Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.9 commit in: /
Date: Wed, 30 May 2018 11:39:29
Message-Id: 1527680351.53b8f4f2e5ab3aa75bce79d5934ede887e4e2854.mpagano@gentoo
1 commit: 53b8f4f2e5ab3aa75bce79d5934ede887e4e2854
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Wed May 30 11:39:11 2018 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Wed May 30 11:39:11 2018 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=53b8f4f2
7
8 Linux patch 4.9.104
9
10 0000_README | 4 +
11 1103_linux-4.9.104.patch | 13079 +++++++++++++++++++++++++++++++++++++++++++++
12 2 files changed, 13083 insertions(+)
13
14 diff --git a/0000_README b/0000_README
15 index 5e90d97..e808f94 100644
16 --- a/0000_README
17 +++ b/0000_README
18 @@ -455,6 +455,10 @@ Patch: 1102_linux-4.9.103.patch
19 From: http://www.kernel.org
20 Desc: Linux 4.9.103
21
22 +Patch: 1103_linux-4.9.104.patch
23 +From: http://www.kernel.org
24 +Desc: Linux 4.9.104
25 +
26 Patch: 1500_XATTR_USER_PREFIX.patch
27 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
28 Desc: Support for namespace user.pax.* on tmpfs.
29
30 diff --git a/1103_linux-4.9.104.patch b/1103_linux-4.9.104.patch
31 new file mode 100644
32 index 0000000..9f689d2
33 --- /dev/null
34 +++ b/1103_linux-4.9.104.patch
35 @@ -0,0 +1,13079 @@
36 +diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
37 +index 1699a55b7b70..ef639960b272 100644
38 +--- a/Documentation/device-mapper/thin-provisioning.txt
39 ++++ b/Documentation/device-mapper/thin-provisioning.txt
40 +@@ -112,9 +112,11 @@ $low_water_mark is expressed in blocks of size $data_block_size. If
41 + free space on the data device drops below this level then a dm event
42 + will be triggered which a userspace daemon should catch allowing it to
43 + extend the pool device. Only one such event will be sent.
44 +-Resuming a device with a new table itself triggers an event so the
45 +-userspace daemon can use this to detect a situation where a new table
46 +-already exceeds the threshold.
47 ++
48 ++No special event is triggered if a just resumed device's free space is below
49 ++the low water mark. However, resuming a device always triggers an
50 ++event; a userspace daemon should verify that free space exceeds the low
51 ++water mark when handling this event.
52 +
53 + A low water mark for the metadata device is maintained in the kernel and
54 + will trigger a dm event if free space on the metadata device drops below
55 +diff --git a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
56 +index 217a90eaabe7..9c38bbe7e6d7 100644
57 +--- a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
58 ++++ b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt
59 +@@ -11,7 +11,11 @@ Required properties:
60 + interrupts.
61 +
62 + Optional properties:
63 +-- clocks: Optional reference to the clock used by the XOR engine.
64 ++- clocks: Optional reference to the clocks used by the XOR engine.
65 ++- clock-names: mandatory if there is a second clock, in this case the
66 ++ name must be "core" for the first clock and "reg" for the second
67 ++ one
68 ++
69 +
70 + Example:
71 +
72 +diff --git a/Makefile b/Makefile
73 +index 6090f655fb32..780dcc8033b2 100644
74 +--- a/Makefile
75 ++++ b/Makefile
76 +@@ -1,6 +1,6 @@
77 + VERSION = 4
78 + PATCHLEVEL = 9
79 +-SUBLEVEL = 103
80 ++SUBLEVEL = 104
81 + EXTRAVERSION =
82 + NAME = Roaring Lionus
83 +
84 +diff --git a/arch/alpha/include/asm/xchg.h b/arch/alpha/include/asm/xchg.h
85 +index 0ca9724597c1..7081e52291d0 100644
86 +--- a/arch/alpha/include/asm/xchg.h
87 ++++ b/arch/alpha/include/asm/xchg.h
88 +@@ -11,6 +11,10 @@
89 + * Atomic exchange.
90 + * Since it can be used to implement critical sections
91 + * it must clobber "memory" (also for interrupts in UP).
92 ++ *
93 ++ * The leading and the trailing memory barriers guarantee that these
94 ++ * operations are fully ordered.
