drivers/tty/serial/8250/8250_fintek.c
++++ b/drivers/tty/serial/8250/8250_fintek.c
+@@ -211,7 +211,7 @@ static int fintek_8250_rs485_config(struct uart_port *port,
+ 
+ 	if ((!!(rs485->flags & SER_RS485_RTS_ON_SEND)) ==
+ 			(!!(rs485->flags & SER_RS485_RTS_AFTER_SEND)))
+-		rs485->flags &= SER_RS485_ENABLED;
++		rs485->flags &= ~SER_RS485_ENABLED;
+ 	else
+ 		config |= RS485_URA;
+ 
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 0c101a7470b0..d4e7be88e0da 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -5137,6 +5137,9 @@ static const struct pci_device_id serial_pci_tbl[] = {
+ 	{ PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 },
+ 	{ PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 },
+ 
++	/* Amazon PCI serial device */
++	{ PCI_DEVICE(0x1d0f, 0x8250), .driver_data = pbn_b0_1_115200 },
++
+ 	/*
+ 	 * These entries match devices with class COMMUNICATION_SERIAL,
+ 	 * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index f0cc04f62b67..8dcfd4978a03 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2586,8 +2586,11 @@ static void serial8250_set_divisor(struct uart_port *port, unsigned int baud,
+ 	serial_dl_write(up, quot);
+ 
+ 	/* XR17V35x UARTs have an extra fractional divisor register (DLD) */
+-	if (up->port.type == PORT_XR17V35X)
++	if (up->port.type == PORT_XR17V35X) {
++		/* Preserve bits not related to baudrate; DLD[7:4]. */
++		quot_frac |= serial_port_in(port, 0x2) & 0xf0;
+ 		serial_port_out(port, 0x2, quot_frac);
++	}
+ }
+ 
+ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index dfeff3951f93..3657d745e90f 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -334,7 +334,8 @@ static void imx_port_rts_active(struct imx_port *sport, unsigned long *ucr2)
+ {
+ 	*ucr2 &= ~(UCR2_CTSC | UCR2_CTS);
+ 
+-	mctrl_gpio_set(sport->gpios, sport->port.mctrl | TIOCM_RTS);
++	sport->port.mctrl |= TIOCM_RTS;
++	mctrl_gpio_set(sport->gpios, sport->port.mctrl);
+ }
+ 
+ static void imx_port_rts_inactive(struct imx_port *sport, unsigned long *ucr2)
+@@ -342,7 +343,8 @@ static void imx_port_rts_inactive(struct imx_port *sport, unsigned long *ucr2)
+ 	*ucr2 &= ~UCR2_CTSC;
+ 	*ucr2 |= UCR2_CTS;
+ 
+-	mctrl_gpio_set(sport->gpios, sport->port.mctrl & ~TIOCM_RTS);
++	sport->port.mctrl &= ~TIOCM_RTS;
++	mctrl_gpio_set(sport->gpios, sport->port.mctrl);
+ }
+ 
+ static void imx_port_rts_auto(struct imx_port *sport, unsigned long *ucr2)
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 784dd42002ea..761b9f5f1491 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1491,6 +1491,14 @@ static void sci_request_dma(struct uart_port *port)
+ 		return;
+ 
+ 	s->cookie_tx = -EINVAL;
++
++	/*
++	 * Don't request a dma channel if no channel was specified
++	 * in the device tree.
