Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.9 commit in: /
Date: Thu, 28 Nov 2019 23:52:01
Message-Id: 1574985102.2abbc4978684dd2bf1a503f3f1b5f259a51f8926.mpagano@gentoo
1 commit: 2abbc4978684dd2bf1a503f3f1b5f259a51f8926
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Thu Nov 28 23:51:42 2019 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Thu Nov 28 23:51:42 2019 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2abbc497
7
8 Linux patch 4.9.204
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1203_linux-4.9.204.patch | 5300 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 5304 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index fed0c83..88b037e 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -855,6 +855,10 @@ Patch: 1202_linux-4.9.203.patch
21 From: http://www.kernel.org
22 Desc: Linux 4.9.203
23
24 +Patch: 1203_linux-4.9.204.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 4.9.204
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1203_linux-4.9.204.patch b/1203_linux-4.9.204.patch
33 new file mode 100644
34 index 0000000..123e455
35 --- /dev/null
36 +++ b/1203_linux-4.9.204.patch
37 @@ -0,0 +1,5300 @@
38 +diff --git a/Documentation/hw-vuln/mds.rst b/Documentation/hw-vuln/mds.rst
39 +index daf6fdac49a3..fbbd1719afb9 100644
40 +--- a/Documentation/hw-vuln/mds.rst
41 ++++ b/Documentation/hw-vuln/mds.rst
42 +@@ -265,8 +265,11 @@ time with the option "mds=". The valid arguments for this option are:
43 +
44 + ============ =============================================================
45 +
46 +-Not specifying this option is equivalent to "mds=full".
47 +-
48 ++Not specifying this option is equivalent to "mds=full". For processors
49 ++that are affected by both TAA (TSX Asynchronous Abort) and MDS,
50 ++specifying just "mds=off" without an accompanying "tsx_async_abort=off"
51 ++will have no effect as the same mitigation is used for both
52 ++vulnerabilities.
53 +
54 + Mitigation selection guide
55 + --------------------------
56 +diff --git a/Documentation/hw-vuln/tsx_async_abort.rst b/Documentation/hw-vuln/tsx_async_abort.rst
57 +index fddbd7579c53..af6865b822d2 100644
58 +--- a/Documentation/hw-vuln/tsx_async_abort.rst
59 ++++ b/Documentation/hw-vuln/tsx_async_abort.rst
60 +@@ -174,7 +174,10 @@ the option "tsx_async_abort=". The valid arguments for this option are:
61 + CPU is not vulnerable to cross-thread TAA attacks.
62 + ============ =============================================================
63 +
64 +-Not specifying this option is equivalent to "tsx_async_abort=full".
65 ++Not specifying this option is equivalent to "tsx_async_abort=full". For
66 ++processors that are affected by both TAA and MDS, specifying just
67 ++"tsx_async_abort=off" without an accompanying "mds=off" will have no
68 ++effect as the same mitigation is used for both vulnerabilities.
69 +
70 + The kernel command line also allows to control the TSX feature using the
71 + parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used
72 +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
73 +index c81a008d6512..1bc12619bedd 100644
74 +--- a/Documentation/kernel-parameters.txt
75 ++++ b/Documentation/kernel-parameters.txt
76 +@@ -2365,6 +2365,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
77 + SMT on vulnerable CPUs
78 + off - Unconditionally disable MDS mitigation
79 +
80 ++ On TAA-affected machines, mds=off can be prevented by
81 ++ an active TAA mitigation as both vulnerabilities are
82 ++ mitigated with the same mechanism so in order to disable
83 ++ this mitigation, you need to specify tsx_async_abort=off
84 ++ too.
85 ++
86 + Not specifying this option is equivalent to
87 + mds=full.
88 +
89 +@@ -4599,6 +4605,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
90 + vulnerable to cross-thread TAA attacks.
91 + off - Unconditionally disable TAA mitigation
92 +
93 ++ On MDS-affected machines, tsx_async_abort=off can be
94 ++ prevented by an active MDS mitigation as both vulnerabilities
95 ++ are mitigated with the same mechanism so in order to disable
96 ++ this mitigation, you need to specify mds=off too.
97 ++
98 + Not specifying this option is equivalent to
99 + tsx_async_abort=full. On CPUs which are MDS affected
100 + and deploy MDS mitigation, TAA mitigation is not
101 +diff --git a/Makefile b/Makefile
102 +index 174c0e2526ac..0234869784fa 100644
103 +--- a/Makefile
104 ++++ b/Makefile
105 +@@ -1,6 +1,6 @@
106 + VERSION = 4
107 + PATCHLEVEL = 9
108 +-SUBLEVEL = 203
109 ++SUBLEVEL = 204
110 + EXTRAVERSION =
111 + NAME = Roaring Lionus
112 +
113 +diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c
114 +index 2ce24e74f879..a509b77ef80d 100644
115 +--- a/arch/arc/kernel/perf_event.c
116 ++++ b/arch/arc/kernel/perf_event.c
117 +@@ -488,8 +488,8 @@ static int arc_pmu_device_probe(struct platform_device *pdev)
118 + /* loop thru all available h/w condition indexes */
119 + for (j = 0; j < cc_bcr.c; j++) {
120 + write_aux_reg(ARC_REG_CC_INDEX, j);
121 +- cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
122 +- cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
123 ++ cc_name.indiv.word0 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME0));
124 ++ cc_name.indiv.word1 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME1));
125 +
126 + /* See if it has been mapped to a perf event_id */
127 + for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
128 +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
129 +index 241bf898adf5..7edc6c3f4bd9 100644
130 +--- a/arch/arm/mm/mmu.c
131 ++++ b/arch/arm/mm/mmu.c
132 +@@ -1188,6 +1188,9 @@ void __init adjust_lowmem_bounds(void)
133 + phys_addr_t block_start = reg->base;
134 + phys_addr_t block_end = reg->base + reg->size;
135 +
136 ++ if (memblock_is_nomap(reg))
137 ++ continue;
138 ++
139 + if (reg->base < vmalloc_limit) {
140 + if (block_end > lowmem_limit)
141 + /*
142 +diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
143 +index ee94597773fa..8d469aa5fc98 100644
144 +--- a/arch/arm64/Makefile
145 ++++ b/arch/arm64/Makefile
146 +@@ -134,6 +134,7 @@ archclean:
147 + $(Q)$(MAKE) $(clean)=$(boot)
148 + $(Q)$(MAKE) $(clean)=$(boot)/dts
149 +
150 ++ifeq ($(KBUILD_EXTMOD),)
151 + # We need to generate vdso-offsets.h before compiling certain files in kernel/.
152 + # In order to do that, we should use the archprepare target, but we can't since
153 + # asm-offsets.h is included in some files used to generate vdso-offsets.h, and
154 +@@ -143,6 +144,7 @@ archclean:
155 + prepare: vdso_prepare
156 + vdso_prepare: prepare0
157 + $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
158 ++endif
159 +
160 + define archhelp
161 + echo '* Image.gz - Compressed kernel image (arch/$(ARCH)/boot/Image.gz)'
162 +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
163 +index 28bef94cf792..5962badb3346 100644
164 +--- a/arch/arm64/kernel/traps.c
165 ++++ b/arch/arm64/kernel/traps.c
166 +@@ -611,7 +611,6 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
167 + handler[reason], smp_processor_id(), esr,
168 + esr_get_class_string(esr));
169 +
170 +- die("Oops - bad mode", regs, 0);
171 + local_irq_disable();
172 + panic("bad mode");
173 + }
174 +diff --git a/arch/m68k/kernel/uboot.c b/arch/m68k/kernel/uboot.c
175 +index b3536a82a262..e002084af101 100644
176 +--- a/arch/m68k/kernel/uboot.c
177 ++++ b/arch/m68k/kernel/uboot.c
178 +@@ -103,5 +103,5 @@ __init void process_uboot_commandline(char *commandp, int size)
179 + }
180 +
181 + parse_uboot_commandline(commandp, len);
182 +- commandp[size - 1] = 0;
183 ++ commandp[len - 1] = 0;
184 + }
185 +diff --git a/arch/powerpc/include/asm/asm-prototypes.h b/arch/powerpc/include/asm/asm-prototypes.h
186 +index f3daa175f86c..c06cfdf12c0b 100644
187 +--- a/arch/powerpc/include/asm/asm-prototypes.h
188 ++++ b/arch/powerpc/include/asm/asm-prototypes.h
189 +@@ -124,7 +124,10 @@ extern int __ucmpdi2(u64, u64);
190 + /* Patch sites */
191 + extern s32 patch__call_flush_count_cache;
192 + extern s32 patch__flush_count_cache_return;
193 ++extern s32 patch__flush_link_stack_return;
194 ++extern s32 patch__call_kvm_flush_link_stack;
195 +
196 + extern long flush_count_cache;
197 ++extern long kvm_flush_link_stack;
198 +
199 + #endif /* _ASM_POWERPC_ASM_PROTOTYPES_H */
200 +diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
201 +index 759597bf0fd8..ccf44c135389 100644
202 +--- a/arch/powerpc/include/asm/security_features.h
203 ++++ b/arch/powerpc/include/asm/security_features.h
204 +@@ -81,6 +81,9 @@ static inline bool security_ftr_enabled(unsigned long feature)
205 + // Software required to flush count cache on context switch
206 + #define SEC_FTR_FLUSH_COUNT_CACHE 0x0000000000000400ull
207 +
208 ++// Software required to flush link stack on context switch
209 ++#define SEC_FTR_FLUSH_LINK_STACK 0x0000000000001000ull
210 ++
211 +
212 + // Features enabled by default
213 + #define SEC_FTR_DEFAULT \
214 +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
215 +index 1abd8dd77ec1..eee2131a97e6 100644
216 +--- a/arch/powerpc/kernel/eeh_pe.c
217 ++++ b/arch/powerpc/kernel/eeh_pe.c
218 +@@ -370,7 +370,7 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev)
219 + while (parent) {
220 + if (!(parent->type & EEH_PE_INVALID))
221 + break;
222 +- parent->type &= ~(EEH_PE_INVALID | EEH_PE_KEEP);
223 ++ parent->type &= ~EEH_PE_INVALID;
224 + parent = parent->parent;
225 + }
226 +
227 +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
228 +index 390ebf4ef384..38f0a75014eb 100644
229 +--- a/arch/powerpc/kernel/entry_64.S
230 ++++ b/arch/powerpc/kernel/entry_64.S
231 +@@ -510,6 +510,7 @@ flush_count_cache:
232 + /* Save LR into r9 */
233 + mflr r9
234 +
235 ++ // Flush the link stack
236 + .rept 64
237 + bl .+4
238 + .endr
239 +@@ -519,6 +520,11 @@ flush_count_cache:
240 + .balign 32
241 + /* Restore LR */
242 + 1: mtlr r9
243 ++
244 ++ // If we're just flushing the link stack, return here
245 ++3: nop
246 ++ patch_site 3b patch__flush_link_stack_return
247 ++
248 + li r9,0x7fff
249 + mtctr r9
250 +
251 +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
252 +index 47c6c0401b3a..54c95e7c74cc 100644
253 +--- a/arch/powerpc/kernel/process.c
254 ++++ b/arch/powerpc/kernel/process.c
255 +@@ -576,12 +576,11 @@ void flush_all_to_thread(struct task_struct *tsk)
256 + if (tsk->thread.regs) {
257 + preempt_disable();
258 + BUG_ON(tsk != current);
259 +- save_all(tsk);
260 +-
261 + #ifdef CONFIG_SPE
262 + if (tsk->thread.regs->msr & MSR_SPE)
263 + tsk->thread.spefscr = mfspr(SPRN_SPEFSCR);
264 + #endif
265 ++ save_all(tsk);
266 +
267 + preempt_enable();
268 + }
269 +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
270 +index f4a98d9c5913..11fff9669cfd 100644
271 +--- a/arch/powerpc/kernel/security.c
272 ++++ b/arch/powerpc/kernel/security.c
273 +@@ -25,11 +25,12 @@ enum count_cache_flush_type {
274 + COUNT_CACHE_FLUSH_HW = 0x4,
275 + };
276 + static enum count_cache_flush_type count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
277 ++static bool link_stack_flush_enabled;
278 +
279 + bool barrier_nospec_enabled;
280 + static bool no_nospec;
281 + static bool btb_flush_enabled;
282 +-#ifdef CONFIG_PPC_FSL_BOOK3E
283 ++#if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_BOOK3S_64)
284 + static bool no_spectrev2;
285 + #endif
286 +
287 +@@ -107,7 +108,7 @@ static __init int barrier_nospec_debugfs_init(void)
288 + device_initcall(barrier_nospec_debugfs_init);
289 + #endif /* CONFIG_DEBUG_FS */
290 +
291 +-#ifdef CONFIG_PPC_FSL_BOOK3E
292 ++#if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_BOOK3S_64)
293 + static int __init handle_nospectre_v2(char *p)
294 + {
295 + no_spectrev2 = true;
296 +@@ -115,6 +116,9 @@ static int __init handle_nospectre_v2(char *p)
297 + return 0;
298 + }
299 + early_param("nospectre_v2", handle_nospectre_v2);
300 ++#endif /* CONFIG_PPC_FSL_BOOK3E || CONFIG_PPC_BOOK3S_64 */
301 ++
302 ++#ifdef CONFIG_PPC_FSL_BOOK3E
303 + void setup_spectre_v2(void)
304 + {
305 + if (no_spectrev2)
306 +@@ -202,11 +206,19 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c
307 +
308 + if (ccd)
309 + seq_buf_printf(&s, "Indirect branch cache disabled");
310 ++
311 ++ if (link_stack_flush_enabled)
312 ++ seq_buf_printf(&s, ", Software link stack flush");
313 ++
314 + } else if (count_cache_flush_type != COUNT_CACHE_FLUSH_NONE) {
315 + seq_buf_printf(&s, "Mitigation: Software count cache flush");
316 +
317 + if (count_cache_flush_type == COUNT_CACHE_FLUSH_HW)
318 + seq_buf_printf(&s, " (hardware accelerated)");
319 ++
320 ++ if (link_stack_flush_enabled)
321 ++ seq_buf_printf(&s, ", Software link stack flush");
322 ++
323 + } else if (btb_flush_enabled) {
324 + seq_buf_printf(&s, "Mitigation: Branch predictor state flush");
325 + } else {
326 +@@ -367,18 +379,49 @@ static __init int stf_barrier_debugfs_init(void)
327 + device_initcall(stf_barrier_debugfs_init);
328 + #endif /* CONFIG_DEBUG_FS */
329 +
330 ++static void no_count_cache_flush(void)
331 ++{
332 ++ count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
333 ++ pr_info("count-cache-flush: software flush disabled.\n");
334 ++}
335 ++
336 + static void toggle_count_cache_flush(bool enable)
337 + {
338 +- if (!enable || !security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE)) {
339 ++ if (!security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE) &&
340 ++ !security_ftr_enabled(SEC_FTR_FLUSH_LINK_STACK))
341 ++ enable = false;
342 ++
343 ++ if (!enable) {
344 + patch_instruction_site(&patch__call_flush_count_cache, PPC_INST_NOP);
345 +- count_cache_flush_type = COUNT_CACHE_FLUSH_NONE;
346 +- pr_info("count-cache-flush: software flush disabled.\n");
347 ++#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
348 ++ patch_instruction_site(&patch__call_kvm_flush_link_stack, PPC_INST_NOP);
349 ++#endif
350 ++ pr_info("link-stack-flush: software flush disabled.\n");
351 ++ link_stack_flush_enabled = false;
352 ++ no_count_cache_flush();
353 + return;
354 + }
355 +
356 ++ // This enables the branch from _switch to flush_count_cache
357 + patch_branch_site(&patch__call_flush_count_cache,
358 + (u64)&flush_count_cache, BRANCH_SET_LINK);
359 +
360 ++#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
361 ++ // This enables the branch from guest_exit_cont to kvm_flush_link_stack
362 ++ patch_branch_site(&patch__call_kvm_flush_link_stack,
363 ++ (u64)&kvm_flush_link_stack, BRANCH_SET_LINK);
364 ++#endif
365 ++
366 ++ pr_info("link-stack-flush: software flush enabled.\n");
367 ++ link_stack_flush_enabled = true;
368 ++
369 ++ // If we just need to flush the link stack, patch an early return
370 ++ if (!security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE)) {
371 ++ patch_instruction_site(&patch__flush_link_stack_return, PPC_INST_BLR);
372 ++ no_count_cache_flush();
373 ++ return;
374 ++ }
375 ++
376 + if (!security_ftr_enabled(SEC_FTR_BCCTR_FLUSH_ASSIST)) {
377 + count_cache_flush_type = COUNT_CACHE_FLUSH_SW;
378 + pr_info("count-cache-flush: full software flush sequence enabled.\n");
379 +@@ -392,7 +435,26 @@ static void toggle_count_cache_flush(bool enable)
380 +
381 + void setup_count_cache_flush(void)
382 + {
383 +- toggle_count_cache_flush(true);
384 ++ bool enable = true;
385 ++
386 ++ if (no_spectrev2 || cpu_mitigations_off()) {
387 ++ if (security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED) ||
388 ++ security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED))
389 ++ pr_warn("Spectre v2 mitigations not fully under software control, can't disable\n");
390 ++
391 ++ enable = false;
392 ++ }
393 ++
394 ++ /*
395 ++ * There's no firmware feature flag/hypervisor bit to tell us we need to
396 ++ * flush the link stack on context switch. So we set it here if we see
397 ++ * either of the Spectre v2 mitigations that aim to protect userspace.
398 ++ */
399 ++ if (security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED) ||
400 ++ security_ftr_enabled(SEC_FTR_FLUSH_COUNT_CACHE))
401 ++ security_ftr_set(SEC_FTR_FLUSH_LINK_STACK);
402 ++
403 ++ toggle_count_cache_flush(enable);
404 + }
405 +
406 + #ifdef CONFIG_DEBUG_FS
407 +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
408 +index 79a180cf4c94..4b60bec20603 100644
409 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
410 ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
411 +@@ -18,6 +18,7 @@
412 + */
413 +
414 + #include <asm/ppc_asm.h>
415 ++#include <asm/code-patching-asm.h>
416 + #include <asm/kvm_asm.h>
417 + #include <asm/reg.h>
418 + #include <asm/mmu.h>
419 +@@ -1266,6 +1267,10 @@ mc_cont:
420 + bl kvmhv_accumulate_time
421 + #endif
422 +
423 ++ /* Possibly flush the link stack here. */
424 ++1: nop
425 ++ patch_site 1b patch__call_kvm_flush_link_stack
426 ++
427 + stw r12, STACK_SLOT_TRAP(r1)
428 + mr r3, r12
429 + /* Increment exit count, poke other threads to exit */
430 +@@ -1685,6 +1690,28 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S)
431 + mtlr r0
432 + blr
433 +
434 ++.balign 32
435 ++.global kvm_flush_link_stack
436 ++kvm_flush_link_stack:
437 ++ /* Save LR into r0 */
438 ++ mflr r0
439 ++
440 ++ /* Flush the link stack. On Power8 it's up to 32 entries in size. */
441 ++ .rept 32
442 ++ bl .+4
443 ++ .endr
444 ++
445 ++ /* And on Power9 it's up to 64. */
446 ++BEGIN_FTR_SECTION
447 ++ .rept 32
448 ++ bl .+4
449 ++ .endr
450 ++END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
451 ++
452 ++ /* Restore LR */
453 ++ mtlr r0
454 ++ blr
455 ++
456 + /*
457 + * Check whether an HDSI is an HPTE not found fault or something else.
458 + * If it is an HPTE not found fault that is due to the guest accessing
459 +diff --git a/arch/powerpc/platforms/ps3/os-area.c b/arch/powerpc/platforms/ps3/os-area.c
460 +index 3db53e8aff92..9b2ef76578f0 100644
461 +--- a/arch/powerpc/platforms/ps3/os-area.c
462 ++++ b/arch/powerpc/platforms/ps3/os-area.c
463 +@@ -664,7 +664,7 @@ static int update_flash_db(void)
464 + db_set_64(db, &os_area_db_id_rtc_diff, saved_params.rtc_diff);
465 +
466 + count = os_area_flash_write(db, sizeof(struct os_area_db), pos);
467 +- if (count < sizeof(struct os_area_db)) {
468 ++ if (count < 0 || count < sizeof(struct os_area_db)) {
469 + pr_debug("%s: os_area_flash_write failed %zd\n", __func__,
470 + count);
471 + error = count < 0 ? count : -EIO;
472 +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
473 +index c0a0947f43bb..656bbbd731d0 100644
474 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
475 ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
476 +@@ -616,7 +616,7 @@ static int dlpar_add_lmb(struct of_drconf_cell *lmb)
477 + nid = memory_add_physaddr_to_nid(lmb->base_addr);
478 +
479 + /* Add the memory */
480 +- rc = add_memory(nid, lmb->base_addr, block_sz);
481 ++ rc = __add_memory(nid, lmb->base_addr, block_sz);
482 + if (rc) {
483 + dlpar_remove_device_tree_lmb(lmb);
484 + dlpar_release_drc(lmb->drc_index);
485 +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
486 +index 96e4fcad57bf..f46e5c0cb6d9 100644
487 +--- a/arch/s390/kernel/perf_cpum_sf.c
488 ++++ b/arch/s390/kernel/perf_cpum_sf.c
489 +@@ -1611,14 +1611,17 @@ static int __init init_cpum_sampling_pmu(void)
490 + }
491 +
492 + sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
493 +- if (!sfdbg)
494 ++ if (!sfdbg) {
495 + pr_err("Registering for s390dbf failed\n");
496 ++ return -ENOMEM;
497 ++ }
498 + debug_register_view(sfdbg, &debug_sprintf_view);
499 +
500 + err = register_external_irq(EXT_IRQ_MEASURE_ALERT,
501 + cpumf_measurement_alert);
502 + if (err) {
503 + pr_cpumsf_err(RS_INIT_FAILURE_ALRT);
504 ++ debug_unregister(sfdbg);
505 + goto out;
506 + }
507 +
508 +@@ -1627,6 +1630,7 @@ static int __init init_cpum_sampling_pmu(void)
509 + pr_cpumsf_err(RS_INIT_FAILURE_PERF);
510 + unregister_external_irq(EXT_IRQ_MEASURE_ALERT,
511 + cpumf_measurement_alert);
512 ++ debug_unregister(sfdbg);
513 + goto out;
514 + }
515 +
516 +diff --git a/arch/sparc/include/asm/cmpxchg_64.h b/arch/sparc/include/asm/cmpxchg_64.h
517 +index faa2f61058c2..92f0a46ace78 100644
518 +--- a/arch/sparc/include/asm/cmpxchg_64.h
519 ++++ b/arch/sparc/include/asm/cmpxchg_64.h
520 +@@ -40,7 +40,12 @@ static inline unsigned long xchg64(__volatile__ unsigned long *m, unsigned long
521 + return val;
522 + }
523 +
524 +-#define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
525 ++#define xchg(ptr,x) \
526 ++({ __typeof__(*(ptr)) __ret; \
527 ++ __ret = (__typeof__(*(ptr))) \
528 ++ __xchg((unsigned long)(x), (ptr), sizeof(*(ptr))); \
529 ++ __ret; \
530 ++})
531 +
532 + void __xchg_called_with_bad_pointer(void);
533 +
534 +diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h
535 +index f005ccac91cc..e87c0f81b700 100644
536 +--- a/arch/sparc/include/asm/parport.h
537 ++++ b/arch/sparc/include/asm/parport.h
538 +@@ -20,6 +20,7 @@
539 + */
540 + #define HAS_DMA
541 +
542 ++#ifdef CONFIG_PARPORT_PC_FIFO
543 + static DEFINE_SPINLOCK(dma_spin_lock);
544 +
545 + #define claim_dma_lock() \
546 +@@ -30,6 +31,7 @@ static DEFINE_SPINLOCK(dma_spin_lock);
547 +
548 + #define release_dma_lock(__flags) \
549 + spin_unlock_irqrestore(&dma_spin_lock, __flags);
550 ++#endif
551 +
552 + static struct sparc_ebus_info {
553 + struct ebus_dma_info info;
554 +diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
555 +index 62087028a9ce..d2ad45c10113 100644
556 +--- a/arch/um/drivers/line.c
557 ++++ b/arch/um/drivers/line.c
558 +@@ -260,7 +260,7 @@ static irqreturn_t line_write_interrupt(int irq, void *data)
559 + if (err == 0) {
560 + spin_unlock(&line->lock);
561 + return IRQ_NONE;
562 +- } else if (err < 0) {
563 ++ } else if ((err < 0) && (err != -EAGAIN)) {
564 + line->head = line->buffer;
565 + line->tail = line->buffer;
566 + }
567 +diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
568 +index ea78a8438a8a..fb489cd848fa 100644
569 +--- a/arch/x86/include/asm/ptrace.h
570 ++++ b/arch/x86/include/asm/ptrace.h
571 +@@ -199,24 +199,52 @@ static inline int regs_within_kernel_stack(struct pt_regs *regs,
572 + (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1)));
573 + }
574 +
575 ++/**
576 ++ * regs_get_kernel_stack_nth_addr() - get the address of the Nth entry on stack
577 ++ * @regs: pt_regs which contains kernel stack pointer.
578 ++ * @n: stack entry number.
579 ++ *
580 ++ * regs_get_kernel_stack_nth() returns the address of the @n th entry of the
581 ++ * kernel stack which is specified by @regs. If the @n th entry is NOT in
582 ++ * the kernel stack, this returns NULL.
583 ++ */
584 ++static inline unsigned long *regs_get_kernel_stack_nth_addr(struct pt_regs *regs, unsigned int n)
585 ++{
586 ++ unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
587 ++
588 ++ addr += n;
589 ++ if (regs_within_kernel_stack(regs, (unsigned long)addr))
590 ++ return addr;
591 ++ else
592 ++ return NULL;
593 ++}
594 ++
595 ++/* To avoid include hell, we can't include uaccess.h */
596 ++extern long probe_kernel_read(void *dst, const void *src, size_t size);
597 ++
598 + /**
599 + * regs_get_kernel_stack_nth() - get Nth entry of the stack
600 + * @regs: pt_regs which contains kernel stack pointer.
601 + * @n: stack entry number.
602 + *
603 + * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which
604 +- * is specified by @regs. If the @n th entry is NOT in the kernel stack,
605 ++ * is specified by @regs. If the @n th entry is NOT in the kernel stack
606 + * this returns 0.
607 + */
608 + static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
609 + unsigned int n)
610 + {
611 +- unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
612 +- addr += n;
613 +- if (regs_within_kernel_stack(regs, (unsigned long)addr))
614 +- return *addr;
615 +- else
616 +- return 0;
617 ++ unsigned long *addr;
618 ++ unsigned long val;
619 ++ long ret;
620 ++
621 ++ addr = regs_get_kernel_stack_nth_addr(regs, n);
622 ++ if (addr) {
623 ++ ret = probe_kernel_read(&val, addr, sizeof(val));
624 ++ if (!ret)
625 ++ return val;
626 ++ }
627 ++ return 0;
628 + }
629 +
630 + #define arch_has_single_step() (1)
631 +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
632 +index 827fc38df97a..24307d5bb4b8 100644
633 +--- a/arch/x86/kernel/cpu/bugs.c
634 ++++ b/arch/x86/kernel/cpu/bugs.c
635 +@@ -38,6 +38,7 @@ static void __init spectre_v2_select_mitigation(void);
636 + static void __init ssb_select_mitigation(void);
637 + static void __init l1tf_select_mitigation(void);
638 + static void __init mds_select_mitigation(void);
639 ++static void __init mds_print_mitigation(void);
640 + static void __init taa_select_mitigation(void);
641 +
642 + /* The base value of the SPEC_CTRL MSR that always has to be preserved. */
643 +@@ -107,6 +108,12 @@ void __init check_bugs(void)
644 + mds_select_mitigation();
645 + taa_select_mitigation();
646 +
647 ++ /*
648 ++ * As MDS and TAA mitigations are inter-related, print MDS
649 ++ * mitigation until after TAA mitigation selection is done.
650 ++ */
651 ++ mds_print_mitigation();
652 ++
653 + arch_smt_update();
654 +
655 + #ifdef CONFIG_X86_32
656 +@@ -244,6 +251,12 @@ static void __init mds_select_mitigation(void)
657 + (mds_nosmt || cpu_mitigations_auto_nosmt()))
658 + cpu_smt_disable(false);
659 + }
660 ++}
661 ++
662 ++static void __init mds_print_mitigation(void)
663 ++{
664 ++ if (!boot_cpu_has_bug(X86_BUG_MDS) || cpu_mitigations_off())
665 ++ return;
666 +
667 + pr_info("%s\n", mds_strings[mds_mitigation]);
668 + }
669 +@@ -303,8 +316,12 @@ static void __init taa_select_mitigation(void)
670 + return;
671 + }
672 +
673 +- /* TAA mitigation is turned off on the cmdline (tsx_async_abort=off) */
674 +- if (taa_mitigation == TAA_MITIGATION_OFF)
675 ++ /*
676 ++ * TAA mitigation via VERW is turned off if both
677 ++ * tsx_async_abort=off and mds=off are specified.
678 ++ */
679 ++ if (taa_mitigation == TAA_MITIGATION_OFF &&
680 ++ mds_mitigation == MDS_MITIGATION_OFF)
681 + goto out;
682 +
683 + if (boot_cpu_has(X86_FEATURE_MD_CLEAR))
684 +@@ -338,6 +355,15 @@ static void __init taa_select_mitigation(void)
685 + if (taa_nosmt || cpu_mitigations_auto_nosmt())
686 + cpu_smt_disable(false);
687 +
688 ++ /*
689 ++ * Update MDS mitigation, if necessary, as the mds_user_clear is
690 ++ * now enabled for TAA mitigation.