95 ++ *
96 + */
97 +
98 + static inline unsigned long
99 +@@ -18,6 +22,7 @@ ____xchg(_u8, volatile char *m, unsigned long val)
100 + {
101 + unsigned long ret, tmp, addr64;
102 +
103 ++ smp_mb();
104 + __asm__ __volatile__(
105 + " andnot %4,7,%3\n"
106 + " insbl %1,%4,%1\n"
107 +@@ -42,6 +47,7 @@ ____xchg(_u16, volatile short *m, unsigned long val)
108 + {
109 + unsigned long ret, tmp, addr64;
110 +
111 ++ smp_mb();
112 + __asm__ __volatile__(
113 + " andnot %4,7,%3\n"
114 + " inswl %1,%4,%1\n"
115 +@@ -66,6 +72,7 @@ ____xchg(_u32, volatile int *m, unsigned long val)
116 + {
117 + unsigned long dummy;
118 +
119 ++ smp_mb();
120 + __asm__ __volatile__(
121 + "1: ldl_l %0,%4\n"
122 + " bis $31,%3,%1\n"
123 +@@ -86,6 +93,7 @@ ____xchg(_u64, volatile long *m, unsigned long val)
124 + {
125 + unsigned long dummy;
126 +
127 ++ smp_mb();
128 + __asm__ __volatile__(
129 + "1: ldq_l %0,%4\n"
130 + " bis $31,%3,%1\n"
131 +@@ -127,10 +135,12 @@ ____xchg(, volatile void *ptr, unsigned long x, int size)
132 + * store NEW in MEM. Return the initial value in MEM. Success is
133 + * indicated by comparing RETURN with OLD.
134 + *
135 +- * The memory barrier should be placed in SMP only when we actually
136 +- * make the change. If we don't change anything (so if the returned
137 +- * prev is equal to old) then we aren't acquiring anything new and
138 +- * we don't need any memory barrier as far I can tell.
139 ++ * The leading and the trailing memory barriers guarantee that these
140 ++ * operations are fully ordered.
141 ++ *
142 ++ * The trailing memory barrier is placed in SMP unconditionally, in
143 ++ * order to guarantee that dependency ordering is preserved when a
144 ++ * dependency is headed by an unsuccessful operation.
145 + */
146 +
147 + static inline unsigned long
148 +@@ -138,6 +148,7 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
149 + {
150 + unsigned long prev, tmp, cmp, addr64;
151 +
152 ++ smp_mb();
153 + __asm__ __volatile__(
154 + " andnot %5,7,%4\n"
155 + " insbl %1,%5,%1\n"
156 +@@ -149,8 +160,8 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new)
157 + " or %1,%2,%2\n"
158 + " stq_c %2,0(%4)\n"
159 + " beq %2,3f\n"
160 +- __ASM__MB
161 + "2:\n"
162 ++ __ASM__MB
163 + ".subsection 2\n"
164 + "3: br 1b\n"
165 + ".previous"
166 +@@ -165,6 +176,7 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
167 + {
168 + unsigned long prev, tmp, cmp, addr64;
169 +
170 ++ smp_mb();
171 + __asm__ __volatile__(
172 + " andnot %5,7,%4\n"
173 + " inswl %1,%5,%1\n"
174 +@@ -176,8 +188,8 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new)
175 + " or %1,%2,%2\n"
176 + " stq_c %2,0(%4)\n"
177 + " beq %2,3f\n"
178 +- __ASM__MB
179 + "2:\n"
180 ++ __ASM__MB
181 + ".subsection 2\n"
182 + "3: br 1b\n"
183 + ".previous"
184 +@@ -192,6 +204,7 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
185 + {
186 + unsigned long prev, cmp;
187 +
188 ++ smp_mb();
189 + __asm__ __volatile__(
190 + "1: ldl_l %0,%5\n"
191 + " cmpeq %0,%3,%1\n"
192 +@@ -199,8 +212,8 @@ ____cmpxchg(_u32, volatile int *m, int old, int new)
193 + " mov %4,%1\n"
194 + " stl_c %1,%2\n"
195 + " beq %1,3f\n"
196 +- __ASM__MB
197 + "2:\n"
198 ++ __ASM__MB
199 + ".subsection 2\n"
200 + "3: br 1b\n"
201 + ".previous"
202 +@@ -215,6 +228,7 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
203 + {
204 + unsigned long prev, cmp;
205 +
206 ++ smp_mb();
207 + __asm__ __volatile__(
208 + "1: ldq_l %0,%5\n"
209 + " cmpeq %0,%3,%1\n"
210 +@@ -222,8 +236,8 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new)
211 + " mov %4,%1\n"
212 + " stq_c %1,%2\n"
213 + " beq %1,3f\n"
214 +- __ASM__MB
215 + "2:\n"
216 ++ __ASM__MB