++	 */
++	if (!of_find_property(port->dev->of_node, "dmas", NULL))
++		return;
++
+ 	chan = sci_request_dma_chan(port, DMA_MEM_TO_DEV);
+ 	dev_dbg(port->dev, "%s: TX: got channel %p\n", __func__, chan);
+ 	if (chan) {
+diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
+index d008f5a75197..377b3592384e 100644
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -246,8 +246,10 @@ static void sysrq_handle_showallcpus(int key)
+ 	 * architecture has no support for it:
+ 	 */
+ 	if (!trigger_all_cpu_backtrace()) {
+-		struct pt_regs *regs = get_irq_regs();
++		struct pt_regs *regs = NULL;
+ 
++		if (in_irq())
++			regs = get_irq_regs();
+ 		if (regs) {
+ 			pr_info("CPU%d:\n", smp_processor_id());
+ 			show_regs(regs);
+@@ -266,7 +268,10 @@ static struct sysrq_key_op sysrq_showallcpus_op = {
+ 
+ static void sysrq_handle_showregs(int key)
+ {
+-	struct pt_regs *regs = get_irq_regs();
++	struct pt_regs *regs = NULL;
++
++	if (in_irq())
++		regs = get_irq_regs();
+ 	if (regs)
+ 		show_regs(regs);
+ 	perf_event_print_debug();
+diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c
+index 4aa5195db8ea..e02acfb1ca95 100644
+--- a/drivers/usb/common/ulpi.c
++++ b/drivers/usb/common/ulpi.c
+@@ -183,9 +183,9 @@ static int ulpi_of_register(struct ulpi *ulpi)
+ 	/* Find a ulpi bus underneath the parent or the grandparent */
+ 	parent = ulpi->dev.parent;
+ 	if (parent->of_node)
+-		np = of_find_node_by_name(parent->of_node, "ulpi");
++		np = of_get_child_by_name(parent->of_node, "ulpi");
+ 	else if (parent->parent && parent->parent->of_node)
+-		np = of_find_node_by_name(parent->parent->of_node, "ulpi");
++		np = of_get_child_by_name(parent->parent->of_node, "ulpi");
+ 	if (!np)
+ 		return 0;
+ 
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 883549ee946c..c42a3e63eb07 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -905,14 +905,25 @@ void usb_release_bos_descriptor(struct usb_device *dev)
+ 	}
+ }
+ 
++static const __u8 bos_desc_len[256] = {
++	[USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE,
++	[USB_CAP_TYPE_EXT]          = USB_DT_USB_EXT_CAP_SIZE,
++	[USB_SS_CAP_TYPE]           = USB_DT_USB_SS_CAP_SIZE,
++	[USB_SSP_CAP_TYPE]          = USB_DT_USB_SSP_CAP_SIZE(1),
++	[CONTAINER_ID_TYPE]         = USB_DT_USB_SS_CONTN_ID_SIZE,
++	[USB_PTM_CAP_TYPE]          = USB_DT_USB_PTM_ID_SIZE,
++};
++
+ /* Get BOS descriptor set */
+ int usb_get_bos_descriptor(struct usb_device *dev)
+ {
+ 	struct device *ddev = &dev->dev;
+ 	struct usb_bos_descriptor *bos;
+ 	struct usb_dev_cap_header *cap;
++	struct usb_ssp_cap_descriptor *ssp_cap;
+ 	unsigned char *buffer;
+-	int length, total_len, num, i;
++	int length, total_len, num, i, ssac;
++	__u8 cap_type;
+ 	int ret;
+ 
+ 	bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL);
+@@ -965,7 +976,13 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ 			dev->bos->desc->bNumDeviceCaps = i;
+ 			break;
+ 		}
++		cap_type = cap->bDevCapabilityType;
+ 		length = cap->bLength;
++		if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) {
++			dev->bos->desc->bNumDeviceCaps = i;
++			break;
++		}
++
+ 		total_len -= length;
+ 
+ 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
+@@ -973,7 +990,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ 			continue;
+ 		}
+ 
+-		switch (cap->bDevCapabilityType) {
++		switch (cap_type) {
+ 		case USB_CAP_TYPE_WIRELESS_USB:
+ 			/* Wireless USB cap descriptor is handled by wusb */
+ 			break;
+@@ -986,8 +1003,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
+ 				(struct usb_ss_cap_descriptor *)buffer;
+ 			break;
+ 		case USB_SSP_CAP_TYPE:
+-			dev->bos->ssp_cap =
+-				(struct usb_ssp_cap_descriptor *)buffer;
++			ssp_cap = (struct usb_ssp_cap_descriptor *)buffer;
++			ssac = (le32_to_cpu(ssp_cap->bmAttributes) &
++				USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1;
++			if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac))
++				dev->bos->ssp_cap = ssp_cap;