691 ++ */
692 ++ if (mds_mitigation == MDS_MITIGATION_OFF &&
693 ++ boot_cpu_has_bug(X86_BUG_MDS)) {
694 ++ mds_mitigation = MDS_MITIGATION_FULL;
695 ++ mds_select_mitigation();
696 ++ }
697 + out:
698 + pr_info("%s\n", taa_strings[taa_mitigation]);
699 + }
700 +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
701 +index f0f180158c26..3a281a2decde 100644
702 +--- a/arch/x86/kvm/mmu.c
703 ++++ b/arch/x86/kvm/mmu.c
704 +@@ -2934,7 +2934,7 @@ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
705 + * here.
706 + */
707 + if (!is_error_noslot_pfn(pfn) && !kvm_is_reserved_pfn(pfn) &&
708 +- level == PT_PAGE_TABLE_LEVEL &&
709 ++ !kvm_is_zone_device_pfn(pfn) && level == PT_PAGE_TABLE_LEVEL &&
710 + PageTransCompoundMap(pfn_to_page(pfn)) &&
711 + !mmu_gfn_lpage_is_disallowed(vcpu, gfn, PT_DIRECTORY_LEVEL)) {
712 + unsigned long mask;
713 +@@ -4890,9 +4890,9 @@ restart:
714 + * the guest, and the guest page table is using 4K page size
715 + * mapping if the indirect sp has level = 1.
716 + */
717 +- if (sp->role.direct &&
718 +- !kvm_is_reserved_pfn(pfn) &&
719 +- PageTransCompoundMap(pfn_to_page(pfn))) {
720 ++ if (sp->role.direct && !kvm_is_reserved_pfn(pfn) &&
721 ++ !kvm_is_zone_device_pfn(pfn) &&
722 ++ PageTransCompoundMap(pfn_to_page(pfn))) {
723 + drop_spte(kvm, sptep);
724 + need_tlb_flush = 1;
725 + goto restart;
726 +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
727 +index 4c0d6d0d6337..f76caa03f4f8 100644
728 +--- a/arch/x86/kvm/vmx.c
729 ++++ b/arch/x86/kvm/vmx.c
730 +@@ -1547,7 +1547,7 @@ static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr)
731 + return -1;
732 + }
733 +
734 +-static inline void __invvpid(int ext, u16 vpid, gva_t gva)
735 ++static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva)
736 + {
737 + struct {
738 + u64 vpid : 16;
739 +@@ -1561,7 +1561,7 @@ static inline void __invvpid(int ext, u16 vpid, gva_t gva)
740 + : : "a"(&operand), "c"(ext) : "cc", "memory");
741 + }
742 +
743 +-static inline void __invept(int ext, u64 eptp, gpa_t gpa)
744 ++static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa)
745 + {
746 + struct {
747 + u64 eptp, gpa;
748 +diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
749 +index a3d2c62fd805..0a3ad5dd1e8b 100644
750 +--- a/arch/x86/tools/gen-insn-attr-x86.awk
751 ++++ b/arch/x86/tools/gen-insn-attr-x86.awk
752 +@@ -68,7 +68,7 @@ BEGIN {
753 +
754 + lprefix1_expr = "\\((66|!F3)\\)"
755 + lprefix2_expr = "\\(F3\\)"
756 +- lprefix3_expr = "\\((F2|!F3|66\\&F2)\\)"
757 ++ lprefix3_expr = "\\((F2|!F3|66&F2)\\)"
758 + lprefix_expr = "\\((66|F2|F3)\\)"
759 + max_lprefix = 4
760 +
761 +@@ -256,7 +256,7 @@ function convert_operands(count,opnd, i,j,imm,mod)
762 + return add_flags(imm, mod)
763 + }
764 +
765 +-/^[0-9a-f]+\:/ {
766 ++/^[0-9a-f]+:/ {
767 + if (NR == 1)
768 + next
769 + # get index
770 +diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
771 +index 6b0d3ef7309c..2ccfbb61ca89 100644
772 +--- a/drivers/acpi/acpi_memhotplug.c
773 ++++ b/drivers/acpi/acpi_memhotplug.c
774 +@@ -228,7 +228,7 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
775 + if (node < 0)
776 + node = memory_add_physaddr_to_nid(info->start_addr);
777 +
778 +- result = add_memory(node, info->start_addr, info->length);
779 ++ result = __add_memory(node, info->start_addr, info->length);
780 +
781 + /*
782 + * If the memory block has been used by the kernel, add_memory()
783 +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
784 +index a0b88f148990..e23e2672a1d6 100644
785 +--- a/drivers/atm/zatm.c
786 ++++ b/drivers/atm/zatm.c
787 +@@ -126,7 +126,7 @@ static unsigned long dummy[2] = {0,0};
788 + #define zin_n(r) inl(zatm_dev->base+r*4)
789 + #define zin(r) inl(zatm_dev->base+uPD98401_##r*4)
790 + #define zout(v,r) outl(v,zatm_dev->base+uPD98401_##r*4)
791 +-#define zwait while (zin(CMR) & uPD98401_BUSY)
792 ++#define zwait() do {} while (zin(CMR) & uPD98401_BUSY)
793 +
794 + /* RX0, RX1, TX0, TX1 */
795 + static const int mbx_entries[NR_MBX] = { 1024,1024,1024,1024 };
796 +@@ -140,7 +140,7 @@ static const int mbx_esize[NR_MBX] = { 16,16,4,4 }; /* entry size in bytes */
797 +
798 + static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
799 + {
800 +- zwait;
801 ++ zwait();
802 + zout(value,CER);
803 + zout(uPD98401_IND_ACC | uPD98401_IA_BALL |
804 + (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
805 +@@ -149,10 +149,10 @@ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr)
806 +
807 + static u32 zpeekl(struct zatm_dev *zatm_dev,u32 addr)
808 + {
809 +- zwait;
810 ++ zwait();
811 + zout(uPD98401_IND_ACC | uPD98401_IA_BALL | uPD98401_IA_RW |
812 + (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR);
813 +- zwait;
814 ++ zwait();
815 + return zin(CER);
816 + }
817 +
818 +@@ -241,7 +241,7 @@ static void refill_pool(struct atm_dev *dev,int pool)
819 + }
820 + if (first) {
821 + spin_lock_irqsave(&zatm_dev->lock, flags);
822 +- zwait;
823 ++ zwait();
824 + zout(virt_to_bus(first),CER);
825 + zout(uPD98401_ADD_BAT | (pool << uPD98401_POOL_SHIFT) | count,
826 + CMR);
827 +@@ -508,9 +508,9 @@ static int open_rx_first(struct atm_vcc *vcc)
828 + }
829 + if (zatm_vcc->pool < 0) return -EMSGSIZE;
830 + spin_lock_irqsave(&zatm_dev->lock, flags);
831 +- zwait;
832 ++ zwait();
833 + zout(uPD98401_OPEN_CHAN,CMR);
834 +- zwait;
835 ++ zwait();
836 + DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
837 + chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
838 + spin_unlock_irqrestore(&zatm_dev->lock, flags);
839 +@@ -571,21 +571,21 @@ static void close_rx(struct atm_vcc *vcc)
840 + pos = vcc->vci >> 1;
841 + shift = (1-(vcc->vci & 1)) << 4;
842 + zpokel(zatm_dev,zpeekl(zatm_dev,pos) & ~(0xffff << shift),pos);
843 +- zwait;
844 ++ zwait();
845 + zout(uPD98401_NOP,CMR);
846 +- zwait;
847 ++ zwait();
848 + zout(uPD98401_NOP,CMR);
849 + spin_unlock_irqrestore(&zatm_dev->lock, flags);
850 + }
851 + spin_lock_irqsave(&zatm_dev->lock, flags);
852 +- zwait;
853 ++ zwait();
854 + zout(uPD98401_DEACT_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
855 + uPD98401_CHAN_ADDR_SHIFT),CMR);
856 +- zwait;
857 ++ zwait();
858 + udelay(10); /* why oh why ... ? */
859 + zout(uPD98401_CLOSE_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan <<
860 + uPD98401_CHAN_ADDR_SHIFT),CMR);
861 +- zwait;
862 ++ zwait();
863 + if (!(zin(CMR) & uPD98401_CHAN_ADDR))
864 + printk(KERN_CRIT DEV_LABEL "(itf %d): can't close RX channel "
865 + "%d\n",vcc->dev->number,zatm_vcc->rx_chan);
866 +@@ -699,7 +699,7 @@ printk("NONONONOO!!!!\n");
867 + skb_queue_tail(&zatm_vcc->tx_queue,skb);
868 + DPRINTK("QRP=0x%08lx\n",zpeekl(zatm_dev,zatm_vcc->tx_chan*VC_SIZE/4+
869 + uPD98401_TXVC_QRP));
870 +- zwait;
871 ++ zwait();
872 + zout(uPD98401_TX_READY | (zatm_vcc->tx_chan <<
873 + uPD98401_CHAN_ADDR_SHIFT),CMR);
874 + spin_unlock_irqrestore(&zatm_dev->lock, flags);
875 +@@ -891,12 +891,12 @@ static void close_tx(struct atm_vcc *vcc)
876 + }
877 + spin_lock_irqsave(&zatm_dev->lock, flags);
878 + #if 0
879 +- zwait;
880 ++ zwait();
881 + zout(uPD98401_DEACT_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
882 + #endif
883 +- zwait;
884 ++ zwait();
885 + zout(uPD98401_CLOSE_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR);
886 +- zwait;
887 ++ zwait();
888 + if (!(zin(CMR) & uPD98401_CHAN_ADDR))
889 + printk(KERN_CRIT DEV_LABEL "(itf %d): can't close TX channel "
890 + "%d\n",vcc->dev->number,chan);
891 +@@ -926,9 +926,9 @@ static int open_tx_first(struct atm_vcc *vcc)
892 + zatm_vcc->tx_chan = 0;
893 + if (vcc->qos.txtp.traffic_class == ATM_NONE) return 0;
894 + spin_lock_irqsave(&zatm_dev->lock, flags);
895 +- zwait;
896 ++ zwait();
897 + zout(uPD98401_OPEN_CHAN,CMR);
898 +- zwait;
899 ++ zwait();
900 + DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER));
901 + chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT;
902 + spin_unlock_irqrestore(&zatm_dev->lock, flags);
903 +@@ -1559,7 +1559,7 @@ static void zatm_phy_put(struct atm_dev *dev,unsigned char value,
904 + struct zatm_dev *zatm_dev;
905 +
906 + zatm_dev = ZATM_DEV(dev);
907 +- zwait;
908 ++ zwait();
909 + zout(value,CER);
910 + zout(uPD98401_IND_ACC | uPD98401_IA_B0 |
911 + (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
912 +@@ -1571,10 +1571,10 @@ static unsigned char zatm_phy_get(struct atm_dev *dev,unsigned long addr)
913 + struct zatm_dev *zatm_dev;
914 +
915 + zatm_dev = ZATM_DEV(dev);
916 +- zwait;
917 ++ zwait();
918 + zout(uPD98401_IND_ACC | uPD98401_IA_B0 | uPD98401_IA_RW |
919 + (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR);
920 +- zwait;
921 ++ zwait();
922 + return zin(CER) & 0xff;
923 + }
924 +
925 +diff --git a/drivers/base/memory.c b/drivers/base/memory.c
926 +index c5cdd190b781..6a3694a4843f 100644
927 +--- a/drivers/base/memory.c
928 ++++ b/drivers/base/memory.c
929 +@@ -500,15 +500,20 @@ memory_probe_store(struct device *dev, struct device_attribute *attr,
930 + if (phys_addr & ((pages_per_block << PAGE_SHIFT) - 1))
931 + return -EINVAL;
932 +
933 ++ ret = lock_device_hotplug_sysfs();
934 ++ if (ret)
935 ++ return ret;
936 ++
937 + nid = memory_add_physaddr_to_nid(phys_addr);
938 +- ret = add_memory(nid, phys_addr,
939 +- MIN_MEMORY_BLOCK_SIZE * sections_per_block);
940 ++ ret = __add_memory(nid, phys_addr,
941 ++ MIN_MEMORY_BLOCK_SIZE * sections_per_block);
942 +
943 + if (ret)
944 + goto out;
945 +
946 + ret = count;
947 + out:
948 ++ unlock_device_hotplug();
949 + return ret;
950 + }
951 +
952 +diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
953 +index 5fd50a284168..db4354fb2a0d 100644
954 +--- a/drivers/block/amiflop.c
955 ++++ b/drivers/block/amiflop.c
956 +@@ -1699,11 +1699,41 @@ static const struct block_device_operations floppy_fops = {
957 + .check_events = amiga_check_events,
958 + };
959 +
960 ++static struct gendisk *fd_alloc_disk(int drive)
961 ++{
962 ++ struct gendisk *disk;
963 ++
964 ++ disk = alloc_disk(1);
965 ++ if (!disk)
966 ++ goto out;
967 ++
968 ++ disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
969 ++ if (IS_ERR(disk->queue)) {
970 ++ disk->queue = NULL;
971 ++ goto out_put_disk;
972 ++ }
973 ++
974 ++ unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL);
975 ++ if (!unit[drive].trackbuf)
976 ++ goto out_cleanup_queue;
977 ++
978 ++ return disk;
979 ++
980 ++out_cleanup_queue:
981 ++ blk_cleanup_queue(disk->queue);
982 ++ disk->queue = NULL;
983 ++out_put_disk:
984 ++ put_disk(disk);
985 ++out:
986 ++ unit[drive].type->code = FD_NODRIVE;
987 ++ return NULL;
988 ++}
989 ++
990 + static int __init fd_probe_drives(void)
991 + {
992 + int drive,drives,nomem;
993 +
994 +- printk(KERN_INFO "FD: probing units\nfound ");
995 ++ pr_info("FD: probing units\nfound");
996 + drives=0;
997 + nomem=0;
998 + for(drive=0;drive<FD_MAX_UNITS;drive++) {
999 +@@ -1711,27 +1741,17 @@ static int __init fd_probe_drives(void)
1000 + fd_probe(drive);
1001 + if (unit[drive].type->code == FD_NODRIVE)
1002 + continue;
1003 +- disk = alloc_disk(1);
1004 ++
1005 ++ disk = fd_alloc_disk(drive);
1006 + if (!disk) {
1007 +- unit[drive].type->code = FD_NODRIVE;
1008 ++ pr_cont(" no mem for fd%d", drive);
1009 ++ nomem = 1;
1010 + continue;
1011 + }
1012 + unit[drive].gendisk = disk;
1013 +-
1014 +- disk->queue = blk_init_queue(do_fd_request, &amiflop_lock);
1015 +- if (!disk->queue) {
1016 +- unit[drive].type->code = FD_NODRIVE;
1017 +- continue;
1018 +- }
1019 +-
1020 + drives++;
1021 +- if ((unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL)) == NULL) {
1022 +- printk("no mem for ");
1023 +- unit[drive].type = &drive_types[num_dr_types - 1]; /* FD_NODRIVE */
1024 +- drives--;
1025 +- nomem = 1;
1026 +- }
1027 +- printk("fd%d ",drive);
1028 ++
1029 ++ pr_cont(" fd%d",drive);
1030 + disk->major = FLOPPY_MAJOR;
1031 + disk->first_minor = drive;
1032 + disk->fops = &floppy_fops;
1033 +@@ -1742,11 +1762,11 @@ static int __init fd_probe_drives(void)
1034 + }
1035 + if ((drives > 0) || (nomem == 0)) {
1036 + if (drives == 0)
1037 +- printk("no drives");
1038 +- printk("\n");
1039 ++ pr_cont(" no drives");
1040 ++ pr_cont("\n");
1041 + return drives;
1042 + }
1043 +- printk("\n");
1044 ++ pr_cont("\n");
1045 + return -ENOMEM;
1046 + }
1047 +
1048 +@@ -1837,30 +1857,6 @@ out_blkdev:
1049 + return ret;
1050 + }
1051 +
1052 +-#if 0 /* not safe to unload */
1053 +-static int __exit amiga_floppy_remove(struct platform_device *pdev)
1054 +-{
1055 +- int i;
1056 +-
1057 +- for( i = 0; i < FD_MAX_UNITS; i++) {
1058 +- if (unit[i].type->code != FD_NODRIVE) {
1059 +- struct request_queue *q = unit[i].gendisk->queue;
1060 +- del_gendisk(unit[i].gendisk);
1061 +- put_disk(unit[i].gendisk);
1062 +- kfree(unit[i].trackbuf);
1063 +- if (q)
1064 +- blk_cleanup_queue(q);
1065 +- }
1066 +- }
1067 +- blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256);
1068 +- free_irq(IRQ_AMIGA_CIAA_TB, NULL);
1069 +- free_irq(IRQ_AMIGA_DSKBLK, NULL);
1070 +- custom.dmacon = DMAF_DISK; /* disable DMA */
1071 +- amiga_chip_free(raw_buf);
1072 +- unregister_blkdev(FLOPPY_MAJOR, "fd");
1073 +-}
1074 +-#endif
1075 +-
1076 + static struct platform_driver amiga_floppy_driver = {
1077 + .driver = {
1078 + .name = "amiga-floppy",
1079 +diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
1080 +index 34e04bf87a62..26f9982bab26 100644
1081 +--- a/drivers/bluetooth/hci_bcsp.c
1082 ++++ b/drivers/bluetooth/hci_bcsp.c
1083 +@@ -605,6 +605,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
1084 + if (*ptr == 0xc0) {
1085 + BT_ERR("Short BCSP packet");
1086 + kfree_skb(bcsp->rx_skb);
1087 ++ bcsp->rx_skb = NULL;
1088 + bcsp->rx_state = BCSP_W4_PKT_START;
1089 + bcsp->rx_count = 0;
1090 + } else
1091 +@@ -620,6 +621,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
1092 + bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
1093 + BT_ERR("Error in BCSP hdr checksum");
1094 + kfree_skb(bcsp->rx_skb);
1095 ++ bcsp->rx_skb = NULL;
1096 + bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
1097 + bcsp->rx_count = 0;
1098 + continue;
1099 +@@ -644,6 +646,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
1100 + bscp_get_crc(bcsp));
1101 +
1102 + kfree_skb(bcsp->rx_skb);
1103 ++ bcsp->rx_skb = NULL;
1104 + bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
1105 + bcsp->rx_count = 0;
1106 + continue;
1107 +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
1108 +index 800ced0a5a24..34548d3b4d13 100644
1109 +--- a/drivers/char/virtio_console.c
1110 ++++ b/drivers/char/virtio_console.c
1111 +@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void)
1112 + }
1113 + }
1114 +
1115 +-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
1116 ++static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size,
1117 + int pages)
1118 + {
1119 + struct port_buffer *buf;
1120 +@@ -445,7 +445,7 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
1121 + return buf;
1122 + }
1123 +
1124 +- if (is_rproc_serial(vq->vdev)) {
1125 ++ if (is_rproc_serial(vdev)) {
1126 + /*
1127 + * Allocate DMA memory from ancestor. When a virtio
1128 + * device is created by remoteproc, the DMA memory is
1129 +@@ -455,9 +455,9 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size,
1130 + * DMA_MEMORY_INCLUDES_CHILDREN had been supported
1131 + * in dma-coherent.c
1132 + */
1133 +- if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent)
1134 ++ if (!vdev->dev.parent || !vdev->dev.parent->parent)
1135 + goto free_buf;
1136 +- buf->dev = vq->vdev->dev.parent->parent;
1137 ++ buf->dev = vdev->dev.parent->parent;
1138 +
1139 + /* Increase device refcnt to avoid freeing it */
1140 + get_device(buf->dev);
1141 +@@ -841,7 +841,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
1142 +
1143 + count = min((size_t)(32 * 1024), count);
1144 +
1145 +- buf = alloc_buf(port->out_vq, count, 0);
1146 ++ buf = alloc_buf(port->portdev->vdev, count, 0);
1147 + if (!buf)
1148 + return -ENOMEM;
1149 +
1150 +@@ -960,7 +960,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe,
1151 + if (ret < 0)
1152 + goto error_out;
1153 +
1154 +- buf = alloc_buf(port->out_vq, 0, pipe->nrbufs);
1155 ++ buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs);
1156 + if (!buf) {
1157 + ret = -ENOMEM;
1158 + goto error_out;
1159 +@@ -1369,24 +1369,24 @@ static void set_console_size(struct port *port, u16 rows, u16 cols)
1160 + port->cons.ws.ws_col = cols;
1161 + }
1162 +
1163 +-static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
1164 ++static int fill_queue(struct virtqueue *vq, spinlock_t *lock)
1165 + {
1166 + struct port_buffer *buf;
1167 +- unsigned int nr_added_bufs;
1168 ++ int nr_added_bufs;
1169 + int ret;
1170 +
1171 + nr_added_bufs = 0;
1172 + do {
1173 +- buf = alloc_buf(vq, PAGE_SIZE, 0);
1174 ++ buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
1175 + if (!buf)
1176 +- break;
1177 ++ return -ENOMEM;
1178 +
1179 + spin_lock_irq(lock);
1180 + ret = add_inbuf(vq, buf);
1181 + if (ret < 0) {
1182 + spin_unlock_irq(lock);
1183 + free_buf(buf, true);
1184 +- break;
1185 ++ return ret;
1186 + }
1187 + nr_added_bufs++;
1188 + spin_unlock_irq(lock);
1189 +@@ -1406,7 +1406,6 @@ static int add_port(struct ports_device *portdev, u32 id)
1190 + char debugfs_name[16];
1191 + struct port *port;
1192 + dev_t devt;
1193 +- unsigned int nr_added_bufs;
1194 + int err;
1195 +
1196 + port = kmalloc(sizeof(*port), GFP_KERNEL);
1197 +@@ -1465,11 +1464,13 @@ static int add_port(struct ports_device *portdev, u32 id)
1198 + spin_lock_init(&port->outvq_lock);
1199 + init_waitqueue_head(&port->waitqueue);
1200 +
1201 +- /* Fill the in_vq with buffers so the host can send us data. */
1202 +- nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
1203 +- if (!nr_added_bufs) {
1204 ++ /* We can safely ignore ENOSPC because it means
1205 ++ * the queue already has buffers. Buffers are removed
1206 ++ * only by virtcons_remove(), not by unplug_port()
1207 ++ */
1208 ++ err = fill_queue(port->in_vq, &port->inbuf_lock);
1209 ++ if (err < 0 && err != -ENOSPC) {
1210 + dev_err(port->dev, "Error allocating inbufs\n");
1211 +- err = -ENOMEM;
1212 + goto free_device;
1213 + }
1214 +
1215 +@@ -1992,19 +1993,40 @@ static void remove_vqs(struct ports_device *portdev)
1216 + kfree(portdev->out_vqs);
1217 + }
1218 +
1219 +-static void remove_controlq_data(struct ports_device *portdev)
1220 ++static void virtcons_remove(struct virtio_device *vdev)
1221 + {
1222 +- struct port_buffer *buf;
1223 +- unsigned int len;
1224 ++ struct ports_device *portdev;
1225 ++ struct port *port, *port2;
1226 +
1227 +- if (!use_multiport(portdev))
1228 +- return;
1229 ++ portdev = vdev->priv;
1230 +
1231 +- while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
1232 +- free_buf(buf, true);
1233 ++ spin_lock_irq(&pdrvdata_lock);
1234 ++ list_del(&portdev->list);
1235 ++ spin_unlock_irq(&pdrvdata_lock);
1236 +
1237 +- while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
1238 +- free_buf(buf, true);
1239 ++ /* Disable interrupts for vqs */
1240 ++ vdev->config->reset(vdev);
1241 ++ /* Finish up work that's lined up */
1242 ++ if (use_multiport(portdev))
1243 ++ cancel_work_sync(&portdev->control_work);
1244 ++ else
1245 ++ cancel_work_sync(&portdev->config_work);
1246 ++
1247 ++ list_for_each_entry_safe(port, port2, &portdev->ports, list)
1248 ++ unplug_port(port);
1249 ++
1250 ++ unregister_chrdev(portdev->chr_major, "virtio-portsdev");
1251 ++
1252 ++ /*
1253 ++ * When yanking out a device, we immediately lose the
1254 ++ * (device-side) queues. So there's no point in keeping the
1255 ++ * guest side around till we drop our final reference. This
1256 ++ * also means that any ports which are in an open state will
1257 ++ * have to just stop using the port, as the vqs are going
1258 ++ * away.
1259 ++ */
1260 ++ remove_vqs(portdev);
1261 ++ kfree(portdev);
1262 + }
1263 +
1264 + /*
1265 +@@ -2073,6 +2095,7 @@ static int virtcons_probe(struct virtio_device *vdev)
1266 +
1267 + spin_lock_init(&portdev->ports_lock);
1268 + INIT_LIST_HEAD(&portdev->ports);
1269 ++ INIT_LIST_HEAD(&portdev->list);
1270 +
1271 + virtio_device_ready(portdev->vdev);
1272 +
1273 +@@ -2080,18 +2103,22 @@ static int virtcons_probe(struct virtio_device *vdev)
1274 + INIT_WORK(&portdev->control_work, &control_work_handler);
1275 +
1276 + if (multiport) {
1277 +- unsigned int nr_added_bufs;
1278 +-
1279 + spin_lock_init(&portdev->c_ivq_lock);
1280 + spin_lock_init(&portdev->c_ovq_lock);
1281 +
1282 +- nr_added_bufs = fill_queue(portdev->c_ivq,
1283 +- &portdev->c_ivq_lock);
1284 +- if (!nr_added_bufs) {
1285 ++ err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
1286 ++ if (err < 0) {
1287 + dev_err(&vdev->dev,
1288 + "Error allocating buffers for control queue\n");
1289 +- err = -ENOMEM;
1290 +- goto free_vqs;
1291 ++ /*
1292 ++ * The host might want to notify mgmt sw about device
1293 ++ * add failure.
1294 ++ */
1295 ++ __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
1296 ++ VIRTIO_CONSOLE_DEVICE_READY, 0);
1297 ++ /* Device was functional: we need full cleanup. */
1298 ++ virtcons_remove(vdev);
1299 ++ return err;
1300 + }
1301 + } else {
1302 + /*
1303 +@@ -2122,11 +2149,6 @@ static int virtcons_probe(struct virtio_device *vdev)
1304 +
1305 + return 0;
1306 +
1307 +-free_vqs:
1308 +- /* The host might want to notify mgmt sw about device add failure */
1309 +- __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
1310 +- VIRTIO_CONSOLE_DEVICE_READY, 0);
1311 +- remove_vqs(portdev);
1312 + free_chrdev:
1313 + unregister_chrdev(portdev->chr_major, "virtio-portsdev");
1314 + free:
1315 +@@ -2135,43 +2157,6 @@ fail:
1316 + return err;
1317 + }
1318 +
1319 +-static void virtcons_remove(struct virtio_device *vdev)
1320 +-{
1321 +- struct ports_device *portdev;
1322 +- struct port *port, *port2;
1323 +-
1324 +- portdev = vdev->priv;
1325 +-
1326 +- spin_lock_irq(&pdrvdata_lock);
1327 +- list_del(&portdev->list);
1328 +- spin_unlock_irq(&pdrvdata_lock);
1329 +-
1330 +- /* Disable interrupts for vqs */
1331 +- vdev->config->reset(vdev);
1332 +- /* Finish up work that's lined up */
1333 +- if (use_multiport(portdev))
1334 +- cancel_work_sync(&portdev->control_work);
1335 +- else
1336 +- cancel_work_sync(&portdev->config_work);
1337 +-
1338 +- list_for_each_entry_safe(port, port2, &portdev->ports, list)
1339 +- unplug_port(port);
1340 +-
1341 +- unregister_chrdev(portdev->chr_major, "virtio-portsdev");
1342 +-
1343 +- /*
1344 +- * When yanking out a device, we immediately lose the
1345 +- * (device-side) queues. So there's no point in keeping the
1346 +- * guest side around till we drop our final reference. This
1347 +- * also means that any ports which are in an open state will
1348 +- * have to just stop using the port, as the vqs are going
1349 +- * away.
1350 +- */
1351 +- remove_controlq_data(portdev);
1352 +- remove_vqs(portdev);
1353 +- kfree(portdev);
1354 +-}
1355 +-
1356 + static struct virtio_device_id id_table[] = {
1357 + { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID },
1358 + { 0 },
1359 +@@ -2202,15 +2187,16 @@ static int virtcons_freeze(struct virtio_device *vdev)
1360 +
1361 + vdev->config->reset(vdev);
1362 +
1363 +- virtqueue_disable_cb(portdev->c_ivq);
1364 ++ if (use_multiport(portdev))
1365 ++ virtqueue_disable_cb(portdev->c_ivq);
1366 + cancel_work_sync(&portdev->control_work);
1367 + cancel_work_sync(&portdev->config_work);
1368 + /*
1369 + * Once more: if control_work_handler() was running, it would
1370 + * enable the cb as the last step.