217 + ".subsection 2\n"
218 + "3: br 1b\n"
219 + ".previous"
220 +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
221 +index 249e10190d20..b7b78cb09a37 100644
222 +--- a/arch/arc/Kconfig
223 ++++ b/arch/arc/Kconfig
224 +@@ -495,7 +495,6 @@ config ARC_CURR_IN_REG
225 +
226 + config ARC_EMUL_UNALIGNED
227 + bool "Emulate unaligned memory access (userspace only)"
228 +- default N
229 + select SYSCTL_ARCH_UNALIGN_NO_WARN
230 + select SYSCTL_ARCH_UNALIGN_ALLOW
231 + depends on ISA_ARCOMPACT
232 +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
233 +index 74dd21b7373c..c51b88ee3cec 100644
234 +--- a/arch/arm/boot/dts/bcm283x.dtsi
235 ++++ b/arch/arm/boot/dts/bcm283x.dtsi
236 +@@ -146,8 +146,8 @@
237 +
238 + i2s: i2s@7e203000 {
239 + compatible = "brcm,bcm2835-i2s";
240 +- reg = <0x7e203000 0x20>,
241 +- <0x7e101098 0x02>;
242 ++ reg = <0x7e203000 0x24>;
243 ++ clocks = <&clocks BCM2835_CLOCK_PCM>;
244 +
245 + dmas = <&dma 2>,
246 + <&dma 3>;
247 +diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts
248 +index a1658d0721b8..cf0de77f09c4 100644
249 +--- a/arch/arm/boot/dts/bcm958625hr.dts
250 ++++ b/arch/arm/boot/dts/bcm958625hr.dts
251 +@@ -49,7 +49,7 @@
252 +
253 + memory {
254 + device_type = "memory";
255 +- reg = <0x60000000 0x80000000>;
256 ++ reg = <0x60000000 0x20000000>;
257 + };
258 +
259 + gpio-restart {
260 +diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
261 +index 58b09bf1ba2d..205130600853 100644
262 +--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
263 ++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
264 +@@ -213,37 +213,37 @@
265 + &iomuxc {
266 + pinctrl_enet1: enet1grp {
267 + fsl,pins = <
268 +- MX7D_PAD_SD2_CD_B__ENET1_MDIO 0x3
269 +- MX7D_PAD_SD2_WP__ENET1_MDC 0x3
270 +- MX7D_PAD_ENET1_RGMII_TXC__ENET1_RGMII_TXC 0x1
271 +- MX7D_PAD_ENET1_RGMII_TD0__ENET1_RGMII_TD0 0x1
272 +- MX7D_PAD_ENET1_RGMII_TD1__ENET1_RGMII_TD1 0x1
273 +- MX7D_PAD_ENET1_RGMII_TD2__ENET1_RGMII_TD2 0x1
274 +- MX7D_PAD_ENET1_RGMII_TD3__ENET1_RGMII_TD3 0x1
275 +- MX7D_PAD_ENET1_RGMII_TX_CTL__ENET1_RGMII_TX_CTL 0x1
276 +- MX7D_PAD_ENET1_RGMII_RXC__ENET1_RGMII_RXC 0x1
277 +- MX7D_PAD_ENET1_RGMII_RD0__ENET1_RGMII_RD0 0x1
278 +- MX7D_PAD_ENET1_RGMII_RD1__ENET1_RGMII_RD1 0x1
279 +- MX7D_PAD_ENET1_RGMII_RD2__ENET1_RGMII_RD2 0x1
280 +- MX7D_PAD_ENET1_RGMII_RD3__ENET1_RGMII_RD3 0x1
281 +- MX7D_PAD_ENET1_RGMII_RX_CTL__ENET1_RGMII_RX_CTL 0x1
282 ++ MX7D_PAD_SD2_CD_B__ENET1_MDIO 0x30
283 ++ MX7D_PAD_SD2_WP__ENET1_MDC 0x30
284 ++ MX7D_PAD_ENET1_RGMII_TXC__ENET1_RGMII_TXC 0x11
285 ++ MX7D_PAD_ENET1_RGMII_TD0__ENET1_RGMII_TD0 0x11
286 ++ MX7D_PAD_ENET1_RGMII_TD1__ENET1_RGMII_TD1 0x11
287 ++ MX7D_PAD_ENET1_RGMII_TD2__ENET1_RGMII_TD2 0x11
288 ++ MX7D_PAD_ENET1_RGMII_TD3__ENET1_RGMII_TD3 0x11
289 ++ MX7D_PAD_ENET1_RGMII_TX_CTL__ENET1_RGMII_TX_CTL 0x11
290 ++ MX7D_PAD_ENET1_RGMII_RXC__ENET1_RGMII_RXC 0x11
291 ++ MX7D_PAD_ENET1_RGMII_RD0__ENET1_RGMII_RD0 0x11
292 ++ MX7D_PAD_ENET1_RGMII_RD1__ENET1_RGMII_RD1 0x11
293 ++ MX7D_PAD_ENET1_RGMII_RD2__ENET1_RGMII_RD2 0x11
294 ++ MX7D_PAD_ENET1_RGMII_RD3__ENET1_RGMII_RD3 0x11
295 ++ MX7D_PAD_ENET1_RGMII_RX_CTL__ENET1_RGMII_RX_CTL 0x11
296 + >;
297 + };
298 +
299 + pinctrl_enet2: enet2grp {
300 + fsl,pins = <
301 +- MX7D_PAD_EPDC_GDSP__ENET2_RGMII_TXC 0x1
302 +- MX7D_PAD_EPDC_SDCE2__ENET2_RGMII_TD0 0x1
303 +- MX7D_PAD_EPDC_SDCE3__ENET2_RGMII_TD1 0x1
304 +- MX7D_PAD_EPDC_GDCLK__ENET2_RGMII_TD2 0x1
305 +- MX7D_PAD_EPDC_GDOE__ENET2_RGMII_TD3 0x1
306 +- MX7D_PAD_EPDC_GDRL__ENET2_RGMII_TX_CTL 0x1
307 +- MX7D_PAD_EPDC_SDCE1__ENET2_RGMII_RXC 0x1
308 +- MX7D_PAD_EPDC_SDCLK__ENET2_RGMII_RD0 0x1
309 +- MX7D_PAD_EPDC_SDLE__ENET2_RGMII_RD1 0x1