+ 			break;
+ 		case CONTAINER_ID_TYPE:
+ 			dev->bos->ss_id =
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 98c666ef9a57..ab245352f102 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1455,14 +1455,18 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 	int number_of_packets = 0;
+ 	unsigned int stream_id = 0;
+ 	void *buf;
+-
+-	if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
+-				USBDEVFS_URB_SHORT_NOT_OK |
++	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
+ 				USBDEVFS_URB_BULK_CONTINUATION |
+ 				USBDEVFS_URB_NO_FSBR |
+ 				USBDEVFS_URB_ZERO_PACKET |
+-				USBDEVFS_URB_NO_INTERRUPT))
+-		return -EINVAL;
++				USBDEVFS_URB_NO_INTERRUPT;
++	/* USBDEVFS_URB_ISO_ASAP is a special case */
++	if (uurb->type == USBDEVFS_URB_TYPE_ISO)
++		mask |= USBDEVFS_URB_ISO_ASAP;
++
++	if (uurb->flags & ~mask)
++			return -EINVAL;
++
+ 	if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
+ 		return -EINVAL;
+ 	if (uurb->buffer_length > 0 && !uurb->buffer)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index e9ce6bb0b22d..8f7d94239ee3 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4935,6 +4935,15 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
+ 		usb_put_dev(udev);
+ 		if ((status == -ENOTCONN) || (status == -ENOTSUPP))
+ 			break;
++
++		/* When halfway through our retry count, power-cycle the port */
++		if (i == (SET_CONFIG_TRIES / 2) - 1) {
++			dev_info(&port_dev->dev, "attempt power cycle\n");
++			usb_hub_set_port_power(hdev, hub, port1, false);
++			msleep(2 * hub_power_on_good_delay(hub));
++			usb_hub_set_port_power(hdev, hub, port1, true);
++			msleep(hub_power_on_good_delay(hub));
++		}
+ 	}
+ 	if (hub->hdev->parent ||
+ 			!hcd->driver->port_handed_over ||
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 37c418e581fb..50010282c010 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -151,6 +151,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* appletouch */
+ 	{ USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */
++	{ USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */
+ 	{ USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM },
+ 
+diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
+index cbb9b8e12c3c..8c5a6fee4dfd 100644
+--- a/drivers/usb/host/ehci-dbg.c
++++ b/drivers/usb/host/ehci-dbg.c
+@@ -837,7 +837,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf)
+ 			default:		/* unknown */
+ 				break;
+ 			}
+-			temp = (cap >> 8) & 0xff;
++			offset = (cap >> 8) & 0xff;
+ 		}
+ 	}
+ #endif
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 2a82c927ded2..97f30eb7dac0 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -947,6 +947,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
+ 	if (!vdev)
+ 		return;
+ 
++	if (vdev->real_port == 0 ||
++			vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) {
++		xhci_dbg(xhci, "Bad vdev->real_port.\n");
++		goto out;
++	}
++
+ 	tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
+ 	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
+ 		/* is this a hub device that added a tt_info to the tts list */
+@@ -960,6 +966,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
+ 			}
+ 		}
+ 	}
++out:
+ 	/* we are now at a leaf device */
+ 	xhci_free_virt_device(xhci, slot_id);
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 82c746e2d85c..353520005c13 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2486,12 +2486,16 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 		 */
+ 		if (list_empty(&ep_ring->td_list)) {
+ 			/*
+-			 * A stopped endpoint may generate an extra completion
+-			 * event if the device was suspended.  Don't print
+-			 * warnings.
++			 * Don't print wanings if it's due to a stopped endpoint
++			 * generating an extra completion event if the device
++			 * was suspended. Or, a event for the last TRB of a
++			 * short TD we already got a short event for.
++			 * The short TD is already removed from the TD list.