1371 + */
1372 +- virtqueue_disable_cb(portdev->c_ivq);
1373 +- remove_controlq_data(portdev);
1374 ++ if (use_multiport(portdev))
1375 ++ virtqueue_disable_cb(portdev->c_ivq);
1376 +
1377 + list_for_each_entry(port, &portdev->ports, list) {
1378 + virtqueue_disable_cb(port->in_vq);
1379 +diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
1380 +index 9adaf48aea23..061a9f10218b 100644
1381 +--- a/drivers/clk/mmp/clk-of-mmp2.c
1382 ++++ b/drivers/clk/mmp/clk-of-mmp2.c
1383 +@@ -227,8 +227,8 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = {
1384 + /* The gate clocks has mux parent. */
1385 + {MMP2_CLK_SDH0, "sdh0_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH0, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1386 + {MMP2_CLK_SDH1, "sdh1_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH1, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1387 +- {MMP2_CLK_SDH1, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1388 +- {MMP2_CLK_SDH1, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1389 ++ {MMP2_CLK_SDH2, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1390 ++ {MMP2_CLK_SDH3, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock},
1391 + {MMP2_CLK_DISP0, "disp0_clk", "disp0_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1b, 0x1b, 0x0, 0, &disp0_lock},
1392 + {MMP2_CLK_DISP0_SPHY, "disp0_sphy_clk", "disp0_sphy_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1024, 0x1024, 0x0, 0, &disp0_lock},
1393 + {MMP2_CLK_DISP1, "disp1_clk", "disp1_div", CLK_SET_RATE_PARENT, APMU_DISP1, 0x1b, 0x1b, 0x0, 0, &disp1_lock},
1394 +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
1395 +index d43cd983a7ec..063ce77df619 100644
1396 +--- a/drivers/cpufreq/cpufreq.c
1397 ++++ b/drivers/cpufreq/cpufreq.c
1398 +@@ -875,6 +875,9 @@ static ssize_t show(struct kobject *kobj, struct attribute *attr, char *buf)
1399 + struct freq_attr *fattr = to_attr(attr);
1400 + ssize_t ret;
1401 +
1402 ++ if (!fattr->show)
1403 ++ return -EIO;
1404 ++
1405 + down_read(&policy->rwsem);
1406 + ret = fattr->show(policy, buf);
1407 + up_read(&policy->rwsem);
1408 +@@ -889,6 +892,9 @@ static ssize_t store(struct kobject *kobj, struct attribute *attr,
1409 + struct freq_attr *fattr = to_attr(attr);
1410 + ssize_t ret = -EINVAL;
1411 +
1412 ++ if (!fattr->store)
1413 ++ return -EIO;
1414 ++
1415 + get_online_cpus();
1416 +
1417 + if (cpu_online(policy->cpu)) {
1418 +@@ -1646,6 +1652,9 @@ void cpufreq_resume(void)
1419 + if (!cpufreq_driver)
1420 + return;
1421 +
1422 ++ if (unlikely(!cpufreq_suspended))
1423 ++ return;
1424 ++
1425 + cpufreq_suspended = false;
1426 +
1427 + if (!has_target() && !cpufreq_driver->resume)
1428 +diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
1429 +index c46387160976..98cdfc2ee0df 100644
1430 +--- a/drivers/firmware/google/gsmi.c
1431 ++++ b/drivers/firmware/google/gsmi.c
1432 +@@ -480,11 +480,10 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
1433 + if (count < sizeof(u32))
1434 + return -EINVAL;
1435 + param.type = *(u32 *)buf;
1436 +- count -= sizeof(u32);
1437 + buf += sizeof(u32);
1438 +
1439 + /* The remaining buffer is the data payload */
1440 +- if (count > gsmi_dev.data_buf->length)
1441 ++ if ((count - sizeof(u32)) > gsmi_dev.data_buf->length)
1442 + return -EINVAL;
1443 + param.data_len = count - sizeof(u32);
1444 +
1445 +@@ -504,7 +503,7 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
1446 +
1447 + spin_unlock_irqrestore(&gsmi_dev.lock, flags);
1448 +
1449 +- return rc;
1450 ++ return (rc == 0) ? count : rc;
1451 +
1452 + }
1453 +
1454 +diff --git a/drivers/gpio/gpio-max77620.c b/drivers/gpio/gpio-max77620.c
1455 +index 4fe0be5aa294..52cac7c600ee 100644
1456 +--- a/drivers/gpio/gpio-max77620.c
1457 ++++ b/drivers/gpio/gpio-max77620.c
1458 +@@ -167,13 +167,13 @@ static int max77620_gpio_set_debounce(struct gpio_chip *gc,
1459 + case 0:
1460 + val = MAX77620_CNFG_GPIO_DBNC_None;
1461 + break;
1462 +- case 1000 ... 8000:
1463 ++ case 1 ... 8000:
1464 + val = MAX77620_CNFG_GPIO_DBNC_8ms;
1465 + break;
1466 +- case 9000 ... 16000:
1467 ++ case 8001 ... 16000:
1468 + val = MAX77620_CNFG_GPIO_DBNC_16ms;
1469 + break;
1470 +- case 17000 ... 32000:
1471 ++ case 16001 ... 32000:
1472 + val = MAX77620_CNFG_GPIO_DBNC_32ms;
1473 + break;
1474 + default:
1475 +diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c
1476 +index 592f597d8951..8261afbbafb0 100644
1477 +--- a/drivers/isdn/mISDN/tei.c
1478 ++++ b/drivers/isdn/mISDN/tei.c
1479 +@@ -1180,8 +1180,7 @@ static int
1480 + ctrl_teimanager(struct manager *mgr, void *arg)
1481 + {
1482 + /* currently we only have one option */
1483 +- int *val = (int *)arg;
1484 +- int ret = 0;
1485 ++ unsigned int *val = (unsigned int *)arg;
1486 +
1487 + switch (val[0]) {
1488 + case IMCLEAR_L2:
1489 +@@ -1197,9 +1196,9 @@ ctrl_teimanager(struct manager *mgr, void *arg)
1490 + test_and_clear_bit(OPTION_L1_HOLD, &mgr->options);
1491 + break;
1492 + default:
1493 +- ret = -EINVAL;
1494 ++ return -EINVAL;
1495 + }
1496 +- return ret;
1497 ++ return 0;
1498 + }
1499 +
1500 + /* This function does create a L2 for fixed TEI in NT Mode */
1501 +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
1502 +index ad6223e88340..3d310dd60a0b 100644
1503 +--- a/drivers/macintosh/windfarm_smu_sat.c
1504 ++++ b/drivers/macintosh/windfarm_smu_sat.c
1505 +@@ -22,14 +22,6 @@
1506 +
1507 + #define VERSION "1.0"
1508 +
1509 +-#define DEBUG
1510 +-
1511 +-#ifdef DEBUG
1512 +-#define DBG(args...) printk(args)
1513 +-#else
1514 +-#define DBG(args...) do { } while(0)
1515 +-#endif
1516 +-
1517 + /* If the cache is older than 800ms we'll refetch it */
1518 + #define MAX_AGE msecs_to_jiffies(800)
1519 +
1520 +@@ -106,13 +98,10 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
1521 + buf[i+2] = data[3];
1522 + buf[i+3] = data[2];
1523 + }
1524 +-#ifdef DEBUG
1525 +- DBG(KERN_DEBUG "sat %d partition %x:", sat_id, id);
1526 +- for (i = 0; i < len; ++i)
1527 +- DBG(" %x", buf[i]);
1528 +- DBG("\n");
1529 +-#endif
1530 +
1531 ++ printk(KERN_DEBUG "sat %d partition %x:", sat_id, id);
1532 ++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
1533 ++ 16, 1, buf, len, false);
1534 + if (size)
1535 + *size = len;
1536 + return (struct smu_sdbp_header *) buf;
1537 +@@ -132,13 +121,13 @@ static int wf_sat_read_cache(struct wf_sat *sat)
1538 + if (err < 0)
1539 + return err;
1540 + sat->last_read = jiffies;
1541 ++
1542 + #ifdef LOTSA_DEBUG
1543 + {
1544 + int i;
1545 +- DBG(KERN_DEBUG "wf_sat_get: data is");
1546 +- for (i = 0; i < 16; ++i)
1547 +- DBG(" %.2x", sat->cache[i]);
1548 +- DBG("\n");
1549 ++ printk(KERN_DEBUG "wf_sat_get: data is");
1550 ++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET,
1551 ++ 16, 1, sat->cache, 16, false);
1552 + }
1553 + #endif
1554 + return 0;
1555 +diff --git a/drivers/md/dm.c b/drivers/md/dm.c
1556 +index 2ffe7db75acb..36e6221fabab 100644
1557 +--- a/drivers/md/dm.c
1558 ++++ b/drivers/md/dm.c
1559 +@@ -1946,9 +1946,7 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
1560 + set_bit(DMF_FREEING, &md->flags);
1561 + spin_unlock(&_minor_lock);
1562 +
1563 +- spin_lock_irq(q->queue_lock);
1564 +- queue_flag_set(QUEUE_FLAG_DYING, q);
1565 +- spin_unlock_irq(q->queue_lock);
1566 ++ blk_set_queue_dying(q);
1567 +
1568 + if (dm_request_based(md) && md->kworker_task)
1569 + kthread_flush_worker(&md->kworker);
1570 +diff --git a/drivers/media/platform/vivid/vivid-kthread-cap.c b/drivers/media/platform/vivid/vivid-kthread-cap.c
1571 +index d300e5e7eadc..2ca9c928ed2f 100644
1572 +--- a/drivers/media/platform/vivid/vivid-kthread-cap.c
1573 ++++ b/drivers/media/platform/vivid/vivid-kthread-cap.c
1574 +@@ -777,7 +777,11 @@ static int vivid_thread_vid_cap(void *data)
1575 + if (kthread_should_stop())
1576 + break;
1577 +
1578 +- mutex_lock(&dev->mutex);
1579 ++ if (!mutex_trylock(&dev->mutex)) {
1580 ++ schedule_timeout_uninterruptible(1);
1581 ++ continue;
1582 ++ }
1583 ++
1584 + cur_jiffies = jiffies;
1585 + if (dev->cap_seq_resync) {
1586 + dev->jiffies_vid_cap = cur_jiffies;
1587 +@@ -930,8 +934,6 @@ void vivid_stop_generating_vid_cap(struct vivid_dev *dev, bool *pstreaming)
1588 +
1589 + /* shutdown control thread */
1590 + vivid_grab_controls(dev, false);
1591 +- mutex_unlock(&dev->mutex);
1592 + kthread_stop(dev->kthread_vid_cap);
1593 + dev->kthread_vid_cap = NULL;
1594 +- mutex_lock(&dev->mutex);
1595 + }
1596 +diff --git a/drivers/media/platform/vivid/vivid-kthread-out.c b/drivers/media/platform/vivid/vivid-kthread-out.c
1597 +index 7c8d75852816..ed5d8fb854b4 100644
1598 +--- a/drivers/media/platform/vivid/vivid-kthread-out.c
1599 ++++ b/drivers/media/platform/vivid/vivid-kthread-out.c
1600 +@@ -147,7 +147,11 @@ static int vivid_thread_vid_out(void *data)
1601 + if (kthread_should_stop())
1602 + break;
1603 +
1604 +- mutex_lock(&dev->mutex);
1605 ++ if (!mutex_trylock(&dev->mutex)) {
1606 ++ schedule_timeout_uninterruptible(1);
1607 ++ continue;
1608 ++ }
1609 ++
1610 + cur_jiffies = jiffies;
1611 + if (dev->out_seq_resync) {
1612 + dev->jiffies_vid_out = cur_jiffies;
1613 +@@ -301,8 +305,6 @@ void vivid_stop_generating_vid_out(struct vivid_dev *dev, bool *pstreaming)
1614 +
1615 + /* shutdown control thread */
1616 + vivid_grab_controls(dev, false);
1617 +- mutex_unlock(&dev->mutex);
1618 + kthread_stop(dev->kthread_vid_out);
1619 + dev->kthread_vid_out = NULL;
1620 +- mutex_lock(&dev->mutex);
1621 + }
1622 +diff --git a/drivers/media/platform/vivid/vivid-sdr-cap.c b/drivers/media/platform/vivid/vivid-sdr-cap.c
1623 +index ebd7b9c4dd83..4f49c9a47d49 100644
1624 +--- a/drivers/media/platform/vivid/vivid-sdr-cap.c
1625 ++++ b/drivers/media/platform/vivid/vivid-sdr-cap.c
1626 +@@ -149,7 +149,11 @@ static int vivid_thread_sdr_cap(void *data)
1627 + if (kthread_should_stop())
1628 + break;
1629 +
1630 +- mutex_lock(&dev->mutex);
1631 ++ if (!mutex_trylock(&dev->mutex)) {
1632 ++ schedule_timeout_uninterruptible(1);
1633 ++ continue;
1634 ++ }
1635 ++
1636 + cur_jiffies = jiffies;
1637 + if (dev->sdr_cap_seq_resync) {
1638 + dev->jiffies_sdr_cap = cur_jiffies;
1639 +@@ -309,10 +313,8 @@ static void sdr_cap_stop_streaming(struct vb2_queue *vq)
1640 + }
1641 +
1642 + /* shutdown control thread */
1643 +- mutex_unlock(&dev->mutex);
1644 + kthread_stop(dev->kthread_sdr_cap);
1645 + dev->kthread_sdr_cap = NULL;
1646 +- mutex_lock(&dev->mutex);
1647 + }
1648 +
1649 + const struct vb2_ops vivid_sdr_cap_qops = {
1650 +diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
1651 +index a72982df4777..82621260fc34 100644
1652 +--- a/drivers/media/platform/vivid/vivid-vid-cap.c
1653 ++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
1654 +@@ -236,9 +236,6 @@ static int vid_cap_start_streaming(struct vb2_queue *vq, unsigned count)
1655 + if (vb2_is_streaming(&dev->vb_vid_out_q))
1656 + dev->can_loop_video = vivid_vid_can_loop(dev);
1657 +
1658 +- if (dev->kthread_vid_cap)
1659 +- return 0;
1660 +-
1661 + dev->vid_cap_seq_count = 0;
1662 + dprintk(dev, 1, "%s\n", __func__);
1663 + for (i = 0; i < VIDEO_MAX_FRAME; i++)
1664 +diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
1665 +index dd609eea4753..8fed2fbe91a9 100644
1666 +--- a/drivers/media/platform/vivid/vivid-vid-out.c
1667 ++++ b/drivers/media/platform/vivid/vivid-vid-out.c
1668 +@@ -158,9 +158,6 @@ static int vid_out_start_streaming(struct vb2_queue *vq, unsigned count)
1669 + if (vb2_is_streaming(&dev->vb_vid_cap_q))
1670 + dev->can_loop_video = vivid_vid_can_loop(dev);
1671 +
1672 +- if (dev->kthread_vid_out)
1673 +- return 0;
1674 +-
1675 + dev->vid_out_seq_count = 0;
1676 + dprintk(dev, 1, "%s\n", __func__);
1677 + if (dev->start_streaming_error) {
1678 +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
1679 +index f072bf28fccd..0b386fd518cc 100644
1680 +--- a/drivers/media/rc/imon.c
1681 ++++ b/drivers/media/rc/imon.c
1682 +@@ -1644,8 +1644,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
1683 + spin_unlock_irqrestore(&ictx->kc_lock, flags);
1684 +
1685 + /* send touchscreen events through input subsystem if touchpad data */
1686 +- if (ictx->display_type == IMON_DISPLAY_TYPE_VGA && len == 8 &&
1687 +- buf[7] == 0x86) {
1688 ++ if (ictx->touch && len == 8 && buf[7] == 0x86) {
1689 + imon_touch_event(ictx, buf);
1690 + return;
1691 +
1692 +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
1693 +index 52bc42da8a4c..1fc3c8d7dd9b 100644
1694 +--- a/drivers/media/usb/b2c2/flexcop-usb.c
1695 ++++ b/drivers/media/usb/b2c2/flexcop-usb.c
1696 +@@ -538,6 +538,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
1697 + struct flexcop_device *fc = NULL;
1698 + int ret;
1699 +
1700 ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
1701 ++ return -ENODEV;
1702 ++
1703 + if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
1704 + err("out of memory\n");
1705 + return -ENOMEM;
1706 +diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
1707 +index b20f03d86e00..2b7a1b569db0 100644
1708 +--- a/drivers/media/usb/dvb-usb/cxusb.c
1709 ++++ b/drivers/media/usb/dvb-usb/cxusb.c
1710 +@@ -437,7 +437,8 @@ static int cxusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
1711 + u8 ircode[4];
1712 + int i;
1713 +
1714 +- cxusb_ctrl_msg(d, CMD_GET_IR_CODE, NULL, 0, ircode, 4);
1715 ++ if (cxusb_ctrl_msg(d, CMD_GET_IR_CODE, NULL, 0, ircode, 4) < 0)
1716 ++ return 0;
1717 +
1718 + *event = 0;
1719 + *state = REMOTE_NO_KEY_PRESSED;
1720 +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
1721 +index bfdf72355332..230f50aa3000 100644
1722 +--- a/drivers/media/usb/usbvision/usbvision-video.c
1723 ++++ b/drivers/media/usb/usbvision/usbvision-video.c
1724 +@@ -332,6 +332,10 @@ static int usbvision_v4l2_open(struct file *file)
1725 + if (mutex_lock_interruptible(&usbvision->v4l2_lock))
1726 + return -ERESTARTSYS;
1727 +
1728 ++ if (usbvision->remove_pending) {
1729 ++ err_code = -ENODEV;
1730 ++ goto unlock;
1731 ++ }
1732 + if (usbvision->user) {
1733 + err_code = -EBUSY;
1734 + } else {
1735 +@@ -395,6 +399,7 @@ unlock:
1736 + static int usbvision_v4l2_close(struct file *file)
1737 + {
1738 + struct usb_usbvision *usbvision = video_drvdata(file);
1739 ++ int r;
1740 +
1741 + PDEBUG(DBG_IO, "close");
1742 +
1743 +@@ -409,9 +414,10 @@ static int usbvision_v4l2_close(struct file *file)
1744 + usbvision_scratch_free(usbvision);
1745 +
1746 + usbvision->user--;
1747 ++ r = usbvision->remove_pending;
1748 + mutex_unlock(&usbvision->v4l2_lock);
1749 +
1750 +- if (usbvision->remove_pending) {
1751 ++ if (r) {
1752 + printk(KERN_INFO "%s: Final disconnect\n", __func__);
1753 + usbvision_release(usbvision);
1754 + return 0;
1755 +@@ -1095,6 +1101,11 @@ static int usbvision_radio_open(struct file *file)
1756 +
1757 + if (mutex_lock_interruptible(&usbvision->v4l2_lock))
1758 + return -ERESTARTSYS;
1759 ++
1760 ++ if (usbvision->remove_pending) {
1761 ++ err_code = -ENODEV;
1762 ++ goto out;
1763 ++ }
1764 + err_code = v4l2_fh_open(file);
1765 + if (err_code)
1766 + goto out;
1767 +@@ -1127,6 +1138,7 @@ out:
1768 + static int usbvision_radio_close(struct file *file)
1769 + {
1770 + struct usb_usbvision *usbvision = video_drvdata(file);
1771 ++ int r;
1772 +
1773 + PDEBUG(DBG_IO, "");
1774 +
1775 +@@ -1139,9 +1151,10 @@ static int usbvision_radio_close(struct file *file)
1776 + usbvision_audio_off(usbvision);
1777 + usbvision->radio = 0;
1778 + usbvision->user--;
1779 ++ r = usbvision->remove_pending;
1780 + mutex_unlock(&usbvision->v4l2_lock);
1781 +
1782 +- if (usbvision->remove_pending) {
1783 ++ if (r) {
1784 + printk(KERN_INFO "%s: Final disconnect\n", __func__);
1785 + v4l2_fh_release(file);
1786 + usbvision_release(usbvision);
1787 +@@ -1568,6 +1581,7 @@ err_usb:
1788 + static void usbvision_disconnect(struct usb_interface *intf)
1789 + {
1790 + struct usb_usbvision *usbvision = to_usbvision(usb_get_intfdata(intf));
1791 ++ int u;
1792 +
1793 + PDEBUG(DBG_PROBE, "");
1794 +
1795 +@@ -1584,13 +1598,14 @@ static void usbvision_disconnect(struct usb_interface *intf)
1796 + v4l2_device_disconnect(&usbvision->v4l2_dev);
1797 + usbvision_i2c_unregister(usbvision);
1798 + usbvision->remove_pending = 1; /* Now all ISO data will be ignored */
1799 ++ u = usbvision->user;
1800 +
1801 + usb_put_dev(usbvision->dev);
1802 + usbvision->dev = NULL; /* USB device is no more */
1803 +
1804 + mutex_unlock(&usbvision->v4l2_lock);
1805 +
1806 +- if (usbvision->user) {
1807 ++ if (u) {
1808 + printk(KERN_INFO "%s: In use, disconnect pending\n",
1809 + __func__);
1810 + wake_up_interruptible(&usbvision->wait_frame);
1811 +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
1812 +index a905d79381da..7c375b6dd318 100644
1813 +--- a/drivers/media/usb/uvc/uvc_driver.c
1814 ++++ b/drivers/media/usb/uvc/uvc_driver.c
1815 +@@ -2021,6 +2021,21 @@ static int uvc_probe(struct usb_interface *intf,
1816 + le16_to_cpu(udev->descriptor.idVendor),
1817 + le16_to_cpu(udev->descriptor.idProduct));
1818 +
1819 ++ /* Initialize the media device. */
1820 ++#ifdef CONFIG_MEDIA_CONTROLLER
1821 ++ dev->mdev.dev = &intf->dev;
1822 ++ strscpy(dev->mdev.model, dev->name, sizeof(dev->mdev.model));
1823 ++ if (udev->serial)
1824 ++ strscpy(dev->mdev.serial, udev->serial,
1825 ++ sizeof(dev->mdev.serial));
1826 ++ usb_make_path(udev, dev->mdev.bus_info, sizeof(dev->mdev.bus_info));
1827 ++ dev->mdev.hw_revision = le16_to_cpu(udev->descriptor.bcdDevice);
1828 ++ dev->mdev.driver_version = LINUX_VERSION_CODE;
1829 ++ media_device_init(&dev->mdev);
1830 ++
1831 ++ dev->vdev.mdev = &dev->mdev;
1832 ++#endif
1833 ++
1834 + /* Parse the Video Class control descriptor. */
1835 + if (uvc_parse_control(dev) < 0) {
1836 + uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC "
1837 +@@ -2041,20 +2056,7 @@ static int uvc_probe(struct usb_interface *intf,
1838 + "linux-uvc-devel mailing list.\n");
1839 + }
1840 +
1841 +- /* Initialize the media device and register the V4L2 device. */
1842 +-#ifdef CONFIG_MEDIA_CONTROLLER
1843 +- dev->mdev.dev = &intf->dev;
1844 +- strlcpy(dev->mdev.model, dev->name, sizeof(dev->mdev.model));
1845 +- if (udev->serial)
1846 +- strlcpy(dev->mdev.serial, udev->serial,
1847 +- sizeof(dev->mdev.serial));
1848 +- strcpy(dev->mdev.bus_info, udev->devpath);
1849 +- dev->mdev.hw_revision = le16_to_cpu(udev->descriptor.bcdDevice);
1850 +- dev->mdev.driver_version = LINUX_VERSION_CODE;
1851 +- media_device_init(&dev->mdev);
1852 +-
1853 +- dev->vdev.mdev = &dev->mdev;
1854 +-#endif
1855 ++ /* Register the V4L2 device. */
1856 + if (v4l2_device_register(&intf->dev, &dev->vdev) < 0)
1857 + goto error;
1858 +
1859 +diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
1860 +index 0556a9749dbe..1f0c2b594654 100644
1861 +--- a/drivers/mfd/arizona-core.c
1862 ++++ b/drivers/mfd/arizona-core.c
1863 +@@ -52,8 +52,10 @@ int arizona_clk32k_enable(struct arizona *arizona)
1864 + if (ret != 0)
1865 + goto err_ref;
1866 + ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK1]);
1867 +- if (ret != 0)
1868 +- goto err_pm;
1869 ++ if (ret != 0) {
1870 ++ pm_runtime_put_sync(arizona->dev);
1871 ++ goto err_ref;
1872 ++ }
1873 + break;
1874 + case ARIZONA_32KZ_MCLK2:
1875 + ret = clk_prepare_enable(arizona->mclk[ARIZONA_MCLK2]);
1876 +@@ -67,8 +69,6 @@ int arizona_clk32k_enable(struct arizona *arizona)
1877 + ARIZONA_CLK_32K_ENA);
1878 + }
1879 +
1880 +-err_pm:
1881 +- pm_runtime_put_sync(arizona->dev);
1882 + err_ref:
1883 + if (ret != 0)
1884 + arizona->clk32k_ref--;
1885 +diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
1886 +index 2d6e2c392786..4a2fc59d5901 100644
1887 +--- a/drivers/mfd/max8997.c
1888 ++++ b/drivers/mfd/max8997.c
1889 +@@ -155,12 +155,6 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata(
1890 +
1891 + pd->ono = irq_of_parse_and_map(dev->of_node, 1);
1892 +
1893 +- /*
1894 +- * ToDo: the 'wakeup' member in the platform data is more of a linux
1895 +- * specfic information. Hence, there is no binding for that yet and
1896 +- * not parsed here.
1897 +- */
1898 +-
1899 + return pd;
1900 + }
1901 +
1902 +@@ -248,7 +242,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
1903 + */
1904 +
1905 + /* MAX8997 has a power button input. */
1906 +- device_init_wakeup(max8997->dev, pdata->wakeup);
1907 ++ device_init_wakeup(max8997->dev, true);
1908 +
1909 + return ret;
1910 +
1911 +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
1912 +index 6c16f170529f..75d52034f89d 100644
1913 +--- a/drivers/mfd/mc13xxx-core.c
1914 ++++ b/drivers/mfd/mc13xxx-core.c
1915 +@@ -278,7 +278,8 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
1916 + if (ret)
1917 + goto out;
1918 +
1919 +- adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
1920 ++ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 |
1921 ++ MC13XXX_ADC0_CHRGRAWDIV;
1922 + adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
1923 +
1924 + if (channel > 7)
1925 +diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
1926 +index cac3bcc308a7..7bb929f05d85 100644
1927 +--- a/drivers/misc/mic/scif/scif_fence.c
1928 ++++ b/drivers/misc/mic/scif/scif_fence.c
1929 +@@ -272,7 +272,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
1930 + dma_fail:
1931 + if (!x100)
1932 + dma_pool_free(ep->remote_dev->signal_pool, status,
1933 +- status->src_dma_addr);
1934 ++ src - offsetof(struct scif_status, val));
1935 + alloc_fail:
1936 + return err;
1937 + }
1938 +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
1939 +index 6f9535e5e584..7fc6ce381142 100644
1940 +--- a/drivers/mmc/host/mtk-sd.c
1941 ++++ b/drivers/mmc/host/mtk-sd.c
1942 +@@ -870,6 +870,7 @@ static void msdc_start_command(struct msdc_host *host,
1943 + WARN_ON(host->cmd);
1944 + host->cmd = cmd;
1945 +
1946 ++ mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
1947 + if (!msdc_cmd_is_ready(host, mrq, cmd))
1948 + return;
1949 +
1950 +@@ -881,7 +882,6 @@ static void msdc_start_command(struct msdc_host *host,
1951 +
1952 + cmd->error = 0;
1953 + rawcmd = msdc_cmd_prepare_raw_cmd(host, mrq, cmd);
1954 +- mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT);
1955 +
1956 + sdr_set_bits(host->base + MSDC_INTEN, cmd_ints_mask);
1957 + writel(cmd->arg, host->base + SDC_ARG);
1958 +diff --git a/drivers/net/ethernet/amazon/Kconfig b/drivers/net/ethernet/amazon/Kconfig
1959 +index 99b30353541a..9e87d7b8360f 100644
1960 +--- a/drivers/net/ethernet/amazon/Kconfig
1961 ++++ b/drivers/net/ethernet/amazon/Kconfig
1962 +@@ -17,7 +17,7 @@ if NET_VENDOR_AMAZON
1963 +
1964 + config ENA_ETHERNET
1965 + tristate "Elastic Network Adapter (ENA) support"
1966 +- depends on (PCI_MSI && X86)
1967 ++ depends on PCI_MSI && !CPU_BIG_ENDIAN
1968 + ---help---
1969 + This driver supports Elastic Network Adapter (ENA)"
1970 +
1971 +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
1972 +index 4a4782b3cc1b..a23404480597 100644
1973 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
1974 ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
1975 +@@ -1078,7 +1078,7 @@ static int bcmgenet_power_down(struct bcmgenet_priv *priv,
1976 + break;
1977 + }
1978 +
1979 +- return 0;
1980 ++ return ret;
1981 + }
1982 +
1983 + static void bcmgenet_power_up(struct bcmgenet_priv *priv,
1984 +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
1985 +index 9eb9b68f8935..ae1f963b6092 100644
1986 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
1987 ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
1988 +@@ -65,9 +65,15 @@
1989 + *
1990 + * The 40 bit 82580 SYSTIM overflows every
1991 + * 2^40 * 10^-9 / 60 = 18.3 minutes.
1992 ++ *
1993 ++ * SYSTIM is converted to real time using a timecounter. As
1994 ++ * timecounter_cyc2time() allows old timestamps, the timecounter
1995 ++ * needs to be updated at least once per half of the SYSTIM interval.
1996 ++ * Scheduling of delayed work is not very accurate, so we aim for 8
1997 ++ * minutes to be sure the actual interval is shorter than 9.16 minutes.