310 +- MX7D_PAD_EPDC_SDOE__ENET2_RGMII_RD2 0x1
311 +- MX7D_PAD_EPDC_SDSHR__ENET2_RGMII_RD3 0x1
312 +- MX7D_PAD_EPDC_SDCE0__ENET2_RGMII_RX_CTL 0x1
313 ++ MX7D_PAD_EPDC_GDSP__ENET2_RGMII_TXC 0x11
314 ++ MX7D_PAD_EPDC_SDCE2__ENET2_RGMII_TD0 0x11
315 ++ MX7D_PAD_EPDC_SDCE3__ENET2_RGMII_TD1 0x11
316 ++ MX7D_PAD_EPDC_GDCLK__ENET2_RGMII_TD2 0x11
317 ++ MX7D_PAD_EPDC_GDOE__ENET2_RGMII_TD3 0x11
318 ++ MX7D_PAD_EPDC_GDRL__ENET2_RGMII_TX_CTL 0x11
319 ++ MX7D_PAD_EPDC_SDCE1__ENET2_RGMII_RXC 0x11
320 ++ MX7D_PAD_EPDC_SDCLK__ENET2_RGMII_RD0 0x11
321 ++ MX7D_PAD_EPDC_SDLE__ENET2_RGMII_RD1 0x11
322 ++ MX7D_PAD_EPDC_SDOE__ENET2_RGMII_RD2 0x11
323 ++ MX7D_PAD_EPDC_SDSHR__ENET2_RGMII_RD3 0x11
324 ++ MX7D_PAD_EPDC_SDCE0__ENET2_RGMII_RX_CTL 0x11
325 + >;
326 + };
327 +
328 +diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts
329 +index 6761d11d3f9e..db0239c7e6c7 100644
330 +--- a/arch/arm/boot/dts/r8a7791-porter.dts
331 ++++ b/arch/arm/boot/dts/r8a7791-porter.dts
332 +@@ -428,7 +428,7 @@
333 + "dclkin.0", "dclkin.1";
334 +
335 + ports {
336 +- port@1 {
337 ++ port@0 {
338 + endpoint {
339 + remote-endpoint = <&adv7511_in>;
340 + };
341 +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi
342 +index 9f48141270b8..f0702d8063d9 100644
343 +--- a/arch/arm/boot/dts/socfpga.dtsi
344 ++++ b/arch/arm/boot/dts/socfpga.dtsi
345 +@@ -759,7 +759,7 @@
346 + timer@fffec600 {
347 + compatible = "arm,cortex-a9-twd-timer";
348 + reg = <0xfffec600 0x100>;
349 +- interrupts = <1 13 0xf04>;
350 ++ interrupts = <1 13 0xf01>;
351 + clocks = <&mpu_periph_clk>;
352 + };
353 +
354 +diff --git a/arch/arm/include/asm/vdso.h b/arch/arm/include/asm/vdso.h
355 +index d0295f1dd1a3..ff65b6d96c7e 100644
356 +--- a/arch/arm/include/asm/vdso.h
357 ++++ b/arch/arm/include/asm/vdso.h
358 +@@ -11,8 +11,6 @@ struct mm_struct;
359 +
360 + void arm_install_vdso(struct mm_struct *mm, unsigned long addr);
361 +
362 +-extern char vdso_start, vdso_end;
363 +-
364 + extern unsigned int vdso_total_pages;
365 +
366 + #else /* CONFIG_VDSO */
367 +diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c
368 +index 53cf86cf2d1a..890439737374 100644
369 +--- a/arch/arm/kernel/vdso.c
370 ++++ b/arch/arm/kernel/vdso.c
371 +@@ -39,6 +39,8 @@
372 +
373 + static struct page **vdso_text_pagelist;
374 +
375 ++extern char vdso_start[], vdso_end[];
376 ++
377 + /* Total number of pages needed for the data and text portions of the VDSO. */
378 + unsigned int vdso_total_pages __ro_after_init;
379 +
380 +@@ -179,13 +181,13 @@ static int __init vdso_init(void)
381 + unsigned int text_pages;
382 + int i;
383 +
384 +- if (memcmp(&vdso_start, "\177ELF", 4)) {
385 ++ if (memcmp(vdso_start, "\177ELF", 4)) {
386 + pr_err("VDSO is not a valid ELF object!\n");
387 + return -ENOEXEC;
388 + }
389 +
390 +- text_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT;
391 +- pr_debug("vdso: %i text pages at base %p\n", text_pages, &vdso_start);
392 ++ text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
393 ++ pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start);
394 +
395 + /* Allocate the VDSO text pagelist */
396 + vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *),
397 +@@ -200,7 +202,7 @@ static int __init vdso_init(void)
398 + for (i = 0; i < text_pages; i++) {
399 + struct page *page;
400 +
401 +- page = virt_to_page(&vdso_start + i * PAGE_SIZE);
402 ++ page = virt_to_page(vdso_start + i * PAGE_SIZE);
403 + vdso_text_pagelist[i] = page;
404 + }
405 +
406 +@@ -211,7 +213,7 @@ static int __init vdso_init(void)
407 +
408 + cntvct_ok = cntvct_functional();
409 +
410 +- patch_vdso(&vdso_start);
411 ++ patch_vdso(vdso_start);
412 +
413 + return 0;