+ 			 */
++
+ 			if (!(trb_comp_code == COMP_STOPPED ||
+-				trb_comp_code == COMP_STOPPED_LENGTH_INVALID)) {
++			      trb_comp_code == COMP_STOPPED_LENGTH_INVALID ||
++			      ep_ring->last_td_was_short)) {
+ 				xhci_warn(xhci, "WARN Event TRB for slot %d ep %d with no TDs queued?\n",
+ 						TRB_TO_SLOT_ID(le32_to_cpu(event->flags)),
+ 						ep_index);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 51535ba2bcd4..e5677700dea4 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3583,10 +3583,9 @@ int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command,
+ 	state = readl(&xhci->op_regs->status);
+ 	if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+ 			(xhci->xhc_state & XHCI_STATE_HALTED)) {
+-		xhci_free_virt_device(xhci, slot_id);
+ 		spin_unlock_irqrestore(&xhci->lock, flags);
+ 		kfree(command);
+-		return ret;
++		return -ENODEV;
+ 	}
+ 
+ 	ret = xhci_queue_slot_control(xhci, command, TRB_DISABLE_SLOT,
+diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c
+index 99c65b0788ff..947579842ad7 100644
+--- a/drivers/usb/mtu3/mtu3_core.c
++++ b/drivers/usb/mtu3/mtu3_core.c
+@@ -774,9 +774,9 @@ int ssusb_gadget_init(struct ssusb_mtk *ssusb)
+ 		return -ENOMEM;
+ 
+ 	mtu->irq = platform_get_irq(pdev, 0);
+-	if (mtu->irq <= 0) {
++	if (mtu->irq < 0) {
+ 		dev_err(dev, "fail to get irq number\n");
+-		return -ENODEV;
++		return mtu->irq;
+ 	}
+ 	dev_info(dev, "irq %d\n", mtu->irq);
+ 
+diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
+index 8babd318c0ed..1ec00eae339a 100644
+--- a/drivers/usb/phy/phy-tahvo.c
++++ b/drivers/usb/phy/phy-tahvo.c
+@@ -368,7 +368,8 @@ static int tahvo_usb_probe(struct platform_device *pdev)
+ 	tu->extcon = devm_extcon_dev_allocate(&pdev->dev, tahvo_cable);
+ 	if (IS_ERR(tu->extcon)) {
+ 		dev_err(&pdev->dev, "failed to allocate memory for extcon\n");
+-		return -ENOMEM;
++		ret = PTR_ERR(tu->extcon);
++		goto err_disable_clk;
+ 	}
+ 
+ 	ret = devm_extcon_dev_register(&pdev->dev, tu->extcon);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index ba672cf4e888..54e316b1892d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb);
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21			0x0121
+ #define QUECTEL_PRODUCT_EC25			0x0125
++#define QUECTEL_PRODUCT_BG96			0x0296
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+ #define CMOTECH_PRODUCT_6001			0x6001
+@@ -1185,6 +1186,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
+diff --git a/drivers/usb/serial/usb_debug.c b/drivers/usb/serial/usb_debug.c
+index 48f285a1ad00..c593ca8800e5 100644
+--- a/drivers/usb/serial/usb_debug.c
++++ b/drivers/usb/serial/usb_debug.c
+@@ -34,12 +34,14 @@ static const struct usb_device_id id_table[] = {
+ };
+ 
+ static const struct usb_device_id dbc_id_table[] = {
++	{ USB_DEVICE(0x1d6b, 0x0010) },
+ 	{ USB_DEVICE(0x1d6b, 0x0011) },
+ 	{ },
+ };
+ 
+ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(0x0525, 0x127a) },
++	{ USB_DEVICE(0x1d6b, 0x0010) },
+ 	{ USB_DEVICE(0x1d6b, 0x0011) },
+ 	{ },
+ };
+diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h
+index 1fcd758a961f..3734a25e09e5 100644
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -112,6 +112,10 @@ static int uas_use_uas_driver(struct usb_interface *intf,
+ 		}
+ 	}
+ 
++	/* All Seagate disk enclosures have broken ATA pass-through support */
++	if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2)
++		flags |= US_FL_NO_ATA_1X;
++
+ 	usb_stor_adjust_quirks(udev, &flags);
+ 