1998 + */
1999 +
2000 +-#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 9)
2001 ++#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 8)
2002 + #define IGB_PTP_TX_TIMEOUT (HZ * 15)
2003 + #define INCPERIOD_82576 BIT(E1000_TIMINCA_16NS_SHIFT)
2004 + #define INCVALUE_82576_MASK GENMASK(E1000_TIMINCA_16NS_SHIFT - 1, 0)
2005 +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
2006 +index 74d2db505866..6068e7c4fc7e 100644
2007 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
2008 ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
2009 +@@ -1679,6 +1679,7 @@ static int mlx4_en_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
2010 + err = mlx4_en_get_flow(dev, cmd, cmd->fs.location);
2011 + break;
2012 + case ETHTOOL_GRXCLSRLALL:
2013 ++ cmd->data = MAX_NUM_OF_FS_RULES;
2014 + while ((!err || err == -ENOENT) && priority < cmd->rule_cnt) {
2015 + err = mlx4_en_get_flow(dev, cmd, i);
2016 + if (!err)
2017 +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
2018 +index d1a3a35ba87b..a10f042df01f 100644
2019 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
2020 ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
2021 +@@ -1757,7 +1757,7 @@ int mlx5_eswitch_set_vport_state(struct mlx5_eswitch *esw,
2022 +
2023 + unlock:
2024 + mutex_unlock(&esw->state_lock);
2025 +- return 0;
2026 ++ return err;
2027 + }
2028 +
2029 + int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
2030 +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
2031 +index 4b76c69fe86d..834208e55f7b 100644
2032 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
2033 ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
2034 +@@ -883,7 +883,7 @@ static u8 qlcnic_dcb_get_capability(struct net_device *netdev, int capid,
2035 + struct qlcnic_adapter *adapter = netdev_priv(netdev);
2036 +
2037 + if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
2038 +- return 0;
2039 ++ return 1;
2040 +
2041 + switch (capid) {
2042 + case DCB_CAP_ATTR_PG:
2043 +diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
2044 +index 77a5364f7a10..04cbff7f1b23 100644
2045 +--- a/drivers/net/ethernet/sfc/ptp.c
2046 ++++ b/drivers/net/ethernet/sfc/ptp.c
2047 +@@ -1320,7 +1320,8 @@ void efx_ptp_remove(struct efx_nic *efx)
2048 + (void)efx_ptp_disable(efx);
2049 +
2050 + cancel_work_sync(&efx->ptp_data->work);
2051 +- cancel_work_sync(&efx->ptp_data->pps_work);
2052 ++ if (efx->ptp_data->pps_workwq)
2053 ++ cancel_work_sync(&efx->ptp_data->pps_work);
2054 +
2055 + skb_queue_purge(&efx->ptp_data->rxq);
2056 + skb_queue_purge(&efx->ptp_data->txq);
2057 +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
2058 +index d7cb205fe7e2..892b06852e15 100644
2059 +--- a/drivers/net/ethernet/ti/cpsw.c
2060 ++++ b/drivers/net/ethernet/ti/cpsw.c
2061 +@@ -590,6 +590,7 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
2062 +
2063 + /* Clear all mcast from ALE */
2064 + cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1);
2065 ++ __dev_mc_unsync(ndev, NULL);
2066 +
2067 + /* Flood All Unicast Packets to Host port */
2068 + cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
2069 +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
2070 +index da10104be16c..a48ed0873cc7 100644
2071 +--- a/drivers/net/macsec.c
2072 ++++ b/drivers/net/macsec.c
2073 +@@ -2798,9 +2798,6 @@ static int macsec_dev_open(struct net_device *dev)
2074 + struct net_device *real_dev = macsec->real_dev;
2075 + int err;
2076 +
2077 +- if (!(real_dev->flags & IFF_UP))
2078 +- return -ENETDOWN;
2079 +-
2080 + err = dev_uc_add(real_dev, dev->dev_addr);
2081 + if (err < 0)
2082 + return err;
2083 +@@ -3275,6 +3272,9 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
2084 + if (err < 0)
2085 + goto del_dev;
2086 +
2087 ++ netif_stacked_transfer_operstate(real_dev, dev);
2088 ++ linkwatch_fire_event(dev);
2089 ++
2090 + macsec_generation++;
2091 +
2092 + return 0;
2093 +@@ -3446,6 +3446,20 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
2094 + return NOTIFY_DONE;
2095 +
2096 + switch (event) {
2097 ++ case NETDEV_DOWN:
2098 ++ case NETDEV_UP:
2099 ++ case NETDEV_CHANGE: {
2100 ++ struct macsec_dev *m, *n;
2101 ++ struct macsec_rxh_data *rxd;
2102 ++
2103 ++ rxd = macsec_data_rtnl(real_dev);
2104 ++ list_for_each_entry_safe(m, n, &rxd->secys, secys) {
2105 ++ struct net_device *dev = m->secy.netdev;
2106 ++
2107 ++ netif_stacked_transfer_operstate(real_dev, dev);
2108 ++ }
2109 ++ break;
2110 ++ }
2111 + case NETDEV_UNREGISTER: {
2112 + struct macsec_dev *m, *n;
2113 + struct macsec_rxh_data *rxd;
2114 +diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
2115 +index a9acf7156855..03009f1becdd 100644
2116 +--- a/drivers/net/ntb_netdev.c
2117 ++++ b/drivers/net/ntb_netdev.c
2118 +@@ -236,7 +236,7 @@ static void ntb_netdev_tx_timer(unsigned long data)
2119 + struct ntb_netdev *dev = netdev_priv(ndev);
2120 +
2121 + if (ntb_transport_tx_free_entry(dev->qp) < tx_stop) {
2122 +- mod_timer(&dev->tx_timer, jiffies + msecs_to_jiffies(tx_time));
2123 ++ mod_timer(&dev->tx_timer, jiffies + usecs_to_jiffies(tx_time));
2124 + } else {
2125 + /* Make sure anybody stopping the queue after this sees the new
2126 + * value of ntb_transport_tx_free_entry()
2127 +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
2128 +index b7bac14d1487..d84a362a084a 100644
2129 +--- a/drivers/net/wireless/ath/ath10k/pci.c
2130 ++++ b/drivers/net/wireless/ath/ath10k/pci.c
2131 +@@ -1039,10 +1039,9 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2132 + struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
2133 + int ret = 0;
2134 + u32 *buf;
2135 +- unsigned int completed_nbytes, orig_nbytes, remaining_bytes;
2136 ++ unsigned int completed_nbytes, alloc_nbytes, remaining_bytes;
2137 + struct ath10k_ce_pipe *ce_diag;
2138 + void *data_buf = NULL;
2139 +- u32 ce_data; /* Host buffer address in CE space */
2140 + dma_addr_t ce_data_base = 0;
2141 + int i;
2142 +
2143 +@@ -1056,9 +1055,10 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2144 + * 1) 4-byte alignment
2145 + * 2) Buffer in DMA-able space
2146 + */
2147 +- orig_nbytes = nbytes;
2148 ++ alloc_nbytes = min_t(unsigned int, nbytes, DIAG_TRANSFER_LIMIT);
2149 ++
2150 + data_buf = (unsigned char *)dma_alloc_coherent(ar->dev,
2151 +- orig_nbytes,
2152 ++ alloc_nbytes,
2153 + &ce_data_base,
2154 + GFP_ATOMIC);
2155 + if (!data_buf) {
2156 +@@ -1066,9 +1066,6 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2157 + goto done;
2158 + }
2159 +
2160 +- /* Copy caller's data to allocated DMA buf */
2161 +- memcpy(data_buf, data, orig_nbytes);
2162 +-
2163 + /*
2164 + * The address supplied by the caller is in the
2165 + * Target CPU virtual address space.
2166 +@@ -1081,12 +1078,14 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2167 + */
2168 + address = ath10k_pci_targ_cpu_to_ce_addr(ar, address);
2169 +
2170 +- remaining_bytes = orig_nbytes;
2171 +- ce_data = ce_data_base;
2172 ++ remaining_bytes = nbytes;
2173 + while (remaining_bytes) {
2174 + /* FIXME: check cast */
2175 + nbytes = min_t(int, remaining_bytes, DIAG_TRANSFER_LIMIT);
2176 +
2177 ++ /* Copy caller's data to allocated DMA buf */
2178 ++ memcpy(data_buf, data, nbytes);
2179 ++
2180 + /* Set up to receive directly into Target(!) address */
2181 + ret = __ath10k_ce_rx_post_buf(ce_diag, &address, address);
2182 + if (ret != 0)
2183 +@@ -1096,7 +1095,7 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2184 + * Request CE to send caller-supplied data that
2185 + * was copied to bounce buffer to Target(!) address.
2186 + */
2187 +- ret = ath10k_ce_send_nolock(ce_diag, NULL, (u32)ce_data,
2188 ++ ret = ath10k_ce_send_nolock(ce_diag, NULL, ce_data_base,
2189 + nbytes, 0, 0);
2190 + if (ret != 0)
2191 + goto done;
2192 +@@ -1137,12 +1136,12 @@ int ath10k_pci_diag_write_mem(struct ath10k *ar, u32 address,
2193 +
2194 + remaining_bytes -= nbytes;
2195 + address += nbytes;
2196 +- ce_data += nbytes;
2197 ++ data += nbytes;
2198 + }
2199 +
2200 + done:
2201 + if (data_buf) {
2202 +- dma_free_coherent(ar->dev, orig_nbytes, data_buf,
2203 ++ dma_free_coherent(ar->dev, alloc_nbytes, data_buf,
2204 + ce_data_base);
2205 + }
2206 +
2207 +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2208 +index 08607d7fdb56..7eff6f8023d8 100644
2209 +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2210 ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
2211 +@@ -4115,7 +4115,7 @@ static void ar9003_hw_thermometer_apply(struct ath_hw *ah)
2212 +
2213 + static void ar9003_hw_thermo_cal_apply(struct ath_hw *ah)
2214 + {
2215 +- u32 data, ko, kg;
2216 ++ u32 data = 0, ko, kg;
2217 +
2218 + if (!AR_SREV_9462_20_OR_LATER(ah))
2219 + return;
2220 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
2221 +index 7c2a9a9bc372..b820e80d4b4c 100644
2222 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
2223 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c
2224 +@@ -502,6 +502,7 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2225 + }
2226 +
2227 + spin_lock_bh(&wl->lock);
2228 ++ wl->wlc->vif = vif;
2229 + wl->mute_tx = false;
2230 + brcms_c_mute(wl->wlc, false);
2231 + if (vif->type == NL80211_IFTYPE_STATION)
2232 +@@ -519,6 +520,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2233 + static void
2234 + brcms_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2235 + {
2236 ++ struct brcms_info *wl = hw->priv;
2237 ++
2238 ++ spin_lock_bh(&wl->lock);
2239 ++ wl->wlc->vif = NULL;
2240 ++ spin_unlock_bh(&wl->lock);
2241 + }
2242 +
2243 + static int brcms_ops_config(struct ieee80211_hw *hw, u32 changed)
2244 +@@ -840,8 +846,8 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw,
2245 + status = brcms_c_aggregatable(wl->wlc, tid);
2246 + spin_unlock_bh(&wl->lock);
2247 + if (!status) {
2248 +- brcms_err(wl->wlc->hw->d11core,
2249 +- "START: tid %d is not agg\'able\n", tid);
2250 ++ brcms_dbg_ht(wl->wlc->hw->d11core,
2251 ++ "START: tid %d is not agg\'able\n", tid);
2252 + return -EINVAL;
2253 + }
2254 + ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
2255 +@@ -937,6 +943,25 @@ static void brcms_ops_set_tsf(struct ieee80211_hw *hw,
2256 + spin_unlock_bh(&wl->lock);
2257 + }
2258 +
2259 ++static int brcms_ops_beacon_set_tim(struct ieee80211_hw *hw,
2260 ++ struct ieee80211_sta *sta, bool set)
2261 ++{
2262 ++ struct brcms_info *wl = hw->priv;
2263 ++ struct sk_buff *beacon = NULL;
2264 ++ u16 tim_offset = 0;
2265 ++
2266 ++ spin_lock_bh(&wl->lock);
2267 ++ if (wl->wlc->vif)
2268 ++ beacon = ieee80211_beacon_get_tim(hw, wl->wlc->vif,
2269 ++ &tim_offset, NULL);
2270 ++ if (beacon)
2271 ++ brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset,
2272 ++ wl->wlc->vif->bss_conf.dtim_period);
2273 ++ spin_unlock_bh(&wl->lock);
2274 ++
2275 ++ return 0;
2276 ++}
2277 ++
2278 + static const struct ieee80211_ops brcms_ops = {
2279 + .tx = brcms_ops_tx,
2280 + .start = brcms_ops_start,
2281 +@@ -955,6 +980,7 @@ static const struct ieee80211_ops brcms_ops = {
2282 + .flush = brcms_ops_flush,
2283 + .get_tsf = brcms_ops_get_tsf,
2284 + .set_tsf = brcms_ops_set_tsf,
2285 ++ .set_tim = brcms_ops_beacon_set_tim,
2286 + };
2287 +
2288 + void brcms_dpc(unsigned long data)
2289 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
2290 +index c4d135cff04a..9f76b880814e 100644
2291 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
2292 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/main.h
2293 +@@ -563,6 +563,7 @@ struct brcms_c_info {
2294 +
2295 + struct wiphy *wiphy;
2296 + struct scb pri_scb;
2297 ++ struct ieee80211_vif *vif;
2298 +
2299 + struct sk_buff *beacon;
2300 + u16 beacon_tim_offset;
2301 +diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
2302 +index 69b826d229c5..04939e576ee0 100644
2303 +--- a/drivers/net/wireless/cisco/airo.c
2304 ++++ b/drivers/net/wireless/cisco/airo.c
2305 +@@ -5472,7 +5472,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
2306 + we have to add a spin lock... */
2307 + rc = readBSSListRid(ai, doLoseSync, &BSSList_rid);
2308 + while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) {
2309 +- ptr += sprintf(ptr, "%pM %*s rssi = %d",
2310 ++ ptr += sprintf(ptr, "%pM %.*s rssi = %d",
2311 + BSSList_rid.bssid,
2312 + (int)BSSList_rid.ssidLen,
2313 + BSSList_rid.ssid,
2314 +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
2315 +index 46d0099fd6e8..94901b0041ce 100644
2316 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
2317 ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
2318 +@@ -364,11 +364,20 @@ mwifiex_cfg80211_set_tx_power(struct wiphy *wiphy,
2319 + struct mwifiex_power_cfg power_cfg;
2320 + int dbm = MBM_TO_DBM(mbm);
2321 +
2322 +- if (type == NL80211_TX_POWER_FIXED) {
2323 ++ switch (type) {
2324 ++ case NL80211_TX_POWER_FIXED:
2325 + power_cfg.is_power_auto = 0;
2326 ++ power_cfg.is_power_fixed = 1;
2327 + power_cfg.power_level = dbm;
2328 +- } else {
2329 ++ break;
2330 ++ case NL80211_TX_POWER_LIMITED:
2331 ++ power_cfg.is_power_auto = 0;
2332 ++ power_cfg.is_power_fixed = 0;
2333 ++ power_cfg.power_level = dbm;
2334 ++ break;
2335 ++ case NL80211_TX_POWER_AUTOMATIC:
2336 + power_cfg.is_power_auto = 1;
2337 ++ break;
2338 + }
2339 +
2340 + priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
2341 +diff --git a/drivers/net/wireless/marvell/mwifiex/ioctl.h b/drivers/net/wireless/marvell/mwifiex/ioctl.h
2342 +index 536ab834b126..729a69f88a48 100644
2343 +--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
2344 ++++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h
2345 +@@ -265,6 +265,7 @@ struct mwifiex_ds_encrypt_key {
2346 +
2347 + struct mwifiex_power_cfg {
2348 + u32 is_power_auto;
2349 ++ u32 is_power_fixed;
2350 + u32 power_level;
2351 + };
2352 +
2353 +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
2354 +index 7f9645703d96..478885afb6c6 100644
2355 +--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
2356 ++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
2357 +@@ -728,6 +728,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
2358 + txp_cfg = (struct host_cmd_ds_txpwr_cfg *) buf;
2359 + txp_cfg->action = cpu_to_le16(HostCmd_ACT_GEN_SET);
2360 + if (!power_cfg->is_power_auto) {
2361 ++ u16 dbm_min = power_cfg->is_power_fixed ?
2362 ++ dbm : priv->min_tx_power_level;
2363 ++
2364 + txp_cfg->mode = cpu_to_le32(1);
2365 + pg_tlv = (struct mwifiex_types_power_group *)
2366 + (buf + sizeof(struct host_cmd_ds_txpwr_cfg));
2367 +@@ -742,7 +745,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
2368 + pg->last_rate_code = 0x03;
2369 + pg->modulation_class = MOD_CLASS_HR_DSSS;
2370 + pg->power_step = 0;
2371 +- pg->power_min = (s8) dbm;
2372 ++ pg->power_min = (s8) dbm_min;
2373 + pg->power_max = (s8) dbm;
2374 + pg++;
2375 + /* Power group for modulation class OFDM */
2376 +@@ -750,7 +753,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
2377 + pg->last_rate_code = 0x07;
2378 + pg->modulation_class = MOD_CLASS_OFDM;
2379 + pg->power_step = 0;
2380 +- pg->power_min = (s8) dbm;
2381 ++ pg->power_min = (s8) dbm_min;
2382 + pg->power_max = (s8) dbm;
2383 + pg++;
2384 + /* Power group for modulation class HTBW20 */
2385 +@@ -758,7 +761,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
2386 + pg->last_rate_code = 0x20;
2387 + pg->modulation_class = MOD_CLASS_HT;
2388 + pg->power_step = 0;
2389 +- pg->power_min = (s8) dbm;
2390 ++ pg->power_min = (s8) dbm_min;
2391 + pg->power_max = (s8) dbm;
2392 + pg->ht_bandwidth = HT_BW_20;
2393 + pg++;
2394 +@@ -767,7 +770,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv,
2395 + pg->last_rate_code = 0x20;
2396 + pg->modulation_class = MOD_CLASS_HT;
2397 + pg->power_step = 0;
2398 +- pg->power_min = (s8) dbm;
2399 ++ pg->power_min = (s8) dbm_min;
2400 + pg->power_max = (s8) dbm;
2401 + pg->ht_bandwidth = HT_BW_40;
2402 + }
2403 +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2404 +index 4e725d165aa6..e78545d4add3 100644
2405 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2406 ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
2407 +@@ -5660,6 +5660,7 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
2408 + break;
2409 + case WLAN_CIPHER_SUITE_TKIP:
2410 + key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
2411 ++ break;
2412 + default:
2413 + return -EOPNOTSUPP;
2414 + }
2415 +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
2416 +index 8de29cc3ced0..a24644f34e65 100644
2417 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
2418 ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c
2419 +@@ -234,7 +234,7 @@ static int _rtl92d_fw_init(struct ieee80211_hw *hw)
2420 + rtl_read_byte(rtlpriv, FW_MAC1_READY));
2421 + }
2422 + RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG,
2423 +- "Polling FW ready fail!! REG_MCUFWDL:0x%08ul\n",
2424 ++ "Polling FW ready fail!! REG_MCUFWDL:0x%08x\n",
2425 + rtl_read_dword(rtlpriv, REG_MCUFWDL));
2426 + return -1;
2427 + }
2428 +diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
2429 +index fd4e9ba176c9..332a3a5c1c90 100644
2430 +--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
2431 ++++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
2432 +@@ -66,7 +66,7 @@ wlcore_vendor_cmd_smart_config_start(struct wiphy *wiphy,
2433 + out:
2434 + mutex_unlock(&wl->mutex);
2435 +
2436 +- return 0;
2437 ++ return ret;
2438 + }
2439 +
2440 + static int
2441 +diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
2442 +index 073e4a478c89..3cd995de1bbb 100644
2443 +--- a/drivers/nfc/port100.c
2444 ++++ b/drivers/nfc/port100.c
2445 +@@ -791,7 +791,7 @@ static int port100_send_frame_async(struct port100 *dev, struct sk_buff *out,
2446 +
2447 + rc = port100_submit_urb_for_ack(dev, GFP_KERNEL);
2448 + if (rc)
2449 +- usb_unlink_urb(dev->out_urb);
2450 ++ usb_kill_urb(dev->out_urb);
2451 +
2452 + exit:
2453 + mutex_unlock(&dev->out_urb_lock);
2454 +diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c
2455 +index 7310a261c858..e175cbeba266 100644
2456 +--- a/drivers/ntb/hw/intel/ntb_hw_intel.c
2457 ++++ b/drivers/ntb/hw/intel/ntb_hw_intel.c
2458 +@@ -330,7 +330,7 @@ static inline int ndev_db_clear_mask(struct intel_ntb_dev *ndev, u64 db_bits,
2459 + return 0;
2460 + }
2461 +
2462 +-static inline int ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
2463 ++static inline u64 ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector)
2464 + {
2465 + u64 shift, mask;
2466 +
2467 +diff --git a/drivers/pci/host/pci-keystone.c b/drivers/pci/host/pci-keystone.c
2468 +index eac0a1238e9d..c690299d5c4a 100644
2469 +--- a/drivers/pci/host/pci-keystone.c
2470 ++++ b/drivers/pci/host/pci-keystone.c
2471 +@@ -43,6 +43,7 @@
2472 + #define PCIE_RC_K2HK 0xb008
2473 + #define PCIE_RC_K2E 0xb009
2474 + #define PCIE_RC_K2L 0xb00a
2475 ++#define PCIE_RC_K2G 0xb00b
2476 +
2477 + #define to_keystone_pcie(x) container_of(x, struct keystone_pcie, pp)
2478 +
2479 +@@ -57,6 +58,8 @@ static void quirk_limit_mrrs(struct pci_dev *dev)
2480 + .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
2481 + { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2L),
2482 + .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
2483 ++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2G),
2484 ++ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, },
2485 + { 0, },
2486 + };
2487 +
2488 +diff --git a/drivers/pinctrl/pinctrl-lpc18xx.c b/drivers/pinctrl/pinctrl-lpc18xx.c
2489 +index e053f1fa5512..ab2a451f3156 100644
2490 +--- a/drivers/pinctrl/pinctrl-lpc18xx.c
2491 ++++ b/drivers/pinctrl/pinctrl-lpc18xx.c
2492 +@@ -630,14 +630,8 @@ static const struct pinctrl_pin_desc lpc18xx_pins[] = {
2493 + LPC18XX_PIN(i2c0_sda, PIN_I2C0_SDA),
2494 + };
2495 +
2496 +-/**
2497 +- * enum lpc18xx_pin_config_param - possible pin configuration parameters
2498 +- * @PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt
2499 +- * controller.
2500 +- */
2501 +-enum lpc18xx_pin_config_param {
2502 +- PIN_CONFIG_GPIO_PIN_INT = PIN_CONFIG_END + 1,
2503 +-};
2504 ++/* PIN_CONFIG_GPIO_PIN_INT: route gpio to the gpio pin interrupt controller */
2505 ++#define PIN_CONFIG_GPIO_PIN_INT (PIN_CONFIG_END + 1)
2506 +
2507 + static const struct pinconf_generic_params lpc18xx_params[] = {
2508 + {"nxp,gpio-pin-interrupt", PIN_CONFIG_GPIO_PIN_INT, 0},
2509 +diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c
2510 +index e0ecffcbe11f..f8b54cfc90c7 100644
2511 +--- a/drivers/pinctrl/pinctrl-zynq.c
2512 ++++ b/drivers/pinctrl/pinctrl-zynq.c
2513 +@@ -967,15 +967,12 @@ enum zynq_io_standards {
2514 + zynq_iostd_max
2515 + };
2516 +
2517 +-/**
2518 +- * enum zynq_pin_config_param - possible pin configuration parameters
2519 +- * @PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
2520 ++/*
2521 ++ * PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to
2522 + * this parameter (on a custom format) tells the driver which alternative
2523 + * IO standard to use.
2524 + */
2525 +-enum zynq_pin_config_param {
2526 +- PIN_CONFIG_IOSTANDARD = PIN_CONFIG_END + 1,
2527 +-};
2528 ++#define PIN_CONFIG_IOSTANDARD (PIN_CONFIG_END + 1)
2529 +
2530 + static const struct pinconf_generic_params zynq_dt_params[] = {
2531 + {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18},
2532 +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
2533 +index 8093afd17aa4..69641c9e7d17 100644
2534 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
2535 ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c
2536 +@@ -790,10 +790,23 @@ static int pmic_gpio_probe(struct platform_device *pdev)
2537 + return ret;
2538 + }
2539 +
2540 +- ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0, npins);
2541 +- if (ret) {
2542 +- dev_err(dev, "failed to add pin range\n");
2543 +- goto err_range;
2544 ++ /*
2545 ++ * For DeviceTree-supported systems, the gpio core checks the
2546 ++ * pinctrl's device node for the "gpio-ranges" property.
2547 ++ * If it is present, it takes care of adding the pin ranges
2548 ++ * for the driver. In this case the driver can skip ahead.
2549 ++ *
2550 ++ * In order to remain compatible with older, existing DeviceTree
2551 ++ * files which don't set the "gpio-ranges" property or systems that
2552 ++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
2553 ++ */
2554 ++ if (!of_property_read_bool(dev->of_node, "gpio-ranges")) {
2555 ++ ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0,
2556 ++ npins);
2557 ++ if (ret) {
2558 ++ dev_err(dev, "failed to add pin range\n");
2559 ++ goto err_range;
2560 ++ }
2561 + }
2562 +
2563 + return 0;
2564 +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
2565 +index 69ffbd7b76f7..0fd7e40b86a0 100644
2566 +--- a/drivers/platform/x86/asus-nb-wmi.c
2567 ++++ b/drivers/platform/x86/asus-nb-wmi.c
2568 +@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str,
2569 +
2570 + static struct quirk_entry quirk_asus_unknown = {
2571 + .wapf = 0,
2572 ++ .wmi_backlight_set_devstate = true,
2573 + };
2574 +
2575 + static struct quirk_entry quirk_asus_q500a = {
2576 + .i8042_filter = asus_q500a_i8042_filter,
2577 ++ .wmi_backlight_set_devstate = true,
2578 + };
2579 +
2580 + /*
2581 +@@ -92,15 +94,18 @@ static struct quirk_entry quirk_asus_q500a = {
2582 + static struct quirk_entry quirk_asus_x55u = {
2583 + .wapf = 4,
2584 + .wmi_backlight_power = true,
2585 ++ .wmi_backlight_set_devstate = true,
2586 + .no_display_toggle = true,
2587 + };
2588 +
2589 + static struct quirk_entry quirk_asus_wapf4 = {
2590 + .wapf = 4,
2591 ++ .wmi_backlight_set_devstate = true,
2592 + };
2593 +
2594 + static struct quirk_entry quirk_asus_x200ca = {
2595 + .wapf = 2,
2596 ++ .wmi_backlight_set_devstate = true,
2597 + };
2598 +
2599 + static struct quirk_entry quirk_no_rfkill = {
2600 +@@ -114,13 +119,16 @@ static struct quirk_entry quirk_no_rfkill_wapf4 = {
2601 +
2602 + static struct quirk_entry quirk_asus_ux303ub = {
2603 + .wmi_backlight_native = true,
2604 ++ .wmi_backlight_set_devstate = true,
2605 + };
2606 +
2607 + static struct quirk_entry quirk_asus_x550lb = {
2608 ++ .wmi_backlight_set_devstate = true,
2609 + .xusb2pr = 0x01D9,
2610 + };
2611 +
2612 +-static struct quirk_entry quirk_asus_ux330uak = {
2613 ++static struct quirk_entry quirk_asus_forceals = {
2614 ++ .wmi_backlight_set_devstate = true,
2615 + .wmi_force_als_set = true,
2616 + };
2617 +
2618 +@@ -431,7 +439,7 @@ static const struct dmi_system_id asus_quirks[] = {
2619 + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
2620 + DMI_MATCH(DMI_PRODUCT_NAME, "UX330UAK"),
2621 + },
2622 +- .driver_data = &quirk_asus_ux330uak,
2623 ++ .driver_data = &quirk_asus_forceals,
2624 + },
2625 + {
2626 + .callback = dmi_matched,
2627 +@@ -442,6 +450,15 @@ static const struct dmi_system_id asus_quirks[] = {
2628 + },
2629 + .driver_data = &quirk_asus_x550lb,
2630 + },
2631 ++ {
2632 ++ .callback = dmi_matched,
2633 ++ .ident = "ASUSTeK COMPUTER INC. UX430UQ",
2634 ++ .matches = {
2635 ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
2636 ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX430UQ"),
2637 ++ },
2638 ++ .driver_data = &quirk_asus_forceals,
2639 ++ },
2640 + {},
2641 + };
2642 +
2643 +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
2644 +index 10bd13b30178..aede41a92cac 100644
2645 +--- a/drivers/platform/x86/asus-wmi.c
2646 ++++ b/drivers/platform/x86/asus-wmi.c
2647 +@@ -2154,7 +2154,7 @@ static int asus_wmi_add(struct platform_device *pdev)
2648 + err = asus_wmi_backlight_init(asus);
2649 + if (err && err != -ENODEV)
2650 + goto fail_backlight;
2651 +- } else
2652 ++ } else if (asus->driver->quirks->wmi_backlight_set_devstate)
2653 + err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL);
2654 +
2655 + status = wmi_install_notify_handler(asus->driver->event_guid,
2656 +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h
2657 +index 5db052d1de1e..53bab79780e2 100644
2658 +--- a/drivers/platform/x86/asus-wmi.h
2659 ++++ b/drivers/platform/x86/asus-wmi.h
2660 +@@ -45,6 +45,7 @@ struct quirk_entry {
2661 + bool store_backlight_power;
2662 + bool wmi_backlight_power;
2663 + bool wmi_backlight_native;
2664 ++ bool wmi_backlight_set_devstate;
2665 + bool wmi_force_als_set;
2666 + int wapf;
2667 + /*
2668 +diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
2669 +index 5dab4665ca3b..3e0eea3aa876 100644
2670 +--- a/drivers/rtc/rtc-s35390a.c
2671 ++++ b/drivers/rtc/rtc-s35390a.c
2672 +@@ -106,7 +106,7 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len)
2673 + */
2674 + static int s35390a_reset(struct s35390a *s35390a, char *status1)
2675 + {
2676 +- char buf;
2677 ++ u8 buf;
2678 + int ret;
2679 + unsigned initcount = 0;
2680 +
2681 +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
2682 +index 5ee7f44cf869..830b2d2dcf20 100644
2683 +--- a/drivers/scsi/dc395x.c
2684 ++++ b/drivers/scsi/dc395x.c
2685 +@@ -1972,6 +1972,11 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left)
2686 + xferred -= psge->length;
2687 + } else {
2688 + /* Partial SG entry done */
2689 ++ pci_dma_sync_single_for_cpu(srb->dcb->
2690 ++ acb->dev,
2691 ++ srb->sg_bus_addr,
2692 ++ SEGMENTX_LEN,
2693 ++ PCI_DMA_TODEVICE);
2694 + psge->length -= xferred;
2695 + psge->address += xferred;
2696 + srb->sg_index = idx;
2697 +@@ -3450,14 +3455,12 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
2698 + }
2699 + }
2700 +
2701 +- if (dir != PCI_DMA_NONE && scsi_sg_count(cmd))
2702 +- pci_dma_sync_sg_for_cpu(acb->dev, scsi_sglist(cmd),
2703 +- scsi_sg_count(cmd), dir);
2704 +-
2705 + ckc_only = 0;
2706 + /* Check Error Conditions */
2707 + ckc_e:
2708 +
2709 ++ pci_unmap_srb(acb, srb);
2710 ++
2711 + if (cmd->cmnd[0] == INQUIRY) {
2712 + unsigned char *base = NULL;
2713 + struct ScsiInqData *ptr;
2714 +@@ -3511,7 +3514,6 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb,
2715 + cmd, cmd->result);
2716 + srb_free_insert(acb, srb);
2717 + }
2718 +- pci_unmap_srb(acb, srb);
2719 +
2720 + cmd->scsi_done(cmd);
2721 + waiting_process_next(acb);
2722 +diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
2723 +index 02cb76fd4420..6bbf2945a3e0 100644
2724 +--- a/drivers/scsi/ips.c
2725 ++++ b/drivers/scsi/ips.c
2726 +@@ -3500,6 +3500,7 @@ ips_send_cmd(ips_ha_t * ha, ips_scb_t * scb)
2727 +
2728 + case START_STOP:
2729 + scb->scsi_cmd->result = DID_OK << 16;
2730 ++ break;
2731 +
2732 + case TEST_UNIT_READY:
2733 + case INQUIRY:
2734 +diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
2735 +index 609dafd661d1..da4583a2fa23 100644
2736 +--- a/drivers/scsi/isci/host.c
2737 ++++ b/drivers/scsi/isci/host.c
2738 +@@ -2717,9 +2717,9 @@ enum sci_status sci_controller_continue_io(struct isci_request *ireq)
2739 + * the task management request.