414 + }
415 +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c
416 +index 4f5fd4a084c0..034b89499bd7 100644
417 +--- a/arch/arm/mach-omap1/clock.c
418 ++++ b/arch/arm/mach-omap1/clock.c
419 +@@ -1031,17 +1031,17 @@ static int clk_debugfs_register_one(struct clk *c)
420 + return -ENOMEM;
421 + c->dent = d;
422 +
423 +- d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)&c->usecount);
424 ++ d = debugfs_create_u8("usecount", S_IRUGO, c->dent, &c->usecount);
425 + if (!d) {
426 + err = -ENOMEM;
427 + goto err_out;
428 + }
429 +- d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)&c->rate);
430 ++ d = debugfs_create_ulong("rate", S_IRUGO, c->dent, &c->rate);
431 + if (!d) {
432 + err = -ENOMEM;
433 + goto err_out;
434 + }
435 +- d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)&c->flags);
436 ++ d = debugfs_create_x8("flags", S_IRUGO, c->dent, &c->flags);
437 + if (!d) {
438 + err = -ENOMEM;
439 + goto err_out;
440 +diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
441 +index 678d2a31dcb8..3202015ecb83 100644
442 +--- a/arch/arm/mach-omap2/pm.c
443 ++++ b/arch/arm/mach-omap2/pm.c
444 +@@ -225,7 +225,7 @@ static void omap_pm_end(void)
445 + cpu_idle_poll_ctrl(false);
446 + }
447 +
448 +-static void omap_pm_finish(void)
449 ++static void omap_pm_wake(void)
450 + {
451 + if (cpu_is_omap34xx())
452 + omap_prcm_irq_complete();
453 +@@ -235,7 +235,7 @@ static const struct platform_suspend_ops omap_pm_ops = {
454 + .begin = omap_pm_begin,
455 + .end = omap_pm_end,
456 + .enter = omap_pm_enter,
457 +- .finish = omap_pm_finish,
458 ++ .wake = omap_pm_wake,
459 + .valid = suspend_valid_only_mem,
460 + };
461 +
462 +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
463 +index b2f2448bfa6d..a4cab2814655 100644
464 +--- a/arch/arm/mach-omap2/timer.c
465 ++++ b/arch/arm/mach-omap2/timer.c
466 +@@ -136,12 +136,6 @@ static struct clock_event_device clockevent_gpt = {
467 + .tick_resume = omap2_gp_timer_shutdown,
468 + };
469 +
470 +-static struct property device_disabled = {
471 +- .name = "status",
472 +- .length = sizeof("disabled"),
473 +- .value = "disabled",
474 +-};
475 +-
476 + static const struct of_device_id omap_timer_match[] __initconst = {
477 + { .compatible = "ti,omap2420-timer", },
478 + { .compatible = "ti,omap3430-timer", },
479 +@@ -183,8 +177,17 @@ static struct device_node * __init omap_get_timer_dt(const struct of_device_id *
480 + of_get_property(np, "ti,timer-secure", NULL)))
481 + continue;
482 +
483 +- if (!of_device_is_compatible(np, "ti,omap-counter32k"))
484 +- of_add_property(np, &device_disabled);
485 ++ if (!of_device_is_compatible(np, "ti,omap-counter32k")) {
486 ++ struct property *prop;
487 ++
488 ++ prop = kzalloc(sizeof(*prop), GFP_KERNEL);
489 ++ if (!prop)
490 ++ return NULL;
491 ++ prop->name = "status";
492 ++ prop->value = "disabled";
493 ++ prop->length = strlen(prop->value);
494 ++ of_add_property(np, prop);
495 ++ }
496 + return np;
497 + }
498 +
499 +diff --git a/arch/arm/mach-orion5x/Kconfig b/arch/arm/mach-orion5x/Kconfig
500 +index 89bb0fc796bd..72905a442106 100644
501 +--- a/arch/arm/mach-orion5x/Kconfig
502 ++++ b/arch/arm/mach-orion5x/Kconfig
503 +@@ -57,7 +57,6 @@ config MACH_KUROBOX_PRO
504 +
505 + config MACH_DNS323
506 + bool "D-Link DNS-323"
507 +- select GENERIC_NET_UTILS
508 + select I2C_BOARDINFO if I2C
509 + help
510 + Say 'Y' here if you want your kernel to support the
511 +@@ -65,7 +64,6 @@ config MACH_DNS323
512 +
513 + config MACH_TS209
514 + bool "QNAP TS-109/TS-209"
515 +- select GENERIC_NET_UTILS
516 + help
517 + Say 'Y' here if you want your kernel to support the
518 + QNAP TS-109/TS-209 platform.