+ 	if (flags & US_FL_IGNORE_UAS) {
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 11b9a22799cc..1f0cf81cc145 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -1112,7 +1112,6 @@ static int hcd_name_to_id(const char *name)
+ static int vhci_setup(struct usb_hcd *hcd)
+ {
+ 	struct vhci *vhci = *((void **)dev_get_platdata(hcd->self.controller));
+-	hcd->self.sg_tablesize = ~0;
+ 	if (usb_hcd_is_primary_hcd(hcd)) {
+ 		vhci->vhci_hcd_hs = hcd_to_vhci_hcd(hcd);
+ 		vhci->vhci_hcd_hs->vhci = vhci;
+diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
+index 8acfc1e099e1..e549bff87c5b 100644
+--- a/include/asm-generic/vmlinux.lds.h
++++ b/include/asm-generic/vmlinux.lds.h
+@@ -459,6 +459,7 @@
+ #define TEXT_TEXT							\
+ 		ALIGN_FUNCTION();					\
+ 		*(.text.hot TEXT_MAIN .text.fixup .text.unlikely)	\
++		*(.text..refcount)					\
+ 		*(.ref.text)						\
+ 	MEM_KEEP(init.text)						\
+ 	MEM_KEEP(exit.text)						\
+diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h
+index cec06625f407..8512777889b0 100644
+--- a/include/uapi/linux/usb/ch9.h
++++ b/include/uapi/linux/usb/ch9.h
+@@ -876,6 +876,8 @@ struct usb_wireless_cap_descriptor {	/* Ultra Wide Band */
+ 	__u8  bReserved;
+ } __attribute__((packed));
+ 
++#define USB_DT_USB_WIRELESS_CAP_SIZE	11
++
+ /* USB 2.0 Extension descriptor */
+ #define	USB_CAP_TYPE_EXT		2
+ 
+@@ -1068,6 +1070,7 @@ struct usb_ptm_cap_descriptor {
+ 	__u8  bDevCapabilityType;
+ } __attribute__((packed));
+ 
++#define USB_DT_USB_PTM_ID_SIZE		3
+ /*
+  * The size of the descriptor for the Sublink Speed Attribute Count
+  * (SSAC) specified in bmAttributes[4:0].
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 10cdb9c26b5d..4f1d4bfc607a 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4433,6 +4433,8 @@ static int __perf_read_group_add(struct perf_event *leader,
+ 	if (ret)
+ 		return ret;
+ 
++	raw_spin_lock_irqsave(&ctx->lock, flags);
++
+ 	/*
+ 	 * Since we co-schedule groups, {enabled,running} times of siblings
+ 	 * will be identical to those of the leader, so we only publish one
+@@ -4455,8 +4457,6 @@ static int __perf_read_group_add(struct perf_event *leader,
+ 	if (read_format & PERF_FORMAT_ID)
+ 		values[n++] = primary_event_id(leader);
+ 
+-	raw_spin_lock_irqsave(&ctx->lock, flags);
+-
+ 	list_for_each_entry(sub, &leader->sibling_list, group_entry) {
+ 		values[n++] += perf_event_count(sub);
+ 		if (read_format & PERF_FORMAT_ID)
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index a1606a4224e1..a66e838640ea 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -573,13 +573,15 @@ static void kprobe_optimizer(struct work_struct *work)
+ 	do_unoptimize_kprobes();
+ 
+ 	/*
+-	 * Step 2: Wait for quiesence period to ensure all running interrupts
+-	 * are done. Because optprobe may modify multiple instructions
+-	 * there is a chance that Nth instruction is interrupted. In that
+-	 * case, running interrupt can return to 2nd-Nth byte of jump
+-	 * instruction. This wait is for avoiding it.
++	 * Step 2: Wait for quiesence period to ensure all potentially
++	 * preempted tasks to have normally scheduled. Because optprobe
++	 * may modify multiple instructions, there is a chance that Nth
++	 * instruction is preempted. In that case, such tasks can return
++	 * to 2nd-Nth byte of jump instruction. This wait is for avoiding it.
++	 * Note that on non-preemptive kernel, this is transparently converted
++	 * to synchronoze_sched() to wait for all interrupts to have completed.