2740 + * @task_request: the handle to the task request object to start.
2741 + */
2742 +-enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
2743 +- struct isci_remote_device *idev,
2744 +- struct isci_request *ireq)
2745 ++enum sci_status sci_controller_start_task(struct isci_host *ihost,
2746 ++ struct isci_remote_device *idev,
2747 ++ struct isci_request *ireq)
2748 + {
2749 + enum sci_status status;
2750 +
2751 +@@ -2728,7 +2728,7 @@ enum sci_task_status sci_controller_start_task(struct isci_host *ihost,
2752 + "%s: SCIC Controller starting task from invalid "
2753 + "state\n",
2754 + __func__);
2755 +- return SCI_TASK_FAILURE_INVALID_STATE;
2756 ++ return SCI_FAILURE_INVALID_STATE;
2757 + }
2758 +
2759 + status = sci_remote_device_start_task(ihost, idev, ireq);
2760 +diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
2761 +index 22a9bb1abae1..15dc6e0d8deb 100644
2762 +--- a/drivers/scsi/isci/host.h
2763 ++++ b/drivers/scsi/isci/host.h
2764 +@@ -490,7 +490,7 @@ enum sci_status sci_controller_start_io(
2765 + struct isci_remote_device *idev,
2766 + struct isci_request *ireq);
2767 +
2768 +-enum sci_task_status sci_controller_start_task(
2769 ++enum sci_status sci_controller_start_task(
2770 + struct isci_host *ihost,
2771 + struct isci_remote_device *idev,
2772 + struct isci_request *ireq);
2773 +diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
2774 +index b709d2b20880..7d71ca421751 100644
2775 +--- a/drivers/scsi/isci/request.c
2776 ++++ b/drivers/scsi/isci/request.c
2777 +@@ -1626,9 +1626,9 @@ static enum sci_status atapi_d2h_reg_frame_handler(struct isci_request *ireq,
2778 +
2779 + if (status == SCI_SUCCESS) {
2780 + if (ireq->stp.rsp.status & ATA_ERR)
2781 +- status = SCI_IO_FAILURE_RESPONSE_VALID;
2782 ++ status = SCI_FAILURE_IO_RESPONSE_VALID;
2783 + } else {
2784 +- status = SCI_IO_FAILURE_RESPONSE_VALID;
2785 ++ status = SCI_FAILURE_IO_RESPONSE_VALID;
2786 + }
2787 +
2788 + if (status != SCI_SUCCESS) {
2789 +diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
2790 +index 6dcaed0c1fc8..fb6eba331ac6 100644
2791 +--- a/drivers/scsi/isci/task.c
2792 ++++ b/drivers/scsi/isci/task.c
2793 +@@ -258,7 +258,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
2794 + struct isci_tmf *tmf, unsigned long timeout_ms)
2795 + {
2796 + DECLARE_COMPLETION_ONSTACK(completion);
2797 +- enum sci_task_status status = SCI_TASK_FAILURE;
2798 ++ enum sci_status status = SCI_FAILURE;
2799 + struct isci_request *ireq;
2800 + int ret = TMF_RESP_FUNC_FAILED;
2801 + unsigned long flags;
2802 +@@ -301,7 +301,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost,
2803 + /* start the TMF io. */
2804 + status = sci_controller_start_task(ihost, idev, ireq);
2805 +
2806 +- if (status != SCI_TASK_SUCCESS) {
2807 ++ if (status != SCI_SUCCESS) {
2808 + dev_dbg(&ihost->pdev->dev,
2809 + "%s: start_io failed - status = 0x%x, request = %p\n",
2810 + __func__,
2811 +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
2812 +index ace4f1f41b8e..d60564397be5 100644
2813 +--- a/drivers/scsi/iscsi_tcp.c
2814 ++++ b/drivers/scsi/iscsi_tcp.c
2815 +@@ -798,7 +798,8 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,
2816 + return rc;
2817 +
2818 + return iscsi_conn_get_addr_param((struct sockaddr_storage *)
2819 +- &addr, param, buf);
2820 ++ &addr,
2821 ++ (enum iscsi_param)param, buf);
2822 + default:
2823 + return iscsi_host_get_param(shost, param, buf);
2824 + }
2825 +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
2826 +index b5be4df05733..3702497b5b16 100644
2827 +--- a/drivers/scsi/lpfc/lpfc_els.c
2828 ++++ b/drivers/scsi/lpfc/lpfc_els.c
2829 +@@ -1141,6 +1141,7 @@ stop_rr_fcf_flogi:
2830 + phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
2831 + phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
2832 + spin_unlock_irq(&phba->hbalock);
2833 ++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
2834 + goto out;
2835 + }
2836 + if (!rc) {
2837 +@@ -1155,6 +1156,7 @@ stop_rr_fcf_flogi:
2838 + phba->fcf.fcf_flag &= ~FCF_DISCOVERY;
2839 + phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO);
2840 + spin_unlock_irq(&phba->hbalock);
2841 ++ phba->fcf.fcf_redisc_attempted = 0; /* reset */
2842 + goto out;
2843 + }
2844 + }
2845 +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
2846 +index 9cca5ddbc50c..6eaba1676846 100644
2847 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
2848 ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
2849 +@@ -1969,6 +1969,26 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *vport, uint16_t fcf_index)
2850 + "failover and change port state:x%x/x%x\n",
2851 + phba->pport->port_state, LPFC_VPORT_UNKNOWN);
2852 + phba->pport->port_state = LPFC_VPORT_UNKNOWN;
2853 ++
2854 ++ if (!phba->fcf.fcf_redisc_attempted) {
2855 ++ lpfc_unregister_fcf(phba);
2856 ++
2857 ++ rc = lpfc_sli4_redisc_fcf_table(phba);
2858 ++ if (!rc) {
2859 ++ lpfc_printf_log(phba, KERN_INFO, LOG_FIP,
2860 ++ "3195 Rediscover FCF table\n");
2861 ++ phba->fcf.fcf_redisc_attempted = 1;
2862 ++ lpfc_sli4_clear_fcf_rr_bmask(phba);
2863 ++ } else {
2864 ++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
2865 ++ "3196 Rediscover FCF table "
2866 ++ "failed. Status:x%x\n", rc);
2867 ++ }
2868 ++ } else {
2869 ++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
2870 ++ "3197 Already rediscover FCF table "
2871 ++ "attempted. No more retry\n");
2872 ++ }
2873 + goto stop_flogi_current_fcf;
2874 + } else {
2875 + lpfc_printf_log(phba, KERN_INFO, LOG_FIP | LOG_ELS,
2876 +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
2877 +index e9ea8f4ea2c9..2f80b2c0409e 100644
2878 +--- a/drivers/scsi/lpfc/lpfc_init.c
2879 ++++ b/drivers/scsi/lpfc/lpfc_init.c
2880 +@@ -4444,7 +4444,7 @@ lpfc_sli4_async_fip_evt(struct lpfc_hba *phba,
2881 + break;
2882 + }
2883 + /* If fast FCF failover rescan event is pending, do nothing */
2884 +- if (phba->fcf.fcf_flag & FCF_REDISC_EVT) {
2885 ++ if (phba->fcf.fcf_flag & (FCF_REDISC_EVT | FCF_REDISC_PEND)) {
2886 + spin_unlock_irq(&phba->hbalock);
2887 + break;
2888 + }
2889 +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
2890 +index c05fc61a383b..e1e0feb25003 100644
2891 +--- a/drivers/scsi/lpfc/lpfc_sli.c
2892 ++++ b/drivers/scsi/lpfc/lpfc_sli.c
2893 +@@ -16553,15 +16553,8 @@ next_priority:
2894 + goto initial_priority;
2895 + lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
2896 + "2844 No roundrobin failover FCF available\n");
2897 +- if (next_fcf_index >= LPFC_SLI4_FCF_TBL_INDX_MAX)
2898 +- return LPFC_FCOE_FCF_NEXT_NONE;
2899 +- else {
2900 +- lpfc_printf_log(phba, KERN_WARNING, LOG_FIP,
2901 +- "3063 Only FCF available idx %d, flag %x\n",
2902 +- next_fcf_index,
2903 +- phba->fcf.fcf_pri[next_fcf_index].fcf_rec.flag);
2904 +- return next_fcf_index;
2905 +- }
2906 ++
2907 ++ return LPFC_FCOE_FCF_NEXT_NONE;
2908 + }
2909 +
2910 + if (next_fcf_index < LPFC_SLI4_FCF_TBL_INDX_MAX &&
2911 +diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
2912 +index 0b88b5703e0f..9c69c4215de3 100644
2913 +--- a/drivers/scsi/lpfc/lpfc_sli4.h
2914 ++++ b/drivers/scsi/lpfc/lpfc_sli4.h
2915 +@@ -237,6 +237,7 @@ struct lpfc_fcf {
2916 + #define FCF_REDISC_EVT 0x100 /* FCF rediscovery event to worker thread */
2917 + #define FCF_REDISC_FOV 0x200 /* Post FCF rediscovery fast failover */
2918 + #define FCF_REDISC_PROG (FCF_REDISC_PEND | FCF_REDISC_EVT)
2919 ++ uint16_t fcf_redisc_attempted;
2920 + uint32_t addr_mode;
2921 + uint32_t eligible_fcf_cnt;
2922 + struct lpfc_fcf_rec current_rec;
2923 +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
2924 +index d90693b2767f..c5cc002dfdd5 100644
2925 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c
2926 ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
2927 +@@ -3694,12 +3694,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
2928 + /*
2929 + * The cur_state should not last for more than max_wait secs
2930 + */
2931 +- for (i = 0; i < (max_wait * 1000); i++) {
2932 ++ for (i = 0; i < max_wait; i++) {
2933 + curr_abs_state = instance->instancet->
2934 + read_fw_status_reg(instance->reg_set);
2935 +
2936 + if (abs_state == curr_abs_state) {
2937 +- msleep(1);
2938 ++ msleep(1000);
2939 + } else
2940 + break;
2941 + }
2942 +diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c
2943 +index cebfd734fd76..a9fef0cd382b 100644
2944 +--- a/drivers/scsi/mpt3sas/mpt3sas_config.c
2945 ++++ b/drivers/scsi/mpt3sas/mpt3sas_config.c
2946 +@@ -674,10 +674,6 @@ mpt3sas_config_set_manufacturing_pg11(struct MPT3SAS_ADAPTER *ioc,
2947 + r = _config_request(ioc, &mpi_request, mpi_reply,
2948 + MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
2949 + sizeof(*config_page));
2950 +- mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_WRITE_NVRAM;
2951 +- r = _config_request(ioc, &mpi_request, mpi_reply,
2952 +- MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page,
2953 +- sizeof(*config_page));
2954 + out:
2955 + return r;
2956 + }
2957 +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
2958 +index ec48c010a3ba..aa2078d7e23e 100644
2959 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
2960 ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
2961 +@@ -3297,6 +3297,40 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index,
2962 + return _scsih_check_for_pending_tm(ioc, smid);
2963 + }
2964 +
2965 ++/** _scsih_allow_scmd_to_device - check whether scmd needs to
2966 ++ * issue to IOC or not.
2967 ++ * @ioc: per adapter object
2968 ++ * @scmd: pointer to scsi command object
2969 ++ *
2970 ++ * Returns true if scmd can be issued to IOC otherwise returns false.
2971 ++ */
2972 ++inline bool _scsih_allow_scmd_to_device(struct MPT3SAS_ADAPTER *ioc,
2973 ++ struct scsi_cmnd *scmd)
2974 ++{
2975 ++
2976 ++ if (ioc->pci_error_recovery)
2977 ++ return false;
2978 ++
2979 ++ if (ioc->hba_mpi_version_belonged == MPI2_VERSION) {
2980 ++ if (ioc->remove_host)
2981 ++ return false;
2982 ++
2983 ++ return true;
2984 ++ }
2985 ++
2986 ++ if (ioc->remove_host) {
2987 ++
2988 ++ switch (scmd->cmnd[0]) {
2989 ++ case SYNCHRONIZE_CACHE:
2990 ++ case START_STOP:
2991 ++ return true;
2992 ++ default:
2993 ++ return false;
2994 ++ }
2995 ++ }
2996 ++
2997 ++ return true;
2998 ++}
2999 +
3000 + /**
3001 + * _scsih_sas_control_complete - completion routine
3002 +@@ -4059,7 +4093,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
3003 + return 0;
3004 + }
3005 +
3006 +- if (ioc->pci_error_recovery || ioc->remove_host) {
3007 ++ if (!(_scsih_allow_scmd_to_device(ioc, scmd))) {
3008 + scmd->result = DID_NO_CONNECT << 16;
3009 + scmd->scsi_done(scmd);
3010 + return 0;
3011 +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
3012 +index a47cf638460a..ccb6f98550da 100644
3013 +--- a/drivers/spi/spi-omap2-mcspi.c
3014 ++++ b/drivers/spi/spi-omap2-mcspi.c
3015 +@@ -298,7 +298,7 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
3016 + struct omap2_mcspi_cs *cs = spi->controller_state;
3017 + struct omap2_mcspi *mcspi;
3018 + unsigned int wcnt;
3019 +- int max_fifo_depth, fifo_depth, bytes_per_word;
3020 ++ int max_fifo_depth, bytes_per_word;
3021 + u32 chconf, xferlevel;
3022 +
3023 + mcspi = spi_master_get_devdata(master);
3024 +@@ -314,10 +314,6 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
3025 + else
3026 + max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH;
3027 +
3028 +- fifo_depth = gcd(t->len, max_fifo_depth);
3029 +- if (fifo_depth < 2 || fifo_depth % bytes_per_word != 0)
3030 +- goto disable_fifo;
3031 +-
3032 + wcnt = t->len / bytes_per_word;
3033 + if (wcnt > OMAP2_MCSPI_MAX_FIFOWCNT)
3034 + goto disable_fifo;
3035 +@@ -325,16 +321,17 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi,
3036 + xferlevel = wcnt << 16;
3037 + if (t->rx_buf != NULL) {
3038 + chconf |= OMAP2_MCSPI_CHCONF_FFER;
3039 +- xferlevel |= (fifo_depth - 1) << 8;
3040 ++ xferlevel |= (bytes_per_word - 1) << 8;
3041 + }
3042 ++
3043 + if (t->tx_buf != NULL) {
3044 + chconf |= OMAP2_MCSPI_CHCONF_FFET;
3045 +- xferlevel |= fifo_depth - 1;
3046 ++ xferlevel |= bytes_per_word - 1;
3047 + }
3048 +
3049 + mcspi_write_reg(master, OMAP2_MCSPI_XFERLEVEL, xferlevel);
3050 + mcspi_write_chconf0(spi, chconf);
3051 +- mcspi->fifo_depth = fifo_depth;
3052 ++ mcspi->fifo_depth = max_fifo_depth;
3053 +
3054 + return;
3055 + }
3056 +@@ -601,7 +598,6 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
3057 + struct dma_slave_config cfg;
3058 + enum dma_slave_buswidth width;
3059 + unsigned es;
3060 +- u32 burst;
3061 + void __iomem *chstat_reg;
3062 + void __iomem *irqstat_reg;
3063 + int wait_res;
3064 +@@ -623,22 +619,14 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer)
3065 + }
3066 +
3067 + count = xfer->len;
3068 +- burst = 1;
3069 +-
3070 +- if (mcspi->fifo_depth > 0) {
3071 +- if (count > mcspi->fifo_depth)
3072 +- burst = mcspi->fifo_depth / es;
3073 +- else
3074 +- burst = count / es;
3075 +- }
3076 +
3077 + memset(&cfg, 0, sizeof(cfg));
3078 + cfg.src_addr = cs->phys + OMAP2_MCSPI_RX0;
3079 + cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0;
3080 + cfg.src_addr_width = width;
3081 + cfg.dst_addr_width = width;
3082 +- cfg.src_maxburst = burst;
3083 +- cfg.dst_maxburst = burst;
3084 ++ cfg.src_maxburst = 1;
3085 ++ cfg.dst_maxburst = 1;
3086 +
3087 + rx = xfer->rx_buf;
3088 + tx = xfer->tx_buf;
3089 +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
3090 +index 711ea523b325..8a69148a962a 100644
3091 +--- a/drivers/spi/spi-sh-msiof.c
3092 ++++ b/drivers/spi/spi-sh-msiof.c
3093 +@@ -1198,8 +1198,8 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
3094 +
3095 + i = platform_get_irq(pdev, 0);
3096 + if (i < 0) {
3097 +- dev_err(&pdev->dev, "cannot get platform IRQ\n");
3098 +- ret = -ENOENT;
3099 ++ dev_err(&pdev->dev, "cannot get IRQ\n");
3100 ++ ret = i;
3101 + goto err1;
3102 + }
3103 +
3104 +diff --git a/drivers/staging/comedi/drivers/usbduxfast.c b/drivers/staging/comedi/drivers/usbduxfast.c
3105 +index 608403c7586b..f0572d6a5f63 100644
3106 +--- a/drivers/staging/comedi/drivers/usbduxfast.c
3107 ++++ b/drivers/staging/comedi/drivers/usbduxfast.c
3108 +@@ -1,5 +1,5 @@
3109 + /*
3110 +- * Copyright (C) 2004-2014 Bernd Porr, mail@××××××××××××.uk
3111 ++ * Copyright (C) 2004-2019 Bernd Porr, mail@××××××××××××.uk
3112 + *
3113 + * This program is free software; you can redistribute it and/or modify
3114 + * it under the terms of the GNU General Public License as published by
3115 +@@ -17,7 +17,7 @@
3116 + * Description: University of Stirling USB DAQ & INCITE Technology Limited
3117 + * Devices: [ITL] USB-DUX-FAST (usbduxfast)
3118 + * Author: Bernd Porr <mail@××××××××××××.uk>
3119 +- * Updated: 10 Oct 2014
3120 ++ * Updated: 16 Nov 2019
3121 + * Status: stable
3122 + */
3123 +
3124 +@@ -31,6 +31,7 @@
3125 + *
3126 + *
3127 + * Revision history:
3128 ++ * 1.0: Fixed a rounding error in usbduxfast_ai_cmdtest
3129 + * 0.9: Dropping the first data packet which seems to be from the last transfer.
3130 + * Buffer overflows in the FX2 are handed over to comedi.
3131 + * 0.92: Dropping now 4 packets. The quad buffer has to be emptied.
3132 +@@ -359,6 +360,7 @@ static int usbduxfast_ai_cmdtest(struct comedi_device *dev,
3133 + struct comedi_cmd *cmd)
3134 + {
3135 + int err = 0;
3136 ++ int err2 = 0;
3137 + unsigned int steps;
3138 + unsigned int arg;
3139 +
3140 +@@ -408,11 +410,16 @@ static int usbduxfast_ai_cmdtest(struct comedi_device *dev,
3141 + */
3142 + steps = (cmd->convert_arg * 30) / 1000;
3143 + if (cmd->chanlist_len != 1)
3144 +- err |= comedi_check_trigger_arg_min(&steps,
3145 +- MIN_SAMPLING_PERIOD);
3146 +- err |= comedi_check_trigger_arg_max(&steps, MAX_SAMPLING_PERIOD);
3147 +- arg = (steps * 1000) / 30;
3148 +- err |= comedi_check_trigger_arg_is(&cmd->convert_arg, arg);
3149 ++ err2 |= comedi_check_trigger_arg_min(&steps,
3150 ++ MIN_SAMPLING_PERIOD);
3151 ++ else
3152 ++ err2 |= comedi_check_trigger_arg_min(&steps, 1);
3153 ++ err2 |= comedi_check_trigger_arg_max(&steps, MAX_SAMPLING_PERIOD);
3154 ++ if (err2) {
3155 ++ err |= err2;
3156 ++ arg = (steps * 1000) / 30;
3157 ++ err |= comedi_check_trigger_arg_is(&cmd->convert_arg, arg);
3158 ++ }
3159 +
3160 + if (cmd->stop_src == TRIG_COUNT)
3161 + err |= comedi_check_trigger_arg_min(&cmd->stop_arg, 1);
3162 +diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
3163 +index 73e5fee6cf1d..83126e2dce36 100644
3164 +--- a/drivers/thermal/rcar_thermal.c
3165 ++++ b/drivers/thermal/rcar_thermal.c
3166 +@@ -401,8 +401,8 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data)
3167 + rcar_thermal_for_each_priv(priv, common) {
3168 + if (rcar_thermal_had_changed(priv, status)) {
3169 + rcar_thermal_irq_disable(priv);
3170 +- schedule_delayed_work(&priv->work,
3171 +- msecs_to_jiffies(300));
3172 ++ queue_delayed_work(system_freezable_wq, &priv->work,
3173 ++ msecs_to_jiffies(300));
3174 + }
3175 + }
3176 +
3177 +diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
3178 +index 7aca2d4670e4..e645ee1cfd98 100644
3179 +--- a/drivers/tty/synclink_gt.c
3180 ++++ b/drivers/tty/synclink_gt.c
3181 +@@ -1187,14 +1187,13 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
3182 + unsigned int cmd, unsigned long arg)
3183 + {
3184 + struct slgt_info *info = tty->driver_data;
3185 +- int rc = -ENOIOCTLCMD;
3186 ++ int rc;
3187 +
3188 + if (sanity_check(info, tty->name, "compat_ioctl"))
3189 + return -ENODEV;
3190 + DBGINFO(("%s compat_ioctl() cmd=%08X\n", info->device_name, cmd));
3191 +
3192 + switch (cmd) {
3193 +-
3194 + case MGSL_IOCSPARAMS32:
3195 + rc = set_params32(info, compat_ptr(arg));
3196 + break;
3197 +@@ -1214,18 +1213,11 @@ static long slgt_compat_ioctl(struct tty_struct *tty,
3198 + case MGSL_IOCWAITGPIO:
3199 + case MGSL_IOCGXSYNC:
3200 + case MGSL_IOCGXCTRL:
3201 +- case MGSL_IOCSTXIDLE:
3202 +- case MGSL_IOCTXENABLE:
3203 +- case MGSL_IOCRXENABLE:
3204 +- case MGSL_IOCTXABORT:
3205 +- case TIOCMIWAIT:
3206 +- case MGSL_IOCSIF:
3207 +- case MGSL_IOCSXSYNC:
3208 +- case MGSL_IOCSXCTRL:
3209 +- rc = ioctl(tty, cmd, arg);
3210 ++ rc = ioctl(tty, cmd, (unsigned long)compat_ptr(arg));
3211 + break;
3212 ++ default:
3213 ++ rc = ioctl(tty, cmd, arg);
3214 + }
3215 +-
3216 + DBGINFO(("%s compat_ioctl() cmd=%08X rc=%d\n", info->device_name, cmd, rc));
3217 + return rc;
3218 + }
3219 +diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
3220 +index b8092bcf89a2..32dc0d9f0519 100644
3221 +--- a/drivers/usb/misc/appledisplay.c
3222 ++++ b/drivers/usb/misc/appledisplay.c
3223 +@@ -160,8 +160,11 @@ static int appledisplay_bl_update_status(struct backlight_device *bd)
3224 + pdata->msgdata, 2,
3225 + ACD_USB_TIMEOUT);
3226 + mutex_unlock(&pdata->sysfslock);
3227 +-
3228 +- return retval;
3229 ++
3230 ++ if (retval < 0)
3231 ++ return retval;
3232 ++ else
3233 ++ return 0;
3234 + }
3235 +
3236 + static int appledisplay_bl_get_brightness(struct backlight_device *bd)
3237 +@@ -179,7 +182,12 @@ static int appledisplay_bl_get_brightness(struct backlight_device *bd)
3238 + 0,
3239 + pdata->msgdata, 2,
3240 + ACD_USB_TIMEOUT);
3241 +- brightness = pdata->msgdata[1];
3242 ++ if (retval < 2) {
3243 ++ if (retval >= 0)
3244 ++ retval = -EMSGSIZE;
3245 ++ } else {
3246 ++ brightness = pdata->msgdata[1];
3247 ++ }
3248 + mutex_unlock(&pdata->sysfslock);
3249 +
3250 + if (retval < 0)
3251 +@@ -321,6 +329,7 @@ error:
3252 + if (pdata) {
3253 + if (pdata->urb) {
3254 + usb_kill_urb(pdata->urb);
3255 ++ cancel_delayed_work_sync(&pdata->work);
3256 + if (pdata->urbdata)
3257 + usb_free_coherent(pdata->udev, ACD_URB_BUFFER_LEN,
3258 + pdata->urbdata, pdata->urb->transfer_dma);
3259 +diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
3260 +index 64f2eeffaa00..b694e200a98e 100644
3261 +--- a/drivers/usb/misc/chaoskey.c
3262 ++++ b/drivers/usb/misc/chaoskey.c
3263 +@@ -412,13 +412,17 @@ static int _chaoskey_fill(struct chaoskey *dev)
3264 + !dev->reading,
3265 + (started ? NAK_TIMEOUT : ALEA_FIRST_TIMEOUT) );
3266 +
3267 +- if (result < 0)
3268 ++ if (result < 0) {
3269 ++ usb_kill_urb(dev->urb);
3270 + goto out;
3271 ++ }
3272 +
3273 +- if (result == 0)
3274 ++ if (result == 0) {
3275 + result = -ETIMEDOUT;
3276 +- else
3277 ++ usb_kill_urb(dev->urb);
3278 ++ } else {
3279 + result = dev->valid;
3280 ++ }
3281 + out:
3282 + /* Let the device go back to sleep eventually */
3283 + usb_autopm_put_interface(dev->interface);
3284 +@@ -554,7 +558,21 @@ static int chaoskey_suspend(struct usb_interface *interface,
3285 +
3286 + static int chaoskey_resume(struct usb_interface *interface)
3287 + {
3288 ++ struct chaoskey *dev;
3289 ++ struct usb_device *udev = interface_to_usbdev(interface);
3290 ++
3291 + usb_dbg(interface, "resume");
3292 ++ dev = usb_get_intfdata(interface);
3293 ++
3294 ++ /*
3295 ++ * We may have lost power.