519 +@@ -107,7 +105,6 @@ config MACH_LINKSTATION_LS_HGL
520 +
521 + config MACH_TS409
522 + bool "QNAP TS-409"
523 +- select GENERIC_NET_UTILS
524 + help
525 + Say 'Y' here if you want your kernel to support the
526 + QNAP TS-409 platform.
527 +diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c
528 +index cd483bfb5ca8..d13344b2ddcd 100644
529 +--- a/arch/arm/mach-orion5x/dns323-setup.c
530 ++++ b/arch/arm/mach-orion5x/dns323-setup.c
531 +@@ -173,10 +173,42 @@ static struct mv643xx_eth_platform_data dns323_eth_data = {
532 + .phy_addr = MV643XX_ETH_PHY_ADDR(8),
533 + };
534 +
535 ++/* dns323_parse_hex_*() taken from tsx09-common.c; should a common copy of these
536 ++ * functions be kept somewhere?
537 ++ */
538 ++static int __init dns323_parse_hex_nibble(char n)
539 ++{
540 ++ if (n >= '0' && n <= '9')
541 ++ return n - '0';
542 ++
543 ++ if (n >= 'A' && n <= 'F')
544 ++ return n - 'A' + 10;
545 ++
546 ++ if (n >= 'a' && n <= 'f')
547 ++ return n - 'a' + 10;
548 ++
549 ++ return -1;
550 ++}
551 ++
552 ++static int __init dns323_parse_hex_byte(const char *b)
553 ++{
554 ++ int hi;
555 ++ int lo;
556 ++
557 ++ hi = dns323_parse_hex_nibble(b[0]);
558 ++ lo = dns323_parse_hex_nibble(b[1]);
559 ++
560 ++ if (hi < 0 || lo < 0)
561 ++ return -1;
562 ++
563 ++ return (hi << 4) | lo;
564 ++}
565 ++
566 + static int __init dns323_read_mac_addr(void)
567 + {
568 + u_int8_t addr[6];
569 +- void __iomem *mac_page;
570 ++ int i;
571 ++ char *mac_page;
572 +
573 + /* MAC address is stored as a regular ol' string in /dev/mtdblock4
574 + * (0x007d0000-0x00800000) starting at offset 196480 (0x2ff80).