+ 	 */
+-	synchronize_sched();
++	synchronize_rcu_tasks();
+ 
+ 	/* Step 3: Optimize kprobes after quiesence period */
+ 	do_optimize_kprobes();
+diff --git a/mm/gup.c b/mm/gup.c
+index 165ba2174c75..e0d82b6706d7 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -1707,6 +1707,47 @@ static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end,
+ 	return 1;
+ }
+ 
++static void gup_pgd_range(unsigned long addr, unsigned long end,
++		int write, struct page **pages, int *nr)
++{
++	unsigned long next;
++	pgd_t *pgdp;
++
++	pgdp = pgd_offset(current->mm, addr);
++	do {
++		pgd_t pgd = READ_ONCE(*pgdp);
++
++		next = pgd_addr_end(addr, end);
++		if (pgd_none(pgd))
++			return;
++		if (unlikely(pgd_huge(pgd))) {
++			if (!gup_huge_pgd(pgd, pgdp, addr, next, write,
++					  pages, nr))
++				return;
++		} else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) {
++			if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
++					 PGDIR_SHIFT, next, write, pages, nr))
++				return;
++		} else if (!gup_p4d_range(pgd, addr, next, write, pages, nr))
++			return;
++	} while (pgdp++, addr = next, addr != end);
++}
++
++#ifndef gup_fast_permitted
++/*
++ * Check if it's allowed to use __get_user_pages_fast() for the range, or
++ * we need to fall back to the slow version:
++ */
++bool gup_fast_permitted(unsigned long start, int nr_pages, int write)
++{
++	unsigned long len, end;
++
++	len = (unsigned long) nr_pages << PAGE_SHIFT;
++	end = start + len;
++	return end >= start;
++}
++#endif
++
+ /*
+  * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to
+  * the regular GUP. It will only return non-negative values.
+@@ -1714,10 +1755,8 @@ static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end,
+ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 			  struct page **pages)
+ {
+-	struct mm_struct *mm = current->mm;
+ 	unsigned long addr, len, end;
+-	unsigned long next, flags;
+-	pgd_t *pgdp;
++	unsigned long flags;
+ 	int nr = 0;
+ 
+ 	start &= PAGE_MASK;
+@@ -1741,45 +1780,15 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 	 * block IPIs that come from THPs splitting.
+ 	 */
+ 
+-	local_irq_save(flags);
+-	pgdp = pgd_offset(mm, addr);
+-	do {
+-		pgd_t pgd = READ_ONCE(*pgdp);
+-
+-		next = pgd_addr_end(addr, end);
+-		if (pgd_none(pgd))
+-			break;
+-		if (unlikely(pgd_huge(pgd))) {
+-			if (!gup_huge_pgd(pgd, pgdp, addr, next, write,
+-					  pages, &nr))
+-				break;
+-		} else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) {
+-			if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
+-					 PGDIR_SHIFT, next, write, pages, &nr))
+-				break;
+-		} else if (!gup_p4d_range(pgd, addr, next, write, pages, &nr))
+-			break;
+-	} while (pgdp++, addr = next, addr != end);
+-	local_irq_restore(flags);
++	if (gup_fast_permitted(start, nr_pages, write)) {
++		local_irq_save(flags);
++		gup_pgd_range(addr, end, write, pages, &nr);
++		local_irq_restore(flags);
++	}
+ 
+ 	return nr;
+ }
+ 
+-#ifndef gup_fast_permitted
+-/*
+- * Check if it's allowed to use __get_user_pages_fast() for the range, or
+- * we need to fall back to the slow version:
+- */
+-bool gup_fast_permitted(unsigned long start, int nr_pages, int write)
+-{
+-	unsigned long len, end;
+-
+-	len = (unsigned long) nr_pages << PAGE_SHIFT;
+-	end = start + len;
+-	return end >= start;
+-}
+-#endif
+-
+ /**
+  * get_user_pages_fast() - pin user pages in memory
+  * @start:	starting user address
+@@ -1799,12 +1808,22 @@ bool gup_fast_permitted(unsigned long start, int nr_pages, int write)
+ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
+ 			struct page **pages)
+ {
++	unsigned long addr, len, end;
+ 	int nr = 0, ret = 0;
+ 
+ 	start &= PAGE_MASK;
++	addr = start;
++	len = (unsigned long) nr_pages << PAGE_SHIFT;
++	end = start + len;
++
++	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
++					(void __user *)start, len)))
++		return 0;
+ 