3296 ++ * In that case the device that needs a long time
3297 ++ * for the first requests needs an extended timeout
3298 ++ * again
3299 ++ */
3300 ++ if (le16_to_cpu(udev->descriptor.idVendor) == ALEA_VENDOR_ID)
3301 ++ dev->reads_started = false;
3302 ++
3303 + return 0;
3304 + }
3305 + #else
3306 +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
3307 +index 40c58145bf80..613544d25fad 100644
3308 +--- a/drivers/usb/serial/cp210x.c
3309 ++++ b/drivers/usb/serial/cp210x.c
3310 +@@ -122,6 +122,7 @@ static const struct usb_device_id id_table[] = {
3311 + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
3312 + { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */
3313 + { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */
3314 ++ { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */
3315 + { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */
3316 + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
3317 + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
3318 +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
3319 +index ea20322e1416..14b45f3e6388 100644
3320 +--- a/drivers/usb/serial/mos7720.c
3321 ++++ b/drivers/usb/serial/mos7720.c
3322 +@@ -1941,10 +1941,6 @@ static int mos7720_startup(struct usb_serial *serial)
3323 + }
3324 + }
3325 +
3326 +- /* setting configuration feature to one */
3327 +- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
3328 +- (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000);
3329 +-
3330 + #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
3331 + if (product == MOSCHIP_DEVICE_ID_7715) {
3332 + ret_val = mos7715_parport_init(serial);
3333 +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
3334 +index 03d63bad6be4..0c92252c9316 100644
3335 +--- a/drivers/usb/serial/mos7840.c
3336 ++++ b/drivers/usb/serial/mos7840.c
3337 +@@ -131,11 +131,15 @@
3338 + /* This driver also supports
3339 + * ATEN UC2324 device using Moschip MCS7840
3340 + * ATEN UC2322 device using Moschip MCS7820
3341 ++ * MOXA UPort 2210 device using Moschip MCS7820
3342 + */
3343 + #define USB_VENDOR_ID_ATENINTL 0x0557
3344 + #define ATENINTL_DEVICE_ID_UC2324 0x2011
3345 + #define ATENINTL_DEVICE_ID_UC2322 0x7820
3346 +
3347 ++#define USB_VENDOR_ID_MOXA 0x110a
3348 ++#define MOXA_DEVICE_ID_2210 0x2210
3349 ++
3350 + /* Interrupt Routine Defines */
3351 +
3352 + #define SERIAL_IIR_RLS 0x06
3353 +@@ -206,6 +210,7 @@ static const struct usb_device_id id_table[] = {
3354 + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)},
3355 + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)},
3356 + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)},
3357 ++ {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)},
3358 + {} /* terminating entry */
3359 + };
3360 + MODULE_DEVICE_TABLE(usb, id_table);
3361 +@@ -2089,6 +2094,7 @@ static int mos7840_probe(struct usb_serial *serial,
3362 + const struct usb_device_id *id)
3363 + {
3364 + u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
3365 ++ u16 vid = le16_to_cpu(serial->dev->descriptor.idVendor);
3366 + u8 *buf;
3367 + int device_type;
3368 +
3369 +@@ -2098,6 +2104,11 @@ static int mos7840_probe(struct usb_serial *serial,
3370 + goto out;
3371 + }
3372 +
3373 ++ if (vid == USB_VENDOR_ID_MOXA && product == MOXA_DEVICE_ID_2210) {
3374 ++ device_type = MOSCHIP_DEVICE_ID_7820;
3375 ++ goto out;
3376 ++ }
3377 ++
3378 + buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL);
3379 + if (!buf)
3380 + return -ENOMEM;
3381 +@@ -2350,11 +2361,6 @@ out:
3382 + goto error;
3383 + } else
3384 + dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status);
3385 +-
3386 +- /* setting configuration feature to one */
3387 +- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
3388 +- 0x03, 0x00, 0x01, 0x00, NULL, 0x00,
3389 +- MOS_WDR_TIMEOUT);
3390 + }
3391 + return 0;
3392 + error:
3393 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
3394 +index 00a6e62a68a8..084332a5855e 100644
3395 +--- a/drivers/usb/serial/option.c
3396 ++++ b/drivers/usb/serial/option.c
3397 +@@ -200,6 +200,7 @@ static void option_instat_callback(struct urb *urb);
3398 + #define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */
3399 +
3400 + #define DELL_PRODUCT_5821E 0x81d7
3401 ++#define DELL_PRODUCT_5821E_ESIM 0x81e0
3402 +
3403 + #define KYOCERA_VENDOR_ID 0x0c88
3404 + #define KYOCERA_PRODUCT_KPC650 0x17da
3405 +@@ -1043,6 +1044,8 @@ static const struct usb_device_id option_ids[] = {
3406 + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) },
3407 + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E),
3408 + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
3409 ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM),
3410 ++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
3411 + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
3412 + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
3413 + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
3414 +@@ -1987,6 +1990,10 @@ static const struct usb_device_id option_ids[] = {
3415 + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
3416 + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
3417 + { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
3418 ++ { USB_DEVICE(0x0489, 0xe0b4), /* Foxconn T77W968 */
3419 ++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
3420 ++ { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
3421 ++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
3422 + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
3423 + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
3424 + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */
3425 +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
3426 +index 2f09294c5946..e459cd7302e2 100644
3427 +--- a/drivers/virtio/virtio_ring.c
3428 ++++ b/drivers/virtio/virtio_ring.c
3429 +@@ -427,7 +427,7 @@ unmap_release:
3430 + kfree(desc);
3431 +
3432 + END_USE(vq);
3433 +- return -EIO;
3434 ++ return -ENOMEM;
3435 + }
3436 +
3437 + /**
3438 +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
3439 +index 6af117af9780..731cf54f75c6 100644
3440 +--- a/drivers/xen/balloon.c
3441 ++++ b/drivers/xen/balloon.c
3442 +@@ -358,7 +358,10 @@ static enum bp_state reserve_additional_memory(void)
3443 + * callers drop the mutex before trying again.
3444 + */
3445 + mutex_unlock(&balloon_mutex);
3446 ++ /* add_memory_resource() requires the device_hotplug lock */
3447 ++ lock_device_hotplug();
3448 + rc = add_memory_resource(nid, resource, memhp_auto_online);
3449 ++ unlock_device_hotplug();
3450 + mutex_lock(&balloon_mutex);
3451 +
3452 + if (rc) {
3453 +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
3454 +index 3df434eb1474..3faccbf35e9f 100644
3455 +--- a/fs/btrfs/ctree.c
3456 ++++ b/fs/btrfs/ctree.c
3457 +@@ -2973,6 +2973,10 @@ int btrfs_search_old_slot(struct btrfs_root *root, struct btrfs_key *key,
3458 +
3459 + again:
3460 + b = get_old_root(root, time_seq);
3461 ++ if (!b) {
3462 ++ ret = -EIO;
3463 ++ goto done;
3464 ++ }
3465 + level = btrfs_header_level(b);
3466 + p->locks[level] = BTRFS_READ_LOCK;
3467 +
3468 +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
3469 +index 7fcddaaca8a5..049cff197d2a 100644
3470 +--- a/fs/ceph/inode.c
3471 ++++ b/fs/ceph/inode.c
3472 +@@ -1630,7 +1630,6 @@ retry_lookup:
3473 + if (IS_ERR(realdn)) {
3474 + err = PTR_ERR(realdn);
3475 + d_drop(dn);
3476 +- dn = NULL;
3477 + goto next_item;
3478 + }
3479 + dn = realdn;
3480 +diff --git a/fs/dlm/member.c b/fs/dlm/member.c
3481 +index 9c47f1c14a8b..a47ae99f7bcb 100644
3482 +--- a/fs/dlm/member.c
3483 ++++ b/fs/dlm/member.c
3484 +@@ -683,7 +683,7 @@ int dlm_ls_start(struct dlm_ls *ls)
3485 +
3486 + error = dlm_config_nodes(ls->ls_name, &nodes, &count);
3487 + if (error < 0)
3488 +- goto fail;
3489 ++ goto fail_rv;
3490 +
3491 + spin_lock(&ls->ls_recover_lock);
3492 +
3493 +@@ -715,8 +715,9 @@ int dlm_ls_start(struct dlm_ls *ls)
3494 + return 0;
3495 +
3496 + fail:
3497 +- kfree(rv);
3498 + kfree(nodes);
3499 ++ fail_rv:
3500 ++ kfree(rv);
3501 + return error;
3502 + }
3503 +
3504 +diff --git a/fs/dlm/user.c b/fs/dlm/user.c
3505 +index 9ac65914ab5b..57f2aacec97f 100644
3506 +--- a/fs/dlm/user.c
3507 ++++ b/fs/dlm/user.c
3508 +@@ -700,7 +700,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat,
3509 + result.version[0] = DLM_DEVICE_VERSION_MAJOR;
3510 + result.version[1] = DLM_DEVICE_VERSION_MINOR;
3511 + result.version[2] = DLM_DEVICE_VERSION_PATCH;
3512 +- memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb));
3513 ++ memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr));
3514 + result.user_lksb = ua->user_lksb;
3515 +
3516 + /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated
3517 +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
3518 +index 9041805096e0..0206c8c20784 100644
3519 +--- a/fs/f2fs/data.c
3520 ++++ b/fs/f2fs/data.c
3521 +@@ -1201,6 +1201,7 @@ int do_write_data_page(struct f2fs_io_info *fio)
3522 + /* This page is already truncated */
3523 + if (fio->old_blkaddr == NULL_ADDR) {
3524 + ClearPageUptodate(page);
3525 ++ clear_cold_data(page);
3526 + goto out_writepage;
3527 + }
3528 +
3529 +@@ -1337,8 +1338,10 @@ done:
3530 + clear_cold_data(page);
3531 + out:
3532 + inode_dec_dirty_pages(inode);
3533 +- if (err)
3534 ++ if (err) {
3535 + ClearPageUptodate(page);
3536 ++ clear_cold_data(page);
3537 ++ }
3538 +
3539 + if (wbc->for_reclaim) {
3540 + f2fs_submit_merged_bio_cond(sbi, NULL, page, 0, DATA, WRITE);
3541 +@@ -1821,6 +1824,8 @@ void f2fs_invalidate_page(struct page *page, unsigned int offset,
3542 + inode_dec_dirty_pages(inode);
3543 + }
3544 +
3545 ++ clear_cold_data(page);
3546 ++
3547 + /* This is atomic written page, keep Private */
3548 + if (IS_ATOMIC_WRITTEN_PAGE(page))
3549 + return;
3550 +@@ -1839,6 +1844,7 @@ int f2fs_release_page(struct page *page, gfp_t wait)
3551 + if (IS_ATOMIC_WRITTEN_PAGE(page))
3552 + return 0;
3553 +
3554 ++ clear_cold_data(page);
3555 + set_page_private(page, 0);
3556 + ClearPagePrivate(page);
3557 + return 1;
3558 +diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
3559 +index af719d93507e..b414892be08b 100644
3560 +--- a/fs/f2fs/dir.c
3561 ++++ b/fs/f2fs/dir.c
3562 +@@ -772,6 +772,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
3563 + clear_page_dirty_for_io(page);
3564 + ClearPagePrivate(page);
3565 + ClearPageUptodate(page);
3566 ++ clear_cold_data(page);
3567 + inode_dec_dirty_pages(dir);
3568 + }
3569 + f2fs_put_page(page, 1);
3570 +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
3571 +index 1d5a35213810..c4c84af1ec17 100644
3572 +--- a/fs/f2fs/segment.c
3573 ++++ b/fs/f2fs/segment.c
3574 +@@ -227,8 +227,10 @@ static int __revoke_inmem_pages(struct inode *inode,
3575 + }
3576 + next:
3577 + /* we don't need to invalidate this in the sccessful status */
3578 +- if (drop || recover)
3579 ++ if (drop || recover) {
3580 + ClearPageUptodate(page);
3581 ++ clear_cold_data(page);
3582 ++ }
3583 + set_page_private(page, 0);
3584 + ClearPagePrivate(page);
3585 + f2fs_put_page(page, 1);
3586 +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
3587 +index f77a38755aea..0a80f6636549 100644
3588 +--- a/fs/gfs2/rgrp.c
3589 ++++ b/fs/gfs2/rgrp.c
3590 +@@ -630,7 +630,10 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
3591 + RB_CLEAR_NODE(&rs->rs_node);
3592 +
3593 + if (rs->rs_free) {
3594 +- struct gfs2_bitmap *bi = rbm_bi(&rs->rs_rbm);
3595 ++ u64 last_block = gfs2_rbm_to_block(&rs->rs_rbm) +
3596 ++ rs->rs_free - 1;
3597 ++ struct gfs2_rbm last_rbm = { .rgd = rs->rs_rbm.rgd, };
3598 ++ struct gfs2_bitmap *start, *last;
3599 +
3600 + /* return reserved blocks to the rgrp */
3601 + BUG_ON(rs->rs_rbm.rgd->rd_reserved < rs->rs_free);
3602 +@@ -641,7 +644,13 @@ static void __rs_deltree(struct gfs2_blkreserv *rs)
3603 + it will force the number to be recalculated later. */
3604 + rgd->rd_extfail_pt += rs->rs_free;
3605 + rs->rs_free = 0;
3606 +- clear_bit(GBF_FULL, &bi->bi_flags);
3607 ++ if (gfs2_rbm_from_block(&last_rbm, last_block))
3608 ++ return;
3609 ++ start = rbm_bi(&rs->rs_rbm);
3610 ++ last = rbm_bi(&last_rbm);
3611 ++ do
3612 ++ clear_bit(GBF_FULL, &start->bi_flags);
3613 ++ while (start++ != last);
3614 + }
3615 + }
3616 +
3617 +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
3618 +index 2e713673df42..85dab71bee74 100644
3619 +--- a/fs/hfs/brec.c
3620 ++++ b/fs/hfs/brec.c
3621 +@@ -444,6 +444,7 @@ skip:
3622 + /* restore search_key */
3623 + hfs_bnode_read_key(node, fd->search_key, 14);
3624 + }
3625 ++ new_node = NULL;
3626 + }
3627 +
3628 + if (!rec && node->parent)
3629 +diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
3630 +index 320f4372f172..77eff447d301 100644
3631 +--- a/fs/hfs/btree.c
3632 ++++ b/fs/hfs/btree.c
3633 +@@ -219,25 +219,17 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
3634 + return node;
3635 + }
3636 +
3637 +-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3638 ++/* Make sure @tree has enough space for the @rsvd_nodes */
3639 ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
3640 + {
3641 +- struct hfs_bnode *node, *next_node;
3642 +- struct page **pagep;
3643 +- u32 nidx, idx;
3644 +- unsigned off;
3645 +- u16 off16;
3646 +- u16 len;
3647 +- u8 *data, byte, m;
3648 +- int i;
3649 +-
3650 +- while (!tree->free_nodes) {
3651 +- struct inode *inode = tree->inode;
3652 +- u32 count;
3653 +- int res;
3654 ++ struct inode *inode = tree->inode;
3655 ++ u32 count;
3656 ++ int res;
3657 +
3658 ++ while (tree->free_nodes < rsvd_nodes) {
3659 + res = hfs_extend_file(inode);
3660 + if (res)
3661 +- return ERR_PTR(res);
3662 ++ return res;
3663 + HFS_I(inode)->phys_size = inode->i_size =
3664 + (loff_t)HFS_I(inode)->alloc_blocks *
3665 + HFS_SB(tree->sb)->alloc_blksz;
3666 +@@ -245,9 +237,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3667 + tree->sb->s_blocksize_bits;
3668 + inode_set_bytes(inode, inode->i_size);
3669 + count = inode->i_size >> tree->node_size_shift;
3670 +- tree->free_nodes = count - tree->node_count;
3671 ++ tree->free_nodes += count - tree->node_count;
3672 + tree->node_count = count;
3673 + }
3674 ++ return 0;
3675 ++}
3676 ++
3677 ++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3678 ++{
3679 ++ struct hfs_bnode *node, *next_node;
3680 ++ struct page **pagep;
3681 ++ u32 nidx, idx;
3682 ++ unsigned off;
3683 ++ u16 off16;
3684 ++ u16 len;
3685 ++ u8 *data, byte, m;
3686 ++ int i, res;
3687 ++
3688 ++ res = hfs_bmap_reserve(tree, 1);
3689 ++ if (res)
3690 ++ return ERR_PTR(res);
3691 +
3692 + nidx = 0;
3693 + node = hfs_bnode_find(tree, nidx);
3694 +diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h
3695 +index f6bd266d70b5..2715f416b5a8 100644
3696 +--- a/fs/hfs/btree.h
3697 ++++ b/fs/hfs/btree.h
3698 +@@ -81,6 +81,7 @@ struct hfs_find_data {
3699 + extern struct hfs_btree *hfs_btree_open(struct super_block *, u32, btree_keycmp);
3700 + extern void hfs_btree_close(struct hfs_btree *);
3701 + extern void hfs_btree_write(struct hfs_btree *);
3702 ++extern int hfs_bmap_reserve(struct hfs_btree *, int);
3703 + extern struct hfs_bnode * hfs_bmap_alloc(struct hfs_btree *);
3704 + extern void hfs_bmap_free(struct hfs_bnode *node);
3705 +
3706 +diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c
3707 +index 8a66405b0f8b..d365bf0b8c77 100644
3708 +--- a/fs/hfs/catalog.c
3709 ++++ b/fs/hfs/catalog.c
3710 +@@ -97,6 +97,14 @@ int hfs_cat_create(u32 cnid, struct inode *dir, const struct qstr *str, struct i
3711 + if (err)
3712 + return err;
3713 +
3714 ++ /*
3715 ++ * Fail early and avoid ENOSPC during the btree operations. We may
3716 ++ * have to split the root node at most once.
3717 ++ */
3718 ++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
3719 ++ if (err)
3720 ++ goto err2;
3721 ++
3722 + hfs_cat_build_key(sb, fd.search_key, cnid, NULL);
3723 + entry_size = hfs_cat_build_thread(sb, &entry, S_ISDIR(inode->i_mode) ?
3724 + HFS_CDR_THD : HFS_CDR_FTH,
3725 +@@ -295,6 +303,14 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, const struct qstr *src_name,
3726 + return err;
3727 + dst_fd = src_fd;
3728 +
3729 ++ /*
3730 ++ * Fail early and avoid ENOSPC during the btree operations. We may
3731 ++ * have to split the root node at most once.
3732 ++ */
3733 ++ err = hfs_bmap_reserve(src_fd.tree, 2 * src_fd.tree->depth);
3734 ++ if (err)
3735 ++ goto out;
3736 ++
3737 + /* find the old dir entry and read the data */
3738 + hfs_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name);
3739 + err = hfs_brec_find(&src_fd);
3740 +diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c
3741 +index e33a0d36a93e..cbe4fca96378 100644
3742 +--- a/fs/hfs/extent.c
3743 ++++ b/fs/hfs/extent.c
3744 +@@ -117,6 +117,10 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd)
3745 + if (HFS_I(inode)->flags & HFS_FLG_EXT_NEW) {
3746 + if (res != -ENOENT)
3747 + return res;
3748 ++ /* Fail early and avoid ENOSPC during the btree operation */
3749 ++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
3750 ++ if (res)
3751 ++ return res;
3752 + hfs_brec_insert(fd, HFS_I(inode)->cached_extents, sizeof(hfs_extent_rec));
3753 + HFS_I(inode)->flags &= ~(HFS_FLG_EXT_DIRTY|HFS_FLG_EXT_NEW);
3754 + } else {
3755 +@@ -300,7 +304,7 @@ int hfs_free_fork(struct super_block *sb, struct hfs_cat_file *file, int type)
3756 + return 0;
3757 +
3758 + blocks = 0;
3759 +- for (i = 0; i < 3; extent++, i++)
3760 ++ for (i = 0; i < 3; i++)
3761 + blocks += be16_to_cpu(extent[i].count);
3762 +
3763 + res = hfs_free_extents(sb, extent, blocks, blocks);
3764 +@@ -341,7 +345,9 @@ int hfs_get_block(struct inode *inode, sector_t block,
3765 + ablock = (u32)block / HFS_SB(sb)->fs_div;
3766 +
3767 + if (block >= HFS_I(inode)->fs_blocks) {
3768 +- if (block > HFS_I(inode)->fs_blocks || !create)
3769 ++ if (!create)
3770 ++ return 0;
3771 ++ if (block > HFS_I(inode)->fs_blocks)
3772 + return -EIO;
3773 + if (ablock >= HFS_I(inode)->alloc_blocks) {
3774 + res = hfs_extend_file(inode);
3775 +diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c
3776 +index f776acf2378a..de0d6d4c46b6 100644
3777 +--- a/fs/hfs/inode.c
3778 ++++ b/fs/hfs/inode.c
3779 +@@ -641,6 +641,8 @@ int hfs_inode_setattr(struct dentry *dentry, struct iattr * attr)
3780 +
3781 + truncate_setsize(inode, attr->ia_size);
3782 + hfs_file_truncate(inode);
3783 ++ inode->i_atime = inode->i_mtime = inode->i_ctime =
3784 ++ current_time(inode);
3785 + }
3786 +
3787 + setattr_copy(inode, attr);
3788 +diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c
3789 +index e5b221de7de6..d7455ea70287 100644
3790 +--- a/fs/hfsplus/attributes.c
3791 ++++ b/fs/hfsplus/attributes.c
3792 +@@ -216,6 +216,11 @@ int hfsplus_create_attr(struct inode *inode,
3793 + if (err)
3794 + goto failed_init_create_attr;
3795 +
3796 ++ /* Fail early and avoid ENOSPC during the btree operation */
3797 ++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth + 1);
3798 ++ if (err)
3799 ++ goto failed_create_attr;
3800 ++
3801 + if (name) {
3802 + err = hfsplus_attr_build_key(sb, fd.search_key,
3803 + inode->i_ino, name);
3804 +@@ -312,6 +317,11 @@ int hfsplus_delete_attr(struct inode *inode, const char *name)
3805 + if (err)
3806 + return err;
3807 +
3808 ++ /* Fail early and avoid ENOSPC during the btree operation */
3809 ++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth);
3810 ++ if (err)
3811 ++ goto out;
3812 ++
3813 + if (name) {
3814 + err = hfsplus_attr_build_key(sb, fd.search_key,
3815 + inode->i_ino, name);
3816 +diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
3817 +index 1002a0c08319..20ce698251ad 100644
3818 +--- a/fs/hfsplus/brec.c
3819 ++++ b/fs/hfsplus/brec.c
3820 +@@ -447,6 +447,7 @@ skip:
3821 + /* restore search_key */
3822 + hfs_bnode_read_key(node, fd->search_key, 14);
3823 + }
3824 ++ new_node = NULL;
3825 + }
3826 +
3827 + if (!rec && node->parent)
3828 +diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
3829 +index 8d2256454efe..7e96b4c294f7 100644
3830 +--- a/fs/hfsplus/btree.c
3831 ++++ b/fs/hfsplus/btree.c
3832 +@@ -341,26 +341,21 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
3833 + return node;
3834 + }
3835 +
3836 +-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3837 ++/* Make sure @tree has enough space for the @rsvd_nodes */
3838 ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
3839 + {
3840 +- struct hfs_bnode *node, *next_node;
3841 +- struct page **pagep;
3842 +- u32 nidx, idx;
3843 +- unsigned off;
3844 +- u16 off16;
3845 +- u16 len;
3846 +- u8 *data, byte, m;
3847 +- int i;
3848 ++ struct inode *inode = tree->inode;
3849 ++ struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
3850 ++ u32 count;
3851 ++ int res;
3852 +
3853 +- while (!tree->free_nodes) {
3854 +- struct inode *inode = tree->inode;
3855 +- struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
3856 +- u32 count;
3857 +- int res;
3858 ++ if (rsvd_nodes <= 0)
3859 ++ return 0;
3860 +
3861 ++ while (tree->free_nodes < rsvd_nodes) {
3862 + res = hfsplus_file_extend(inode, hfs_bnode_need_zeroout(tree));
3863 + if (res)
3864 +- return ERR_PTR(res);
3865 ++ return res;
3866 + hip->phys_size = inode->i_size =
3867 + (loff_t)hip->alloc_blocks <<
3868 + HFSPLUS_SB(tree->sb)->alloc_blksz_shift;
3869 +@@ -368,9 +363,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3870 + hip->alloc_blocks << HFSPLUS_SB(tree->sb)->fs_shift;
3871 + inode_set_bytes(inode, inode->i_size);
3872 + count = inode->i_size >> tree->node_size_shift;
3873 +- tree->free_nodes = count - tree->node_count;
3874 ++ tree->free_nodes += count - tree->node_count;
3875 + tree->node_count = count;
3876 + }
3877 ++ return 0;
3878 ++}
3879 ++
3880 ++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree)
3881 ++{
3882 ++ struct hfs_bnode *node, *next_node;
3883 ++ struct page **pagep;
3884 ++ u32 nidx, idx;
3885 ++ unsigned off;
3886 ++ u16 off16;
3887 ++ u16 len;
3888 ++ u8 *data, byte, m;
3889 ++ int i, res;
3890 ++
3891 ++ res = hfs_bmap_reserve(tree, 1);
3892 ++ if (res)
3893 ++ return ERR_PTR(res);
3894 +
3895 + nidx = 0;
3896 + node = hfs_bnode_find(tree, nidx);
3897 +diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
3898 +index a5e00f7a4c14..947da72e72a3 100644
3899 +--- a/fs/hfsplus/catalog.c
3900 ++++ b/fs/hfsplus/catalog.c
3901 +@@ -264,6 +264,14 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir,
3902 + if (err)
3903 + return err;
3904 +
3905 ++ /*
3906 ++ * Fail early and avoid ENOSPC during the btree operations. We may
3907 ++ * have to split the root node at most once.
3908 ++ */
3909 ++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth);
3910 ++ if (err)
3911 ++ goto err2;
3912 ++
3913 + hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid);
3914 + entry_size = hfsplus_fill_cat_thread(sb, &entry,
3915 + S_ISDIR(inode->i_mode) ?
3916 +@@ -332,6 +340,14 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, const struct qstr *str)
3917 + if (err)
3918 + return err;
3919 +
3920 ++ /*
3921 ++ * Fail early and avoid ENOSPC during the btree operations. We may
3922 ++ * have to split the root node at most once.
3923 ++ */
3924 ++ err = hfs_bmap_reserve(fd.tree, 2 * (int)fd.tree->depth - 2);
3925 ++ if (err)
3926 ++ goto out;
3927 ++
3928 + if (!str) {
3929 + int len;
3930 +
3931 +@@ -432,6 +448,14 @@ int hfsplus_rename_cat(u32 cnid,
3932 + return err;
3933 + dst_fd = src_fd;
3934 +
3935 ++ /*
3936 ++ * Fail early and avoid ENOSPC during the btree operations. We may
3937 ++ * have to split the root node at most twice.
3938 ++ */
3939 ++ err = hfs_bmap_reserve(src_fd.tree, 4 * (int)src_fd.tree->depth - 1);
3940 ++ if (err)
3941 ++ goto out;
3942 ++
3943 + /* find the old dir entry and read the data */
3944 + err = hfsplus_cat_build_key(sb, src_fd.search_key,
3945 + src_dir->i_ino, src_name);
3946 +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
3947 +index feca524ce2a5..d93c051559cb 100644
3948 +--- a/fs/hfsplus/extents.c
3949 ++++ b/fs/hfsplus/extents.c
3950 +@@ -99,6 +99,10 @@ static int __hfsplus_ext_write_extent(struct inode *inode,
3951 + if (hip->extent_state & HFSPLUS_EXT_NEW) {
3952 + if (res != -ENOENT)
3953 + return res;
3954 ++ /* Fail early and avoid ENOSPC during the btree operation */
3955 ++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1);
3956 ++ if (res)
3957 ++ return res;
3958 + hfs_brec_insert(fd, hip->cached_extents,
3959 + sizeof(hfsplus_extent_rec));
3960 + hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW);
3961 +@@ -232,7 +236,9 @@ int hfsplus_get_block(struct inode *inode, sector_t iblock,
3962 + ablock = iblock >> sbi->fs_shift;
3963 +
3964 + if (iblock >= hip->fs_blocks) {
3965 +- if (iblock > hip->fs_blocks || !create)
3966 ++ if (!create)
3967 ++ return 0;
3968 ++ if (iblock > hip->fs_blocks)
3969 + return -EIO;
3970 + if (ablock >= hip->alloc_blocks) {
3971 + res = hfsplus_file_extend(inode, false);
3972 +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
3973 +index a3f03b247463..35cd703c6604 100644
3974 +--- a/fs/hfsplus/hfsplus_fs.h
3975 ++++ b/fs/hfsplus/hfsplus_fs.h
3976 +@@ -311,6 +311,7 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb)
3977 + #define hfs_btree_open hfsplus_btree_open
3978 + #define hfs_btree_close hfsplus_btree_close
3979 + #define hfs_btree_write hfsplus_btree_write
3980 ++#define hfs_bmap_reserve hfsplus_bmap_reserve
3981 + #define hfs_bmap_alloc hfsplus_bmap_alloc
3982 + #define hfs_bmap_free hfsplus_bmap_free
3983 + #define hfs_bnode_read hfsplus_bnode_read
3984 +@@ -395,6 +396,7 @@ u32 hfsplus_calc_btree_clump_size(u32 block_size, u32 node_size, u64 sectors,
3985 + struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id);
3986 + void hfs_btree_close(struct hfs_btree *tree);
3987 + int hfs_btree_write(struct hfs_btree *tree);
3988 ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes);
3989 + struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree);
3990 + void hfs_bmap_free(struct hfs_bnode *node);
3991 +
3992 +diff --git a/fs/hfsplus/inode.c b/fs/hfsplus/inode.c
3993 +index 2e796f8302ff..cfd380e2743d 100644
3994 +--- a/fs/hfsplus/inode.c
3995 ++++ b/fs/hfsplus/inode.c
3996 +@@ -260,6 +260,7 @@ static int hfsplus_setattr(struct dentry *dentry, struct iattr *attr)
3997 + }
3998 + truncate_setsize(inode, attr->ia_size);
3999 + hfsplus_file_truncate(inode);
4000 ++ inode->i_mtime = inode->i_ctime = current_time(inode);
4001 + }
4002 +
4003 + setattr_copy(inode, attr);
4004 +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
4005 +index 935bac253991..1403c88f2b05 100644
4006 +--- a/fs/ocfs2/buffer_head_io.c
4007 ++++ b/fs/ocfs2/buffer_head_io.c
4008 +@@ -98,25 +98,34 @@ out:
4009 + return ret;
4010 + }
4011 +
4012 ++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
4013 ++ * will be easier to handle read failure.