575 +@@ -185,8 +217,23 @@ static int __init dns323_read_mac_addr(void)
576 + if (!mac_page)
577 + return -ENOMEM;
578 +
579 +- if (!mac_pton((__force const char *) mac_page, addr))
580 +- goto error_fail;
581 ++ /* Sanity check the string we're looking at */
582 ++ for (i = 0; i < 5; i++) {
583 ++ if (*(mac_page + (i * 3) + 2) != ':') {
584 ++ goto error_fail;
585 ++ }
586 ++ }
587 ++
588 ++ for (i = 0; i < 6; i++) {
589 ++ int byte;
590 ++
591 ++ byte = dns323_parse_hex_byte(mac_page + (i * 3));
592 ++ if (byte < 0) {
593 ++ goto error_fail;
594 ++ }
595 ++
596 ++ addr[i] = byte;
597 ++ }
598 +
599 + iounmap(mac_page);
600 + printk("DNS-323: Found ethernet MAC address: %pM\n", addr);
601 +diff --git a/arch/arm/mach-orion5x/tsx09-common.c b/arch/arm/mach-orion5x/tsx09-common.c
602 +index 89774985d380..905d4f2dd0b8 100644
603 +--- a/arch/arm/mach-orion5x/tsx09-common.c
604 ++++ b/arch/arm/mach-orion5x/tsx09-common.c
605 +@@ -53,12 +53,53 @@ struct mv643xx_eth_platform_data qnap_tsx09_eth_data = {
606 + .phy_addr = MV643XX_ETH_PHY_ADDR(8),
607 + };
608 +
609 ++static int __init qnap_tsx09_parse_hex_nibble(char n)
610 ++{
611 ++ if (n >= '0' && n <= '9')
612 ++ return n - '0';
613 ++
614 ++ if (n >= 'A' && n <= 'F')
615 ++ return n - 'A' + 10;
616 ++
617 ++ if (n >= 'a' && n <= 'f')
618 ++ return n - 'a' + 10;
619 ++
620 ++ return -1;
621 ++}
622 ++
623 ++static int __init qnap_tsx09_parse_hex_byte(const char *b)
624 ++{
625 ++ int hi;
626 ++ int lo;
627 ++
628 ++ hi = qnap_tsx09_parse_hex_nibble(b[0]);
629 ++ lo = qnap_tsx09_parse_hex_nibble(b[1]);
630 ++
631 ++ if (hi < 0 || lo < 0)
632 ++ return -1;
633 ++
634 ++ return (hi << 4) | lo;
635 ++}
636 ++
637 + static int __init qnap_tsx09_check_mac_addr(const char *addr_str)
638 + {
639 + u_int8_t addr[6];
640 ++ int i;
641 +
642 +- if (!mac_pton(addr_str, addr))
643 +- return -1;
644 ++ for (i = 0; i < 6; i++) {
645 ++ int byte;
646 ++
647 ++ /*
648 ++ * Enforce "xx:xx:xx:xx:xx:xx\n" format.
649 ++ */
650 ++ if (addr_str[(i * 3) + 2] != ((i < 5) ? ':' : '\n'))
651 ++ return -1;
652 ++
653 ++ byte = qnap_tsx09_parse_hex_byte(addr_str + (i * 3));
654 ++ if (byte < 0)
655 ++ return -1;
656 ++ addr[i] = byte;
657 ++ }
658 +
659 + printk(KERN_INFO "tsx09: found ethernet mac address %pM\n", addr);
660 +
661 +@@ -77,12 +118,12 @@ void __init qnap_tsx09_find_mac_addr(u32 mem_base, u32 size)
662 + unsigned long addr;
663 +
664 + for (addr = mem_base; addr < (mem_base + size); addr += 1024) {
665 +- void __iomem *nor_page;
666 ++ char *nor_page;
667 + int ret = 0;
668 +
669 + nor_page = ioremap(addr, 1024);
670 + if (nor_page != NULL) {
671 +- ret = qnap_tsx09_check_mac_addr((__force const char *)nor_page);
672 ++ ret = qnap_tsx09_check_mac_addr(nor_page);
673 + iounmap(nor_page);
674 + }
675 +
676 +diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
677 +index 7a327bd32521..ebef8aacea83 100644
678 +--- a/arch/arm/plat-omap/dmtimer.c
679 ++++ b/arch/arm/plat-omap/dmtimer.c
680 +@@ -890,11 +890,8 @@ static int omap_dm_timer_probe(struct platform_device *pdev)
681 + timer->irq = irq->start;
682 + timer->pdev = pdev;
683 +
684 +- /* Skip pm_runtime_enable for OMAP1 */
685 +- if (!(timer->capability & OMAP_TIMER_NEEDS_RESET)) {
686 +- pm_runtime_enable(dev);
687 +- pm_runtime_irq_safe(dev);
688 +- }
689 ++ pm_runtime_enable(dev);
690 ++ pm_runtime_irq_safe(dev);
691 +
692 + if (!timer->reserved) {
693 + ret = pm_runtime_get_sync(dev);
694 +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
695 +index 338f82a7fdc7..2c93de7fffe5 100644
696 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
697 ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
698 +@@ -326,8 +326,8 @@
699 + blsp2_spi5: spi@075ba000{
700 + compatible = "qcom,spi-qup-v2.2.1";
701 + reg = <0x075ba000 0x600>;
702 +- interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
703 +- clocks = <&gcc GCC_BLSP2_QUP5_SPI_APPS_CLK>,
704 ++ interrupts = <GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
705 ++ clocks = <&gcc GCC_BLSP2_QUP6_SPI_APPS_CLK>,
706 + <&gcc GCC_BLSP2_AHB_CLK>;
707 + clock-names = "core", "iface";