+ 	if (gup_fast_permitted(start, nr_pages, write)) {
+-		nr = __get_user_pages_fast(start, nr_pages, write, pages);
++		local_irq_disable();
++		gup_pgd_range(addr, end, write, pages, &nr);
++		local_irq_enable();
+ 		ret = nr;
+ 	}
+ 
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index 2aebb7984437..ab70a395f490 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -51,6 +51,8 @@ static int __init hash_setup(char *str)
+ 			ima_hash_algo = HASH_ALGO_SHA1;
+ 		else if (strncmp(str, "md5", 3) == 0)
+ 			ima_hash_algo = HASH_ALGO_MD5;
++		else
++			return 1;
+ 		goto out;
+ 	}
+ 
+@@ -60,6 +62,8 @@ static int __init hash_setup(char *str)
+ 			break;
+ 		}
+ 	}
++	if (i == HASH_ALGO__LAST)
++		return 1;
+ out:
+ 	hash_setup_done = 1;
+ 	return 1;
+diff --git a/tools/include/linux/poison.h b/tools/include/linux/poison.h
+index 4bf6777a8a03..9fdcd3eaac3b 100644
+--- a/tools/include/linux/poison.h
++++ b/tools/include/linux/poison.h
+@@ -15,6 +15,10 @@
+ # define POISON_POINTER_DELTA 0
+ #endif
+ 
++#ifdef __cplusplus
++#define LIST_POISON1  NULL
++#define LIST_POISON2  NULL
++#else
+ /*
+  * These are non-NULL pointers that will result in page faults
+  * under normal circumstances, used to verify that nobody uses
+@@ -22,6 +26,7 @@
+  */
+ #define LIST_POISON1  ((void *) 0x100 + POISON_POINTER_DELTA)
+ #define LIST_POISON2  ((void *) 0x200 + POISON_POINTER_DELTA)
++#endif
+ 
+ /********** include/linux/timer.h **********/
+ /*
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index fd32ad08c6d4..d00aac51130d 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -2733,6 +2733,7 @@ static int perf_c2c__record(int argc, const char **argv)
+ 		if (!perf_mem_events[j].supported) {
+ 			pr_err("failed: event '%s' not supported\n",
+ 			       perf_mem_events[j].name);
++			free(rec_argv);
+ 			return -1;
+ 		}
+ 
+diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
+index 4db960085273..e15efba605f6 100644
+--- a/tools/perf/builtin-mem.c
++++ b/tools/perf/builtin-mem.c
+@@ -113,6 +113,7 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
+ 		if (!perf_mem_events[j].supported) {
+ 			pr_err("failed: event '%s' not supported\n",
+ 			       perf_mem_events__name(j));
++			free(rec_argv);
+ 			return -1;
+ 		}
+ 
+diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
+index 4e2e61695986..01de01ca14f2 100644
+--- a/tools/perf/builtin-timechart.c
++++ b/tools/perf/builtin-timechart.c
+@@ -1732,8 +1732,10 @@ static int timechart__io_record(int argc, const char **argv)
+ 	if (rec_argv == NULL)
+ 		return -ENOMEM;
+ 
+-	if (asprintf(&filter, "common_pid != %d", getpid()) < 0)
++	if (asprintf(&filter, "common_pid != %d", getpid()) < 0) {
++		free(rec_argv);
+ 		return -ENOMEM;
++	}
+ 
+ 	p = rec_argv;
+ 	for (i = 0; i < common_args_nr; i++)
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index d5d7fff1c211..8e3c4ec00017 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -2086,6 +2086,7 @@ static int trace__record(struct trace *trace, int argc, const char **argv)
+ 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
+ 		else {
+ 			pr_err("Neither raw_syscalls nor syscalls events exist.\n");
++			free(rec_argv);
+ 			return -1;
+ 		}
+ 	}
+diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c
+index c180bbcdbef6..0e1367f90af5 100644
+--- a/tools/perf/tests/attr.c
++++ b/tools/perf/tests/attr.c
+@@ -167,7 +167,7 @@ static int run_dir(const char *d, const char *perf)
+ 	snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s",
+ 		 d, d, perf, vcnt, v);
+ 
+-	return system(cmd);
++	return system(cmd) ? TEST_FAIL : TEST_OK;
+ }
+ 
+ int test__attr(struct test *test __maybe_unused, int subtest __maybe_unused)
+diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py
+index 907b1b2f56ad..ff9b60b99f52 100644
+--- a/tools/perf/tests/attr.py
++++ b/tools/perf/tests/attr.py
+@@ -238,6 +238,7 @@ class Test(object):
+         # events in result. Fail if there's not any.