4014 ++ */
4015 + int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
4016 + unsigned int nr, struct buffer_head *bhs[])
4017 + {
4018 + int status = 0;
4019 + unsigned int i;
4020 + struct buffer_head *bh;
4021 ++ int new_bh = 0;
4022 +
4023 + trace_ocfs2_read_blocks_sync((unsigned long long)block, nr);
4024 +
4025 + if (!nr)
4026 + goto bail;
4027 +
4028 ++ /* Don't put buffer head and re-assign it to NULL if it is allocated
4029 ++ * outside since the caller can't be aware of this alternation!
4030 ++ */
4031 ++ new_bh = (bhs[0] == NULL);
4032 ++
4033 + for (i = 0 ; i < nr ; i++) {
4034 + if (bhs[i] == NULL) {
4035 + bhs[i] = sb_getblk(osb->sb, block++);
4036 + if (bhs[i] == NULL) {
4037 + status = -ENOMEM;
4038 + mlog_errno(status);
4039 +- goto bail;
4040 ++ break;
4041 + }
4042 + }
4043 + bh = bhs[i];
4044 +@@ -156,9 +165,26 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
4045 + submit_bh(REQ_OP_READ, 0, bh);
4046 + }
4047 +
4048 ++read_failure:
4049 + for (i = nr; i > 0; i--) {
4050 + bh = bhs[i - 1];
4051 +
4052 ++ if (unlikely(status)) {
4053 ++ if (new_bh && bh) {
4054 ++ /* If middle bh fails, let previous bh
4055 ++ * finish its read and then put it to
4056 ++ * aovoid bh leak
4057 ++ */
4058 ++ if (!buffer_jbd(bh))
4059 ++ wait_on_buffer(bh);
4060 ++ put_bh(bh);
4061 ++ bhs[i - 1] = NULL;
4062 ++ } else if (bh && buffer_uptodate(bh)) {
4063 ++ clear_buffer_uptodate(bh);
4064 ++ }
4065 ++ continue;
4066 ++ }
4067 ++
4068 + /* No need to wait on the buffer if it's managed by JBD. */
4069 + if (!buffer_jbd(bh))
4070 + wait_on_buffer(bh);
4071 +@@ -168,8 +194,7 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block,
4072 + * so we can safely record this and loop back
4073 + * to cleanup the other buffers. */
4074 + status = -EIO;
4075 +- put_bh(bh);
4076 +- bhs[i - 1] = NULL;
4077 ++ goto read_failure;
4078 + }
4079 + }
4080 +
4081 +@@ -177,6 +202,9 @@ bail:
4082 + return status;
4083 + }
4084 +
4085 ++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it
4086 ++ * will be easier to handle read failure.
4087 ++ */
4088 + int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4089 + struct buffer_head *bhs[], int flags,
4090 + int (*validate)(struct super_block *sb,
4091 +@@ -186,6 +214,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4092 + int i, ignore_cache = 0;
4093 + struct buffer_head *bh;
4094 + struct super_block *sb = ocfs2_metadata_cache_get_super(ci);
4095 ++ int new_bh = 0;
4096 +
4097 + trace_ocfs2_read_blocks_begin(ci, (unsigned long long)block, nr, flags);
4098 +
4099 +@@ -211,6 +240,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4100 + goto bail;
4101 + }
4102 +
4103 ++ /* Don't put buffer head and re-assign it to NULL if it is allocated
4104 ++ * outside since the caller can't be aware of this alternation!
4105 ++ */
4106 ++ new_bh = (bhs[0] == NULL);
4107 ++
4108 + ocfs2_metadata_cache_io_lock(ci);
4109 + for (i = 0 ; i < nr ; i++) {
4110 + if (bhs[i] == NULL) {
4111 +@@ -219,7 +253,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4112 + ocfs2_metadata_cache_io_unlock(ci);
4113 + status = -ENOMEM;
4114 + mlog_errno(status);
4115 +- goto bail;
4116 ++ /* Don't forget to put previous bh! */
4117 ++ break;
4118 + }
4119 + }
4120 + bh = bhs[i];
4121 +@@ -313,16 +348,27 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4122 + }
4123 + }
4124 +
4125 +- status = 0;
4126 +-
4127 ++read_failure:
4128 + for (i = (nr - 1); i >= 0; i--) {
4129 + bh = bhs[i];
4130 +
4131 + if (!(flags & OCFS2_BH_READAHEAD)) {
4132 +- if (status) {
4133 +- /* Clear the rest of the buffers on error */
4134 +- put_bh(bh);
4135 +- bhs[i] = NULL;
4136 ++ if (unlikely(status)) {
4137 ++ /* Clear the buffers on error including those
4138 ++ * ever succeeded in reading
4139 ++ */
4140 ++ if (new_bh && bh) {
4141 ++ /* If middle bh fails, let previous bh
4142 ++ * finish its read and then put it to
4143 ++ * aovoid bh leak
4144 ++ */
4145 ++ if (!buffer_jbd(bh))
4146 ++ wait_on_buffer(bh);
4147 ++ put_bh(bh);
4148 ++ bhs[i] = NULL;
4149 ++ } else if (bh && buffer_uptodate(bh)) {
4150 ++ clear_buffer_uptodate(bh);
4151 ++ }
4152 + continue;
4153 + }
4154 + /* We know this can't have changed as we hold the
4155 +@@ -340,9 +386,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4156 + * uptodate. */
4157 + status = -EIO;
4158 + clear_buffer_needs_validate(bh);
4159 +- put_bh(bh);
4160 +- bhs[i] = NULL;
4161 +- continue;
4162 ++ goto read_failure;
4163 + }
4164 +
4165 + if (buffer_needs_validate(bh)) {
4166 +@@ -352,11 +396,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
4167 + BUG_ON(buffer_jbd(bh));
4168 + clear_buffer_needs_validate(bh);
4169 + status = validate(sb, bh);
4170 +- if (status) {
4171 +- put_bh(bh);
4172 +- bhs[i] = NULL;
4173 +- continue;
4174 +- }
4175 ++ if (status)
4176 ++ goto read_failure;
4177 + }
4178 + }
4179 +
4180 +diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
4181 +index e7b760deefae..32d60f69db24 100644
4182 +--- a/fs/ocfs2/dlm/dlmdebug.c
4183 ++++ b/fs/ocfs2/dlm/dlmdebug.c
4184 +@@ -329,7 +329,7 @@ void dlm_print_one_mle(struct dlm_master_list_entry *mle)
4185 + {
4186 + char *buf;
4187 +
4188 +- buf = (char *) get_zeroed_page(GFP_NOFS);
4189 ++ buf = (char *) get_zeroed_page(GFP_ATOMIC);
4190 + if (buf) {
4191 + dump_mle(mle, buf, PAGE_SIZE - 1);
4192 + free_page((unsigned long)buf);
4193 +diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
4194 +index 5729d55da67d..2c3e975126b3 100644
4195 +--- a/fs/ocfs2/dlmglue.c
4196 ++++ b/fs/ocfs2/dlmglue.c
4197 +@@ -3421,7 +3421,7 @@ static int ocfs2_downconvert_lock(struct ocfs2_super *osb,
4198 + * we can recover correctly from node failure. Otherwise, we may get
4199 + * invalid LVB in LKB, but without DLM_SBF_VALNOTVALID being set.
4200 + */
4201 +- if (!ocfs2_is_o2cb_active() &&
4202 ++ if (ocfs2_userspace_stack(osb) &&
4203 + lockres->l_ops->flags & LOCK_TYPE_USES_LVB)
4204 + lvb = 1;
4205 +
4206 +diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c
4207 +index c179afd0051a..afaa044f5f6b 100644
4208 +--- a/fs/ocfs2/move_extents.c
4209 ++++ b/fs/ocfs2/move_extents.c
4210 +@@ -25,6 +25,7 @@
4211 + #include "ocfs2_ioctl.h"
4212 +
4213 + #include "alloc.h"
4214 ++#include "localalloc.h"
4215 + #include "aops.h"
4216 + #include "dlmglue.h"
4217 + #include "extent_map.h"
4218 +@@ -222,6 +223,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
4219 + struct ocfs2_refcount_tree *ref_tree = NULL;
4220 + u32 new_phys_cpos, new_len;
4221 + u64 phys_blkno = ocfs2_clusters_to_blocks(inode->i_sb, phys_cpos);
4222 ++ int need_free = 0;
4223 +
4224 + if ((ext_flags & OCFS2_EXT_REFCOUNTED) && *len) {
4225 +
4226 +@@ -315,6 +317,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
4227 + if (!partial) {
4228 + context->range->me_flags &= ~OCFS2_MOVE_EXT_FL_COMPLETE;
4229 + ret = -ENOSPC;
4230 ++ need_free = 1;
4231 + goto out_commit;
4232 + }
4233 + }
4234 +@@ -339,6 +342,20 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context,
4235 + mlog_errno(ret);
4236 +
4237 + out_commit:
4238 ++ if (need_free && context->data_ac) {
4239 ++ struct ocfs2_alloc_context *data_ac = context->data_ac;
4240 ++
4241 ++ if (context->data_ac->ac_which == OCFS2_AC_USE_LOCAL)
4242 ++ ocfs2_free_local_alloc_bits(osb, handle, data_ac,
4243 ++ new_phys_cpos, new_len);
4244 ++ else
4245 ++ ocfs2_free_clusters(handle,
4246 ++ data_ac->ac_inode,
4247 ++ data_ac->ac_bh,
4248 ++ ocfs2_clusters_to_blocks(osb->sb, new_phys_cpos),
4249 ++ new_len);
4250 ++ }
4251 ++
4252 + ocfs2_commit_trans(osb, handle);
4253 +
4254 + out_unlock_mutex:
4255 +diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c
4256 +index 820359096c7a..52c07346bea3 100644
4257 +--- a/fs/ocfs2/stackglue.c
4258 ++++ b/fs/ocfs2/stackglue.c
4259 +@@ -48,12 +48,6 @@ static char ocfs2_hb_ctl_path[OCFS2_MAX_HB_CTL_PATH] = "/sbin/ocfs2_hb_ctl";
4260 + */
4261 + static struct ocfs2_stack_plugin *active_stack;
4262 +
4263 +-inline int ocfs2_is_o2cb_active(void)
4264 +-{
4265 +- return !strcmp(active_stack->sp_name, OCFS2_STACK_PLUGIN_O2CB);
4266 +-}
4267 +-EXPORT_SYMBOL_GPL(ocfs2_is_o2cb_active);
4268 +-
4269 + static struct ocfs2_stack_plugin *ocfs2_stack_lookup(const char *name)
4270 + {
4271 + struct ocfs2_stack_plugin *p;
4272 +diff --git a/fs/ocfs2/stackglue.h b/fs/ocfs2/stackglue.h
4273 +index e3036e1790e8..f2dce10fae54 100644
4274 +--- a/fs/ocfs2/stackglue.h
4275 ++++ b/fs/ocfs2/stackglue.h
4276 +@@ -298,9 +298,6 @@ void ocfs2_stack_glue_set_max_proto_version(struct ocfs2_protocol_version *max_p
4277 + int ocfs2_stack_glue_register(struct ocfs2_stack_plugin *plugin);
4278 + void ocfs2_stack_glue_unregister(struct ocfs2_stack_plugin *plugin);
4279 +
4280 +-/* In ocfs2_downconvert_lock(), we need to know which stack we are using */
4281 +-int ocfs2_is_o2cb_active(void);
4282 +-
4283 + extern struct kset *ocfs2_kset;
4284 +
4285 + #endif /* STACKGLUE_H */
4286 +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
4287 +index c387467d574c..e108c945ac1f 100644
4288 +--- a/fs/ocfs2/xattr.c
4289 ++++ b/fs/ocfs2/xattr.c
4290 +@@ -1497,6 +1497,18 @@ static int ocfs2_xa_check_space(struct ocfs2_xa_loc *loc,
4291 + return loc->xl_ops->xlo_check_space(loc, xi);
4292 + }
4293 +
4294 ++static void ocfs2_xa_add_entry(struct ocfs2_xa_loc *loc, u32 name_hash)
4295 ++{
4296 ++ loc->xl_ops->xlo_add_entry(loc, name_hash);
4297 ++ loc->xl_entry->xe_name_hash = cpu_to_le32(name_hash);
4298 ++ /*
4299 ++ * We can't leave the new entry's xe_name_offset at zero or
4300 ++ * add_namevalue() will go nuts. We set it to the size of our
4301 ++ * storage so that it can never be less than any other entry.
4302 ++ */
4303 ++ loc->xl_entry->xe_name_offset = cpu_to_le16(loc->xl_size);
4304 ++}
4305 ++
4306 + static void ocfs2_xa_add_namevalue(struct ocfs2_xa_loc *loc,
4307 + struct ocfs2_xattr_info *xi)
4308 + {
4309 +@@ -2128,31 +2140,29 @@ static int ocfs2_xa_prepare_entry(struct ocfs2_xa_loc *loc,
4310 + if (rc)
4311 + goto out;
4312 +
4313 +- if (!loc->xl_entry) {
4314 +- rc = -EINVAL;
4315 +- goto out;
4316 +- }
4317 +-
4318 +- if (ocfs2_xa_can_reuse_entry(loc, xi)) {
4319 +- orig_value_size = loc->xl_entry->xe_value_size;
4320 +- rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
4321 +- if (rc)
4322 +- goto out;
4323 +- goto alloc_value;
4324 +- }
4325 ++ if (loc->xl_entry) {
4326 ++ if (ocfs2_xa_can_reuse_entry(loc, xi)) {
4327 ++ orig_value_size = loc->xl_entry->xe_value_size;
4328 ++ rc = ocfs2_xa_reuse_entry(loc, xi, ctxt);
4329 ++ if (rc)
4330 ++ goto out;
4331 ++ goto alloc_value;
4332 ++ }
4333 +
4334 +- if (!ocfs2_xattr_is_local(loc->xl_entry)) {
4335 +- orig_clusters = ocfs2_xa_value_clusters(loc);
4336 +- rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
4337 +- if (rc) {
4338 +- mlog_errno(rc);
4339 +- ocfs2_xa_cleanup_value_truncate(loc,
4340 +- "overwriting",
4341 +- orig_clusters);
4342 +- goto out;
4343 ++ if (!ocfs2_xattr_is_local(loc->xl_entry)) {
4344 ++ orig_clusters = ocfs2_xa_value_clusters(loc);
4345 ++ rc = ocfs2_xa_value_truncate(loc, 0, ctxt);
4346 ++ if (rc) {
4347 ++ mlog_errno(rc);
4348 ++ ocfs2_xa_cleanup_value_truncate(loc,
4349 ++ "overwriting",
4350 ++ orig_clusters);
4351 ++ goto out;
4352 ++ }
4353 + }
4354 +- }
4355 +- ocfs2_xa_wipe_namevalue(loc);
4356 ++ ocfs2_xa_wipe_namevalue(loc);
4357 ++ } else
4358 ++ ocfs2_xa_add_entry(loc, name_hash);
4359 +
4360 + /*
4361 + * If we get here, we have a blank entry. Fill it. We grow our
4362 +diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
4363 +index 651755353374..0b58b9d419e8 100644
4364 +--- a/fs/xfs/xfs_buf.c
4365 ++++ b/fs/xfs/xfs_buf.c
4366 +@@ -57,6 +57,32 @@ static kmem_zone_t *xfs_buf_zone;
4367 + #define xb_to_gfp(flags) \
4368 + ((((flags) & XBF_READ_AHEAD) ? __GFP_NORETRY : GFP_NOFS) | __GFP_NOWARN)
4369 +
4370 ++/*
4371 ++ * Locking orders
4372 ++ *
4373 ++ * xfs_buf_ioacct_inc:
4374 ++ * xfs_buf_ioacct_dec:
4375 ++ * b_sema (caller holds)
4376 ++ * b_lock
4377 ++ *
4378 ++ * xfs_buf_stale:
4379 ++ * b_sema (caller holds)
4380 ++ * b_lock
4381 ++ * lru_lock
4382 ++ *
4383 ++ * xfs_buf_rele:
4384 ++ * b_lock
4385 ++ * pag_buf_lock
4386 ++ * lru_lock
4387 ++ *
4388 ++ * xfs_buftarg_wait_rele
4389 ++ * lru_lock
4390 ++ * b_lock (trylock due to inversion)
4391 ++ *
4392 ++ * xfs_buftarg_isolate
4393 ++ * lru_lock
4394 ++ * b_lock (trylock due to inversion)
4395 ++ */
4396 +
4397 + static inline int
4398 + xfs_buf_is_vmapped(
4399 +@@ -957,8 +983,18 @@ xfs_buf_rele(
4400 +
4401 + ASSERT(atomic_read(&bp->b_hold) > 0);
4402 +
4403 +- release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
4404 ++ /*
4405 ++ * We grab the b_lock here first to serialise racing xfs_buf_rele()
4406 ++ * calls. The pag_buf_lock being taken on the last reference only
4407 ++ * serialises against racing lookups in xfs_buf_find(). IOWs, the second
4408 ++ * to last reference we drop here is not serialised against the last
4409 ++ * reference until we take bp->b_lock. Hence if we don't grab b_lock
4410 ++ * first, the last "release" reference can win the race to the lock and
4411 ++ * free the buffer before the second-to-last reference is processed,
4412 ++ * leading to a use-after-free scenario.
4413 ++ */
4414 + spin_lock(&bp->b_lock);
4415 ++ release = atomic_dec_and_lock(&bp->b_hold, &pag->pag_buf_lock);
4416 + if (!release) {
4417 + /*
4418 + * Drop the in-flight state if the buffer is already on the LRU
4419 +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
4420 +index 3b77588a9360..dec03c0dbc21 100644
4421 +--- a/include/linux/bitmap.h
4422 ++++ b/include/linux/bitmap.h
4423 +@@ -185,8 +185,13 @@ extern int bitmap_print_to_pagebuf(bool list, char *buf,
4424 + #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
4425 + #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))
4426 +
4427 ++/*
4428 ++ * The static inlines below do not handle constant nbits==0 correctly,
4429 ++ * so make such users (should any ever turn up) call the out-of-line
4430 ++ * versions.
4431 ++ */
4432 + #define small_const_nbits(nbits) \
4433 +- (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG)
4434 ++ (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG && (nbits) > 0)
4435 +
4436 + static inline void bitmap_zero(unsigned long *dst, unsigned int nbits)
4437 + {
4438 +@@ -316,7 +321,7 @@ static __always_inline int bitmap_weight(const unsigned long *src, unsigned int
4439 + }
4440 +
4441 + static inline void bitmap_shift_right(unsigned long *dst, const unsigned long *src,
4442 +- unsigned int shift, int nbits)
4443 ++ unsigned int shift, unsigned int nbits)
4444 + {
4445 + if (small_const_nbits(nbits))
4446 + *dst = (*src & BITMAP_LAST_WORD_MASK(nbits)) >> shift;
4447 +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
4448 +index 0590e7d47b02..ab90a8541aaa 100644
4449 +--- a/include/linux/kvm_host.h
4450 ++++ b/include/linux/kvm_host.h
4451 +@@ -843,6 +843,7 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu);
4452 + void kvm_vcpu_kick(struct kvm_vcpu *vcpu);
4453 +
4454 + bool kvm_is_reserved_pfn(kvm_pfn_t pfn);
4455 ++bool kvm_is_zone_device_pfn(kvm_pfn_t pfn);
4456 +
4457 + struct kvm_irq_ack_notifier {
4458 + struct hlist_node link;
4459 +diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
4460 +index 134a2f69c21a..9469eef30095 100644
4461 +--- a/include/linux/memory_hotplug.h
4462 ++++ b/include/linux/memory_hotplug.h
4463 +@@ -272,6 +272,7 @@ static inline void remove_memory(int nid, u64 start, u64 size) {}
4464 +
4465 + extern int walk_memory_range(unsigned long start_pfn, unsigned long end_pfn,
4466 + void *arg, int (*func)(struct memory_block *, void *));
4467 ++extern int __add_memory(int nid, u64 start, u64 size);
4468 + extern int add_memory(int nid, u64 start, u64 size);
4469 + extern int add_memory_resource(int nid, struct resource *resource, bool online);
4470 + extern int zone_for_memory(int nid, u64 start, u64 size, int zone_default,
4471 +diff --git a/include/linux/mfd/max8997.h b/include/linux/mfd/max8997.h
4472 +index cf815577bd68..3ae1fe743bc3 100644
4473 +--- a/include/linux/mfd/max8997.h
4474 ++++ b/include/linux/mfd/max8997.h
4475 +@@ -178,7 +178,6 @@ struct max8997_led_platform_data {
4476 + struct max8997_platform_data {
4477 + /* IRQ */
4478 + int ono;
4479 +- int wakeup;
4480 +
4481 + /* ---- PMIC ---- */
4482 + struct max8997_regulator_data *regulators;
4483 +diff --git a/include/linux/mfd/mc13xxx.h b/include/linux/mfd/mc13xxx.h
4484 +index 638222e43e48..93011c61aafd 100644
4485 +--- a/include/linux/mfd/mc13xxx.h
4486 ++++ b/include/linux/mfd/mc13xxx.h
4487 +@@ -247,6 +247,7 @@ struct mc13xxx_platform_data {
4488 + #define MC13XXX_ADC0_TSMOD0 (1 << 12)
4489 + #define MC13XXX_ADC0_TSMOD1 (1 << 13)
4490 + #define MC13XXX_ADC0_TSMOD2 (1 << 14)
4491 ++#define MC13XXX_ADC0_CHRGRAWDIV (1 << 15)
4492 + #define MC13XXX_ADC0_ADINC1 (1 << 16)
4493 + #define MC13XXX_ADC0_ADINC2 (1 << 17)
4494 +
4495 +diff --git a/kernel/auditsc.c b/kernel/auditsc.c
4496 +index c2aaf539728f..854e90be1a02 100644
4497 +--- a/kernel/auditsc.c
4498 ++++ b/kernel/auditsc.c
4499 +@@ -1096,7 +1096,7 @@ static void audit_log_execve_info(struct audit_context *context,
4500 + }
4501 +
4502 + /* write as much as we can to the audit log */
4503 +- if (len_buf > 0) {
4504 ++ if (len_buf >= 0) {
4505 + /* NOTE: some magic numbers here - basically if we
4506 + * can't fit a reasonable amount of data into the
4507 + * existing audit buffer, flush it and start with
4508 +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
4509 +index a0339c458c14..c1873d325ebd 100644
4510 +--- a/kernel/printk/printk.c
4511 ++++ b/kernel/printk/printk.c
4512 +@@ -1050,7 +1050,7 @@ void __init setup_log_buf(int early)
4513 + {
4514 + unsigned long flags;
4515 + char *new_log_buf;
4516 +- int free;
4517 ++ unsigned int free;
4518 +
4519 + if (log_buf != __log_buf)
4520 + return;
4521 +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
4522 +index d8afae1bd5c5..b765a58cf20f 100644
4523 +--- a/kernel/sched/fair.c
4524 ++++ b/kernel/sched/fair.c
4525 +@@ -7950,13 +7950,22 @@ out_all_pinned:
4526 + sd->nr_balance_failed = 0;
4527 +
4528 + out_one_pinned:
4529 ++ ld_moved = 0;
4530 ++
4531 ++ /*
4532 ++ * idle_balance() disregards balance intervals, so we could repeatedly
4533 ++ * reach this code, which would lead to balance_interval skyrocketting
4534 ++ * in a short amount of time. Skip the balance_interval increase logic
4535 ++ * to avoid that.
4536 ++ */
4537 ++ if (env.idle == CPU_NEWLY_IDLE)
4538 ++ goto out;
4539 ++
4540 + /* tune up the balancing interval */
4541 + if (((env.flags & LBF_ALL_PINNED) &&
4542 + sd->balance_interval < MAX_PINNED_INTERVAL) ||
4543 + (sd->balance_interval < sd->max_interval))
4544 + sd->balance_interval *= 2;
4545 +-
4546 +- ld_moved = 0;
4547 + out:
4548 + return ld_moved;
4549 + }
4550 +diff --git a/mm/ksm.c b/mm/ksm.c
4551 +index 614b2cce9ad7..d6c81a5076a7 100644
4552 +--- a/mm/ksm.c
4553 ++++ b/mm/ksm.c
4554 +@@ -710,13 +710,13 @@ static int remove_stable_node(struct stable_node *stable_node)
4555 + return 0;
4556 + }
4557 +
4558 +- if (WARN_ON_ONCE(page_mapped(page))) {
4559 +- /*
4560 +- * This should not happen: but if it does, just refuse to let
4561 +- * merge_across_nodes be switched - there is no need to panic.
4562 +- */
4563 +- err = -EBUSY;
4564 +- } else {
4565 ++ /*
4566 ++ * Page could be still mapped if this races with __mmput() running in
4567 ++ * between ksm_exit() and exit_mmap(). Just refuse to let
4568 ++ * merge_across_nodes/max_page_sharing be switched.
4569 ++ */
4570 ++ err = -EBUSY;
4571 ++ if (!page_mapped(page)) {
4572 + /*
4573 + * The stable node did not yet appear stale to get_ksm_page(),
4574 + * since that allows for an unmapped ksm page to be recognized
4575 +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
4576 +index b4c8d7b9ab82..449999657c0b 100644
4577 +--- a/mm/memory_hotplug.c
4578 ++++ b/mm/memory_hotplug.c
4579 +@@ -1340,7 +1340,12 @@ static int online_memory_block(struct memory_block *mem, void *arg)
4580 + return memory_block_change_state(mem, MEM_ONLINE, MEM_OFFLINE);
4581 + }
4582 +
4583 +-/* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */
4584 ++/*
4585 ++ * NOTE: The caller must call lock_device_hotplug() to serialize hotplug
4586 ++ * and online/offline operations (triggered e.g. by sysfs).
4587 ++ *
4588 ++ * we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG
4589 ++ */
4590 + int __ref add_memory_resource(int nid, struct resource *res, bool online)
4591 + {
4592 + u64 start, size;
4593 +@@ -1418,9 +1423,9 @@ out:
4594 + mem_hotplug_done();
4595 + return ret;
4596 + }
4597 +-EXPORT_SYMBOL_GPL(add_memory_resource);
4598 +
4599 +-int __ref add_memory(int nid, u64 start, u64 size)
4600 ++/* requires device_hotplug_lock, see add_memory_resource() */
4601 ++int __ref __add_memory(int nid, u64 start, u64 size)
4602 + {
4603 + struct resource *res;
4604 + int ret;
4605 +@@ -1434,6 +1439,17 @@ int __ref add_memory(int nid, u64 start, u64 size)
4606 + release_memory_resource(res);
4607 + return ret;
4608 + }
4609 ++
4610 ++int add_memory(int nid, u64 start, u64 size)
4611 ++{
4612 ++ int rc;
4613 ++
4614 ++ lock_device_hotplug();
4615 ++ rc = __add_memory(nid, start, size);
4616 ++ unlock_device_hotplug();
4617 ++
4618 ++ return rc;
4619 ++}
4620 + EXPORT_SYMBOL_GPL(add_memory);
4621 +
4622 + #ifdef CONFIG_MEMORY_HOTREMOVE
4623 +diff --git a/mm/page-writeback.c b/mm/page-writeback.c
4624 +index 281a46aeae61..f6a376a51099 100644
4625 +--- a/mm/page-writeback.c
4626 ++++ b/mm/page-writeback.c
4627 +@@ -2141,6 +2141,13 @@ EXPORT_SYMBOL(tag_pages_for_writeback);
4628 + * not miss some pages (e.g., because some other process has cleared TOWRITE
4629 + * tag we set). The rule we follow is that TOWRITE tag can be cleared only
4630 + * by the process clearing the DIRTY tag (and submitting the page for IO).
4631 ++ *
4632 ++ * To avoid deadlocks between range_cyclic writeback and callers that hold
4633 ++ * pages in PageWriteback to aggregate IO until write_cache_pages() returns,
4634 ++ * we do not loop back to the start of the file. Doing so causes a page
4635 ++ * lock/page writeback access order inversion - we should only ever lock
4636 ++ * multiple pages in ascending page->index order, and looping back to the start
4637 ++ * of the file violates that rule and causes deadlocks.
4638 + */
4639 + int write_cache_pages(struct address_space *mapping,
4640 + struct writeback_control *wbc, writepage_t writepage,
4641 +@@ -2155,7 +2162,6 @@ int write_cache_pages(struct address_space *mapping,
4642 + pgoff_t index;
4643 + pgoff_t end; /* Inclusive */
4644 + pgoff_t done_index;
4645 +- int cycled;
4646 + int range_whole = 0;
4647 + int tag;
4648 +
4649 +@@ -2163,23 +2169,17 @@ int write_cache_pages(struct address_space *mapping,
4650 + if (wbc->range_cyclic) {
4651 + writeback_index = mapping->writeback_index; /* prev offset */
4652 + index = writeback_index;
4653 +- if (index == 0)
4654 +- cycled = 1;
4655 +- else
4656 +- cycled = 0;
4657 + end = -1;
4658 + } else {
4659 + index = wbc->range_start >> PAGE_SHIFT;
4660 + end = wbc->range_end >> PAGE_SHIFT;
4661 + if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
4662 + range_whole = 1;
4663 +- cycled = 1; /* ignore range_cyclic tests */
4664 + }
4665 + if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
4666 + tag = PAGECACHE_TAG_TOWRITE;
4667 + else
4668 + tag = PAGECACHE_TAG_DIRTY;
4669 +-retry:
4670 + if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
4671 + tag_pages_for_writeback(mapping, index, end);
4672 + done_index = index;
4673 +@@ -2287,17 +2287,14 @@ continue_unlock:
4674 + pagevec_release(&pvec);
4675 + cond_resched();
4676 + }
4677 +- if (!cycled && !done) {
4678 +- /*
4679 +- * range_cyclic:
4680 +- * We hit the last page and there is more work to be done: wrap
4681 +- * back to the start of the file
4682 +- */
4683 +- cycled = 1;
4684 +- index = 0;
4685 +- end = writeback_index - 1;
4686 +- goto retry;
4687 +- }
4688 ++
4689 ++ /*
4690 ++ * If we hit the last page and there is more work to be done: wrap
4691 ++ * back the index back to the start of the file for the next
4692 ++ * time we are called.
4693 ++ */
4694 ++ if (wbc->range_cyclic && !done)
4695 ++ done_index = 0;
4696 + if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
4697 + mapping->writeback_index = done_index;
4698 +
4699 +diff --git a/net/core/dev.c b/net/core/dev.c
4700 +index 547b4daae5ca..c6fb7e61cb40 100644
4701 +--- a/net/core/dev.c
4702 ++++ b/net/core/dev.c
4703 +@@ -2997,7 +2997,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de
4704 + }
4705 +
4706 + skb = next;
4707 +- if (netif_xmit_stopped(txq) && skb) {
4708 ++ if (netif_tx_queue_stopped(txq) && skb) {
4709 + rc = NETDEV_TX_BUSY;
4710 + break;
4711 + }
4712 +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
4713 +index ba724576764e..ead1a32c68f7 100644
4714 +--- a/net/core/rtnetlink.c
4715 ++++ b/net/core/rtnetlink.c
4716 +@@ -1724,6 +1724,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4717 + if (tb[IFLA_VF_MAC]) {
4718 + struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
4719 +
4720 ++ if (ivm->vf >= INT_MAX)
4721 ++ return -EINVAL;
4722 + err = -EOPNOTSUPP;
4723 + if (ops->ndo_set_vf_mac)
4724 + err = ops->ndo_set_vf_mac(dev, ivm->vf,
4725 +@@ -1735,6 +1737,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4726 + if (tb[IFLA_VF_VLAN]) {
4727 + struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
4728 +
4729 ++ if (ivv->vf >= INT_MAX)
4730 ++ return -EINVAL;
4731 + err = -EOPNOTSUPP;
4732 + if (ops->ndo_set_vf_vlan)
4733 + err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
4734 +@@ -1767,6 +1771,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4735 + if (len == 0)
4736 + return -EINVAL;
4737 +
4738 ++ if (ivvl[0]->vf >= INT_MAX)
4739 ++ return -EINVAL;
4740 + err = ops->ndo_set_vf_vlan(dev, ivvl[0]->vf, ivvl[0]->vlan,
4741 + ivvl[0]->qos, ivvl[0]->vlan_proto);
4742 + if (err < 0)
4743 +@@ -1777,6 +1783,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4744 + struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
4745 + struct ifla_vf_info ivf;
4746 +
4747 ++ if (ivt->vf >= INT_MAX)
4748 ++ return -EINVAL;
4749 + err = -EOPNOTSUPP;
4750 + if (ops->ndo_get_vf_config)
4751 + err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
4752 +@@ -1795,6 +1803,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4753 + if (tb[IFLA_VF_RATE]) {
4754 + struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
4755 +
4756 ++ if (ivt->vf >= INT_MAX)
4757 ++ return -EINVAL;
4758 + err = -EOPNOTSUPP;
4759 + if (ops->ndo_set_vf_rate)
4760 + err = ops->ndo_set_vf_rate(dev, ivt->vf,
4761 +@@ -1807,6 +1817,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4762 + if (tb[IFLA_VF_SPOOFCHK]) {
4763 + struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
4764 +
4765 ++ if (ivs->vf >= INT_MAX)
4766 ++ return -EINVAL;
4767 + err = -EOPNOTSUPP;
4768 + if (ops->ndo_set_vf_spoofchk)
4769 + err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
4770 +@@ -1818,6 +1830,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4771 + if (tb[IFLA_VF_LINK_STATE]) {
4772 + struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
4773 +
4774 ++ if (ivl->vf >= INT_MAX)
4775 ++ return -EINVAL;
4776 + err = -EOPNOTSUPP;
4777 + if (ops->ndo_set_vf_link_state)
4778 + err = ops->ndo_set_vf_link_state(dev, ivl->vf,
4779 +@@ -1831,6 +1845,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4780 +
4781 + err = -EOPNOTSUPP;
4782 + ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
4783 ++ if (ivrssq_en->vf >= INT_MAX)
4784 ++ return -EINVAL;
4785 + if (ops->ndo_set_vf_rss_query_en)
4786 + err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
4787 + ivrssq_en->setting);
4788 +@@ -1841,6 +1857,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4789 + if (tb[IFLA_VF_TRUST]) {
4790 + struct ifla_vf_trust *ivt = nla_data(tb[IFLA_VF_TRUST]);
4791 +
4792 ++ if (ivt->vf >= INT_MAX)
4793 ++ return -EINVAL;
4794 + err = -EOPNOTSUPP;
4795 + if (ops->ndo_set_vf_trust)
4796 + err = ops->ndo_set_vf_trust(dev, ivt->vf, ivt->setting);
4797 +@@ -1851,15 +1869,18 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
4798 + if (tb[IFLA_VF_IB_NODE_GUID]) {
4799 + struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_NODE_GUID]);
4800 +
4801 ++ if (ivt->vf >= INT_MAX)
4802 ++ return -EINVAL;
4803 + if (!ops->ndo_set_vf_guid)
4804 + return -EOPNOTSUPP;
4805 +-
4806 + return handle_vf_guid(dev, ivt, IFLA_VF_IB_NODE_GUID);
4807 + }
4808 +
4809 + if (tb[IFLA_VF_IB_PORT_GUID]) {
4810 + struct ifla_vf_guid *ivt = nla_data(tb[IFLA_VF_IB_PORT_GUID]);
4811 +
4812 ++ if (ivt->vf >= INT_MAX)
4813 ++ return -EINVAL;
4814 + if (!ops->ndo_set_vf_guid)
4815 + return -EOPNOTSUPP;
4816 +
4817 +diff --git a/net/core/sock.c b/net/core/sock.c
4818 +index d22493351407..9178c1654375 100644
4819 +--- a/net/core/sock.c
4820 ++++ b/net/core/sock.c
4821 +@@ -945,10 +945,12 @@ set_rcvbuf:
4822 + clear_bit(SOCK_PASSSEC, &sock->flags);
4823 + break;
4824 + case SO_MARK:
4825 +- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
4826 ++ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
4827 + ret = -EPERM;
4828 +- else
4829 ++ } else if (val != sk->sk_mark) {
4830 + sk->sk_mark = val;
4831 ++ sk_dst_reset(sk);
4832 ++ }
4833 + break;
4834 +
4835 + case SO_RXQ_OVFL:
4836 +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
4837 +index 03a696d3bcd9..4a88c4eb2301 100644
4838 +--- a/net/l2tp/l2tp_ip.c
4839 ++++ b/net/l2tp/l2tp_ip.c
4840 +@@ -116,6 +116,7 @@ static int l2tp_ip_recv(struct sk_buff *skb)
4841 + unsigned char *ptr, *optr;
4842 + struct l2tp_session *session;
4843 + struct l2tp_tunnel *tunnel = NULL;
4844 ++ struct iphdr *iph;
4845 + int length;
4846 +
4847 + if (!pskb_may_pull(skb, 4))
4848 +@@ -174,24 +175,17 @@ pass_up:
4849 + goto discard;
4850 +
4851 + tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
4852 +- tunnel = l2tp_tunnel_find(net, tunnel_id);
4853 +- if (tunnel) {
4854 +- sk = tunnel->sock;
4855 +- sock_hold(sk);
4856 +- } else {
4857 +- struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
4858 +-
4859 +- read_lock_bh(&l2tp_ip_lock);
4860 +- sk = __l2tp_ip_bind_lookup(net, iph->daddr, iph->saddr,
4861 +- inet_iif(skb), tunnel_id);
4862 +- if (!sk) {
4863 +- read_unlock_bh(&l2tp_ip_lock);
4864 +- goto discard;
4865 +- }
4866 ++ iph = (struct iphdr *)skb_network_header(skb);
4867 +
4868 +- sock_hold(sk);
4869 ++ read_lock_bh(&l2tp_ip_lock);
4870 ++ sk = __l2tp_ip_bind_lookup(net, iph->daddr, iph->saddr, inet_iif(skb),
4871 ++ tunnel_id);
4872 ++ if (!sk) {
4873 + read_unlock_bh(&l2tp_ip_lock);
4874 ++ goto discard;
4875 + }
4876 ++ sock_hold(sk);
4877 ++ read_unlock_bh(&l2tp_ip_lock);
4878 +
4879 + if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
4880 + goto discard_put;
4881 +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
4882 +index 8d412b9b0214..423cb095ad37 100644
4883 +--- a/net/l2tp/l2tp_ip6.c
4884 ++++ b/net/l2tp/l2tp_ip6.c
4885 +@@ -128,6 +128,7 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
4886 + unsigned char *ptr, *optr;
4887 + struct l2tp_session *session;
4888 + struct l2tp_tunnel *tunnel = NULL;
4889 ++ struct ipv6hdr *iph;
4890 + int length;
4891 +
4892 + if (!pskb_may_pull(skb, 4))
4893 +@@ -187,24 +188,17 @@ pass_up:
4894 + goto discard;
4895 +
4896 + tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
4897 +- tunnel = l2tp_tunnel_find(net, tunnel_id);
4898 +- if (tunnel) {
4899 +- sk = tunnel->sock;
4900 +- sock_hold(sk);
4901 +- } else {
4902 +- struct ipv6hdr *iph = ipv6_hdr(skb);
4903 +-
4904 +- read_lock_bh(&l2tp_ip6_lock);
4905 +- sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, &iph->saddr,
4906 +- inet6_iif(skb), tunnel_id);
4907 +- if (!sk) {
4908 +- read_unlock_bh(&l2tp_ip6_lock);
4909 +- goto discard;
4910 +- }
4911 ++ iph = ipv6_hdr(skb);
4912 +
4913 +- sock_hold(sk);
4914 ++ read_lock_bh(&l2tp_ip6_lock);
4915 ++ sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, &iph->saddr,
4916 ++ inet6_iif(skb), tunnel_id);
4917 ++ if (!sk) {
4918 + read_unlock_bh(&l2tp_ip6_lock);
4919 ++ goto discard;
4920 + }
4921 ++ sock_hold(sk);
4922 ++ read_unlock_bh(&l2tp_ip6_lock);
4923 +
4924 + if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
4925 + goto discard_put;
4926 +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
4927 +index cf9b2fe8eac6..9bebf4dc1c8e 100644
4928 +--- a/net/sched/act_pedit.c
4929 ++++ b/net/sched/act_pedit.c
4930 +@@ -54,13 +54,14 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
4931 + if (tb[TCA_PEDIT_PARMS] == NULL)
4932 + return -EINVAL;
4933 + parm = nla_data(tb[TCA_PEDIT_PARMS]);
4934 ++ if (!parm->nkeys)
4935 ++ return -EINVAL;
4936 ++
4937 + ksize = parm->nkeys * sizeof(struct tc_pedit_key);
4938 + if (nla_len(tb[TCA_PEDIT_PARMS]) < sizeof(*parm) + ksize)
4939 + return -EINVAL;
4940 +
4941 + if (!tcf_hash_check(tn, parm->index, a, bind)) {
4942 +- if (!parm->nkeys)
4943 +- return -EINVAL;
4944 + ret = tcf_hash_create(tn, parm->index, est, a,
4945 + &act_pedit_ops, bind, false);
4946 + if (ret)
4947 +diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
4948 +index 1d74d653e6c0..ad0dcb69395d 100644
4949 +--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
4950 ++++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
4951 +@@ -63,6 +63,7 @@
4952 + #include <linux/sunrpc/gss_krb5.h>
4953 + #include <linux/random.h>
4954 + #include <linux/crypto.h>
4955 ++#include <linux/atomic.h>
4956 +
4957 + #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
4958 + # define RPCDBG_FACILITY RPCDBG_AUTH
4959 +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
4960 +index 280fb3178708..f3f05148922a 100644
4961 +--- a/net/sunrpc/xprtsock.c
4962 ++++ b/net/sunrpc/xprtsock.c
4963 +@@ -124,7 +124,7 @@ static struct ctl_table xs_tunables_table[] = {
4964 + .mode = 0644,
4965 + .proc_handler = proc_dointvec_minmax,
4966 + .extra1 = &xprt_min_resvport_limit,
4967 +- .extra2 = &xprt_max_resvport
4968 ++ .extra2 = &xprt_max_resvport_limit
4969 + },
4970 + {
4971 + .procname = "max_resvport",
4972 +@@ -132,7 +132,7 @@ static struct ctl_table xs_tunables_table[] = {
4973 + .maxlen = sizeof(unsigned int),
4974 + .mode = 0644,
4975 + .proc_handler = proc_dointvec_minmax,
4976 +- .extra1 = &xprt_min_resvport,
4977 ++ .extra1 = &xprt_min_resvport_limit,
4978 + .extra2 = &xprt_max_resvport_limit
4979 + },
4980 + {
4981 +@@ -1737,11 +1737,17 @@ static void xs_udp_timer(struct rpc_xprt *xprt, struct rpc_task *task)
4982 + xprt_adjust_cwnd(xprt, task, -ETIMEDOUT);
4983 + }
4984 +
4985 +-static unsigned short xs_get_random_port(void)
4986 ++static int xs_get_random_port(void)
4987 + {
4988 +- unsigned short range = xprt_max_resvport - xprt_min_resvport + 1;
4989 +- unsigned short rand = (unsigned short) prandom_u32() % range;
4990 +- return rand + xprt_min_resvport;
4991 ++ unsigned short min = xprt_min_resvport, max = xprt_max_resvport;
4992 ++ unsigned short range;
4993 ++ unsigned short rand;
4994 ++
4995 ++ if (max < min)
4996 ++ return -EADDRINUSE;
4997 ++ range = max - min + 1;
4998 ++ rand = (unsigned short) prandom_u32() % range;
4999 ++ return rand + min;
5000 + }
5001 +
5002 + /**
5003 +@@ -1798,9 +1804,9 @@ static void xs_set_srcport(struct sock_xprt *transport, struct socket *sock)
5004 + transport->srcport = xs_sock_getport(sock);
5005 + }
5006 +
5007 +-static unsigned short xs_get_srcport(struct sock_xprt *transport)
5008 ++static int xs_get_srcport(struct sock_xprt *transport)
5009 + {
5010 +- unsigned short port = transport->srcport;
5011 ++ int port = transport->srcport;
5012 +
5013 + if (port == 0 && transport->xprt.resvport)
5014 + port = xs_get_random_port();
5015 +@@ -1821,7 +1827,7 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
5016 + {
5017 + struct sockaddr_storage myaddr;
5018 + int err, nloop = 0;
5019 +- unsigned short port = xs_get_srcport(transport);
5020 ++ int port = xs_get_srcport(transport);
5021 + unsigned short last;
5022 +
5023 + /*
5024 +@@ -1839,8 +1845,8 @@ static int xs_bind(struct sock_xprt *transport, struct socket *sock)
5025 + * transport->xprt.resvport == 1) xs_get_srcport above will
5026 + * ensure that port is non-zero and we will bind as needed.
5027 + */
5028 +- if (port == 0)
5029 +- return 0;
5030 ++ if (port <= 0)
5031 ++ return port;
5032 +
5033 + memcpy(&myaddr, &transport->srcaddr, transport->xprt.addrlen);
5034 + do {
5035 +@@ -3223,12 +3229,8 @@ static int param_set_uint_minmax(const char *val,
5036 +
5037 + static int param_set_portnr(const char *val, const struct kernel_param *kp)
5038 + {
5039 +- if (kp->arg == &xprt_min_resvport)
5040 +- return param_set_uint_minmax(val, kp,
5041 +- RPC_MIN_RESVPORT,
5042 +- xprt_max_resvport);
5043 + return param_set_uint_minmax(val, kp,
5044 +- xprt_min_resvport,
5045 ++ RPC_MIN_RESVPORT,
5046 + RPC_MAX_RESVPORT);
5047 + }
5048 +
5049 +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
5050 +index cecf51a5aec4..32ae82a5596d 100644
5051 +--- a/net/unix/af_unix.c
5052 ++++ b/net/unix/af_unix.c
5053 +@@ -224,6 +224,8 @@ static inline void unix_release_addr(struct unix_address *addr)
5054 +
5055 + static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
5056 + {
5057 ++ *hashp = 0;
5058 ++
5059 + if (len <= sizeof(short) || len > sizeof(*sunaddr))
5060 + return -EINVAL;
5061 + if (!sunaddr || sunaddr->sun_family != AF_UNIX)
5062 +diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
5063 +index 48d6dca471c6..6c8daf5b391f 100644
5064 +--- a/sound/firewire/isight.c
5065 ++++ b/sound/firewire/isight.c
5066 +@@ -639,7 +639,7 @@ static int isight_probe(struct fw_unit *unit,
5067 + if (!isight->audio_base) {
5068 + dev_err(&unit->device, "audio unit base not found\n");
5069 + err = -ENXIO;
5070 +- goto err_unit;
5071 ++ goto error;
5072 + }
5073 + fw_iso_resources_init(&isight->resources, unit);
5074 +
5075 +@@ -668,12 +668,12 @@ static int isight_probe(struct fw_unit *unit,
5076 + dev_set_drvdata(&unit->device, isight);
5077 +
5078 + return 0;
5079 +-
5080 +-err_unit:
5081 +- fw_unit_put(isight->unit);
5082 +- mutex_destroy(&isight->mutex);
5083 + error:
5084 + snd_card_free(card);
5085 ++
5086 ++ mutex_destroy(&isight->mutex);
5087 ++ fw_unit_put(isight->unit);
5088 ++
5089 + return err;
5090 + }
5091 +
5092 +diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c
5093 +index 7e21621e492a..7fd1b4000883 100644
5094 +--- a/sound/i2c/cs8427.c
5095 ++++ b/sound/i2c/cs8427.c
5096 +@@ -118,7 +118,7 @@ static int snd_cs8427_send_corudata(struct snd_i2c_device *device,
5097 + struct cs8427 *chip = device->private_data;
5098 + char *hw_data = udata ?
5099 + chip->playback.hw_udata : chip->playback.hw_status;
5100 +- char data[32];
5101 ++ unsigned char data[32];
5102 + int err, idx;
5103 +
5104 + if (!memcmp(hw_data, ndata, count))
5105 +diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
5106 +index 1e76869dd488..863e04809a6b 100644
5107 +--- a/sound/soc/tegra/tegra_sgtl5000.c
5108 ++++ b/sound/soc/tegra/tegra_sgtl5000.c
5109 +@@ -152,14 +152,14 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
5110 + dev_err(&pdev->dev,
5111 + "Property 'nvidia,i2s-controller' missing/invalid\n");
5112 + ret = -EINVAL;
5113 +- goto err;
5114 ++ goto err_put_codec_of_node;
5115 + }
5116 +
5117 + tegra_sgtl5000_dai.platform_of_node = tegra_sgtl5000_dai.cpu_of_node;
5118 +
5119 + ret = tegra_asoc_utils_init(&machine->util_data, &pdev->dev);
5120 + if (ret)
5121 +- goto err;
5122 ++ goto err_put_cpu_of_node;
5123 +
5124 + ret = snd_soc_register_card(card);
5125 + if (ret) {
5126 +@@ -172,6 +172,13 @@ static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
5127 +
5128 + err_fini_utils:
5129 + tegra_asoc_utils_fini(&machine->util_data);
5130 ++err_put_cpu_of_node:
5131 ++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
5132 ++ tegra_sgtl5000_dai.cpu_of_node = NULL;
5133 ++ tegra_sgtl5000_dai.platform_of_node = NULL;
5134 ++err_put_codec_of_node:
5135 ++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
5136 ++ tegra_sgtl5000_dai.codec_of_node = NULL;
5137 + err:
5138 + return ret;
5139 + }
5140 +@@ -186,6 +193,12 @@ static int tegra_sgtl5000_driver_remove(struct platform_device *pdev)
5141 +
5142 + tegra_asoc_utils_fini(&machine->util_data);
5143 +
5144 ++ of_node_put(tegra_sgtl5000_dai.cpu_of_node);
5145 ++ tegra_sgtl5000_dai.cpu_of_node = NULL;
5146 ++ tegra_sgtl5000_dai.platform_of_node = NULL;
5147 ++ of_node_put(tegra_sgtl5000_dai.codec_of_node);
5148 ++ tegra_sgtl5000_dai.codec_of_node = NULL;
5149 ++
5150 + return ret;
5151 + }
5152 +
5153 +diff --git a/tools/gpio/Build b/tools/gpio/Build
5154 +index 620c1937d957..4141f35837db 100644
5155 +--- a/tools/gpio/Build
5156 ++++ b/tools/gpio/Build
5157 +@@ -1,3 +1,4 @@
5158 ++gpio-utils-y += gpio-utils.o
5159 + lsgpio-y += lsgpio.o gpio-utils.o
5160 + gpio-hammer-y += gpio-hammer.o gpio-utils.o
5161 + gpio-event-mon-y += gpio-event-mon.o gpio-utils.o
5162 +diff --git a/tools/gpio/Makefile b/tools/gpio/Makefile
5163 +index 250a891e6ef0..359dd5d11c81 100644
5164 +--- a/tools/gpio/Makefile
5165 ++++ b/tools/gpio/Makefile
5166 +@@ -32,11 +32,15 @@ $(OUTPUT)include/linux/gpio.h: ../../include/uapi/linux/gpio.h
5167 +
5168 + prepare: $(OUTPUT)include/linux/gpio.h
5169 +
5170 ++GPIO_UTILS_IN := $(output)gpio-utils-in.o
5171 ++$(GPIO_UTILS_IN): prepare FORCE
5172 ++ $(Q)$(MAKE) $(build)=gpio-utils
5173 ++
5174 + #
5175 + # lsgpio
5176 + #
5177 + LSGPIO_IN := $(OUTPUT)lsgpio-in.o
5178 +-$(LSGPIO_IN): prepare FORCE
5179 ++$(LSGPIO_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
5180 + $(Q)$(MAKE) $(build)=lsgpio
5181 + $(OUTPUT)lsgpio: $(LSGPIO_IN)
5182 + $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
5183 +@@ -45,7 +49,7 @@ $(OUTPUT)lsgpio: $(LSGPIO_IN)
5184 + # gpio-hammer
5185 + #
5186 + GPIO_HAMMER_IN := $(OUTPUT)gpio-hammer-in.o
5187 +-$(GPIO_HAMMER_IN): prepare FORCE
5188 ++$(GPIO_HAMMER_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
5189 + $(Q)$(MAKE) $(build)=gpio-hammer
5190 + $(OUTPUT)gpio-hammer: $(GPIO_HAMMER_IN)
5191 + $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
5192 +@@ -54,7 +58,7 @@ $(OUTPUT)gpio-hammer: $(GPIO_HAMMER_IN)
5193 + # gpio-event-mon
5194 + #
5195 + GPIO_EVENT_MON_IN := $(OUTPUT)gpio-event-mon-in.o
5196 +-$(GPIO_EVENT_MON_IN): prepare FORCE
5197 ++$(GPIO_EVENT_MON_IN): prepare FORCE $(OUTPUT)gpio-utils-in.o
5198 + $(Q)$(MAKE) $(build)=gpio-event-mon
5199 + $(OUTPUT)gpio-event-mon: $(GPIO_EVENT_MON_IN)
5200 + $(QUIET_LINK)$(CC) $(CFLAGS) $(LDFLAGS) $< -o $@
5201 +diff --git a/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk b/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
5202 +index a3d2c62fd805..0a3ad5dd1e8b 100644
5203 +--- a/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
5204 ++++ b/tools/objtool/arch/x86/tools/gen-insn-attr-x86.awk
5205 +@@ -68,7 +68,7 @@ BEGIN {
5206 +
5207 + lprefix1_expr = "\\((66|!F3)\\)"
5208 + lprefix2_expr = "\\(F3\\)"
5209 +- lprefix3_expr = "\\((F2|!F3|66\\&F2)\\)"
5210 ++ lprefix3_expr = "\\((F2|!F3|66&F2)\\)"
5211 + lprefix_expr = "\\((66|F2|F3)\\)"
5212 + max_lprefix = 4
5213 +
5214 +@@ -256,7 +256,7 @@ function convert_operands(count,opnd, i,j,imm,mod)
5215 + return add_flags(imm, mod)
5216 + }
5217 +
5218 +-/^[0-9a-f]+\:/ {
5219 ++/^[0-9a-f]+:/ {
5220 + if (NR == 1)
5221 + next
5222 + # get index
5223 +diff --git a/tools/power/acpi/tools/acpidump/apmain.c b/tools/power/acpi/tools/acpidump/apmain.c
5224 +index 7ff46be908f0..d426fec3b1d3 100644
5225 +--- a/tools/power/acpi/tools/acpidump/apmain.c
5226 ++++ b/tools/power/acpi/tools/acpidump/apmain.c
5227 +@@ -139,7 +139,7 @@ static int ap_insert_action(char *argument, u32 to_be_done)
5228 +
5229 + current_action++;
5230 + if (current_action > AP_MAX_ACTIONS) {
5231 +- fprintf(stderr, "Too many table options (max %u)\n",
5232 ++ fprintf(stderr, "Too many table options (max %d)\n",
5233 + AP_MAX_ACTIONS);
5234 + return (-1);
5235 + }
5236 +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
5237 +index 231bcd2c4eb5..1e7ac6f3362f 100644
5238 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
5239 ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
5240 +@@ -71,8 +71,11 @@ test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
5241 + echo "r ${PROBEFUNC} \$retval" > kprobe_events
5242 + ! echo "p ${PROBEFUNC} \$retval" > kprobe_events
5243 +
5244 ++# $comm was introduced in 4.8, older kernels reject it.
5245 ++if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then
5246 + : "Comm access"
5247 + test_goodarg "\$comm"
5248 ++fi
5249 +
5250 + : "Indirect memory access"
5251 + test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
5252 +diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
5253 +index 6ff7b601f854..4bb905925b0e 100644
5254 +--- a/tools/usb/usbip/libsrc/usbip_host_common.c
5255 ++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
5256 +@@ -43,7 +43,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
5257 + int size;
5258 + int fd;
5259 + int length;
5260 +- char status;
5261 ++ char status[2] = { 0 };
5262 + int value = 0;
5263 +
5264 + size = snprintf(status_attr_path, sizeof(status_attr_path),
5265 +@@ -61,15 +61,15 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
5266 + return -1;
5267 + }
5268 +
5269 +- length = read(fd, &status, 1);
5270 ++ length = read(fd, status, 1);
5271 + if (length < 0) {
5272 + err("error reading attribute %s", status_attr_path);
5273 + close(fd);
5274 + return -1;
5275 + }
5276 +
5277 +- value = atoi(&status);
5278 +-
5279 ++ value = atoi(status);
5280 ++ close(fd);
5281 + return value;
5282 + }
5283 +
5284 +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
5285 +index 0fc93519e63e..c0dff5337a50 100644
5286 +--- a/virt/kvm/kvm_main.c
5287 ++++ b/virt/kvm/kvm_main.c
5288 +@@ -131,10 +131,30 @@ __weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
5289 + {
5290 + }
5291 +
5292 ++bool kvm_is_zone_device_pfn(kvm_pfn_t pfn)
5293 ++{
5294 ++ /*
5295 ++ * The metadata used by is_zone_device_page() to determine whether or
5296 ++ * not a page is ZONE_DEVICE is guaranteed to be valid if and only if
5297 ++ * the device has been pinned, e.g. by get_user_pages(). WARN if the
5298 ++ * page_count() is zero to help detect bad usage of this helper.
5299 ++ */
5300 ++ if (!pfn_valid(pfn) || WARN_ON_ONCE(!page_count(pfn_to_page(pfn))))
5301 ++ return false;
5302 ++
5303 ++ return is_zone_device_page(pfn_to_page(pfn));
5304 ++}
5305 ++
5306 + bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
5307 + {
5308 ++ /*
5309 ++ * ZONE_DEVICE pages currently set PG_reserved, but from a refcounting
5310 ++ * perspective they are "normal" pages, albeit with slightly different
5311 ++ * usage rules.
5312 ++ */
5313 + if (pfn_valid(pfn))
5314 +- return PageReserved(pfn_to_page(pfn));
5315 ++ return PageReserved(pfn_to_page(pfn)) &&
5316 ++ !kvm_is_zone_device_pfn(pfn);
5317 +
5318 + return true;
5319 + }
5320 +@@ -1758,7 +1778,7 @@ static void kvm_release_pfn_dirty(kvm_pfn_t pfn)
5321 +
5322 + void kvm_set_pfn_dirty(kvm_pfn_t pfn)
5323 + {
5324 +- if (!kvm_is_reserved_pfn(pfn)) {
5325 ++ if (!kvm_is_reserved_pfn(pfn) && !kvm_is_zone_device_pfn(pfn)) {
5326 + struct page *page = pfn_to_page(pfn);
5327 +
5328 + if (!PageReserved(page))
5329 +@@ -1769,7 +1789,7 @@ EXPORT_SYMBOL_GPL(kvm_set_pfn_dirty);
5330 +
5331 + void kvm_set_pfn_accessed(kvm_pfn_t pfn)
5332 + {
5333 +- if (!kvm_is_reserved_pfn(pfn))
5334 ++ if (!kvm_is_reserved_pfn(pfn) && !kvm_is_zone_device_pfn(pfn))
5335 + mark_page_accessed(pfn_to_page(pfn));
5336 + }
5337 + EXPORT_SYMBOL_GPL(kvm_set_pfn_accessed);