+         for exp_name, exp_event in expect.items():
+             exp_list = []
++            res_event = {}
+             log.debug("    matching [%s]" % exp_name)
+             for res_name, res_event in result.items():
+                 log.debug("      to [%s]" % res_name)
+@@ -254,7 +255,10 @@ class Test(object):
+                 if exp_event.optional():
+                     log.debug("    %s does not match, but is optional" % exp_name)
+                 else:
+-                    exp_event.diff(res_event)
++                    if not res_event:
++                        log.debug("    res_event is empty");
++                    else:
++                        exp_event.diff(res_event)
+                     raise Fail(self, 'match failure');
+ 
+             match[exp_name] = exp_list
+diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
+index 961e3ee26c27..2afc41a3730f 100644
+--- a/tools/testing/selftests/x86/ldt_gdt.c
++++ b/tools/testing/selftests/x86/ldt_gdt.c
+@@ -115,7 +115,15 @@ static void check_valid_segment(uint16_t index, int ldt,
+ 		return;
+ 	}
+ 
+-	if (ar != expected_ar) {
++	/* The SDM says "bits 19:16 are undefined".  Thanks. */
++	ar &= ~0xF0000;
++
++	/*
++	 * NB: Different Linux versions do different things with the
++	 * accessed bit in set_thread_area().
++	 */
++	if (ar != expected_ar &&
++	    (ldt || ar != (expected_ar | AR_ACCESSED))) {
+ 		printf("[FAIL]\t%s entry %hu has AR 0x%08X but expected 0x%08X\n",
+ 		       (ldt ? "LDT" : "GDT"), index, ar, expected_ar);
+ 		nerrs++;
+@@ -367,9 +375,24 @@ static void do_simple_tests(void)
+ 	install_invalid(&desc, false);
+ 
+ 	desc.seg_not_present = 0;
+-	desc.read_exec_only = 0;
+ 	desc.seg_32bit = 1;
++	desc.read_exec_only = 0;
++	desc.limit = 0xfffff;
++
+ 	install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB);
++
++	desc.limit_in_pages = 1;
++
++	install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB | AR_G);
++	desc.read_exec_only = 1;
++	install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P | AR_DB | AR_G);
++	desc.contents = 1;
++	desc.read_exec_only = 0;
++	install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G);
++	desc.read_exec_only = 1;
++	install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G);
++
++	desc.limit = 0;
+ 	install_invalid(&desc, true);
+ }
+ 
+diff --git a/tools/usb/usbip/Makefile.am b/tools/usb/usbip/Makefile.am
+index da3a430849a8..5961e9c18812 100644
+--- a/tools/usb/usbip/Makefile.am
++++ b/tools/usb/usbip/Makefile.am
+@@ -2,6 +2,7 @@
+ SUBDIRS := libsrc src
+ includedir = @includedir@/usbip
+ include_HEADERS := $(addprefix libsrc/, \
+-		     usbip_common.h vhci_driver.h usbip_host_driver.h)
++		     usbip_common.h vhci_driver.h usbip_host_driver.h \
++		     list.h sysfs_utils.h usbip_host_common.h)
+ 
+ dist_man_MANS := $(addprefix doc/, usbip.8 usbipd.8)
+diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c
+index 5727dfb15a83..8a1cd1616de4 100644
+--- a/tools/usb/usbip/libsrc/vhci_driver.c
++++ b/tools/usb/usbip/libsrc/vhci_driver.c
+@@ -329,9 +329,17 @@ int usbip_vhci_refresh_device_list(void)
+ int usbip_vhci_get_free_port(uint32_t speed)
+ {
+ 	for (int i = 0; i < vhci_driver->nports; i++) {
+-		if (speed == USB_SPEED_SUPER &&
+-		    vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
+-			continue;
++
++		switch (speed) {
++		case	USB_SPEED_SUPER:
++			if (vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
++				continue;
++		break;
++		default:
++			if (vhci_driver->idev[i].hub != HUB_SPEED_HIGH)
++				continue;
++		break;
++		}
+ 
+ 		if (vhci_driver->idev[i].status == VDEV_ST_NULL)
+ 			return vhci_driver->idev[i].port;