708 + pinctrl-names = "default", "sleep";
709 +diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
710 +index cae331d553f8..a9d2dd03c977 100644
711 +--- a/arch/arm64/include/asm/spinlock.h
712 ++++ b/arch/arm64/include/asm/spinlock.h
713 +@@ -141,8 +141,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
714 + " cbnz %w1, 1f\n"
715 + " add %w1, %w0, %3\n"
716 + " casa %w0, %w1, %2\n"
717 +- " and %w1, %w1, #0xffff\n"
718 +- " eor %w1, %w1, %w0, lsr #16\n"
719 ++ " sub %w1, %w1, %3\n"
720 ++ " eor %w1, %w1, %w0\n"
721 + "1:")
722 + : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock)
723 + : "I" (1 << TICKET_SHIFT)
724 +diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h
725 +index 801a16dbbdf6..7d2a15a0f625 100644
726 +--- a/arch/arm64/include/asm/stacktrace.h
727 ++++ b/arch/arm64/include/asm/stacktrace.h
728 +@@ -23,7 +23,7 @@ struct stackframe {
729 + unsigned long sp;
730 + unsigned long pc;
731 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER
732 +- unsigned int graph;
733 ++ int graph;
734 + #endif
735 + };
736 +
737 +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
738 +index 74107134cc30..2de62aa91303 100644
739 +--- a/arch/arm64/kernel/cpu_errata.c
740 ++++ b/arch/arm64/kernel/cpu_errata.c
741 +@@ -160,7 +160,7 @@ static int enable_smccc_arch_workaround_1(void *data)
742 + case PSCI_CONDUIT_HVC:
743 + arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
744 + ARM_SMCCC_ARCH_WORKAROUND_1, &res);
745 +- if (res.a0)
746 ++ if ((int)res.a0 < 0)
747 + return 0;
748 + cb = call_hvc_arch_workaround_1;
749 + smccc_start = __smccc_workaround_1_hvc_start;
750 +@@ -170,7 +170,7 @@ static int enable_smccc_arch_workaround_1(void *data)
751 + case PSCI_CONDUIT_SMC:
752 + arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID,
753 + ARM_SMCCC_ARCH_WORKAROUND_1, &res);
754 +- if (res.a0)
755 ++ if ((int)res.a0 < 0)
756 + return 0;
757 + cb = call_smc_arch_workaround_1;
758 + smccc_start = __smccc_workaround_1_smc_start;
759 +diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
760 +index c2efddfca18c..0cc01e0d38eb 100644
761 +--- a/arch/arm64/kernel/stacktrace.c
762 ++++ b/arch/arm64/kernel/stacktrace.c
763 +@@ -72,6 +72,11 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
764 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER
765 + if (tsk->ret_stack &&
766 + (frame->pc == (unsigned long)return_to_handler)) {
767 ++ if (WARN_ON_ONCE(frame->graph == -1))
768 ++ return -EINVAL;
769 ++ if (frame->graph < -1)
770 ++ frame->graph += FTRACE_NOTRACE_DEPTH;
771 ++
772 + /*
773 + * This is a case where function graph tracer has
774 + * modified a return address (LR) in a stack frame
775 +diff --git a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c
776 +index 59779699a1a4..5d9076e86200 100644
777 +--- a/arch/arm64/kernel/time.c
778 ++++ b/arch/arm64/kernel/time.c
779 +@@ -53,7 +53,7 @@ unsigned long profile_pc(struct pt_regs *regs)
780 + frame.sp = regs->sp;
781 + frame.pc = regs->pc;
782 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER
783 +- frame.graph = -1; /* no task info */
784 ++ frame.graph = current->curr_ret_stack;
785 + #endif
786 + do {
787 + int ret = unwind_frame(NULL, &frame);
788 +diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
789 +index 5ed0ea92c5bf..f851c9d651f0 100644
790 +--- a/arch/ia64/kernel/err_inject.c
791 ++++ b/arch/ia64/kernel/err_inject.c
792 +@@ -142,7 +142,7 @@ store_virtual_to_phys(struct device *dev, struct device_attribute *attr,
793 + u64 virt_addr=simple_strtoull(buf, NULL, 16);
794 + int ret;
795 +
796 +- ret = get_user_pages(virt_addr, 1, FOLL_WRITE, NULL, NULL);
797 ++ ret = get_user_pages_fast(virt_addr, 1, FOLL_WRITE, NULL);
798 + if (ret<=0) {
799 + #ifdef ERR_INJ_DEBUG
800 + printk("Virtual address %lx is not existing.\n",virt_addr);
801 +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c
802 +index a0fc0c192427..3e8be0f54a44 100644
803 +--- a/arch/m68k/coldfire/device.c
804 ++++ b/arch/m68k/coldfire/device.c
805 +@@ -135,7 +135,11 @@ static struct platform_device mcf_fec0 = {
806 + .id = 0,
807 + .num_resources = ARRAY_SIZE(mcf_fec0_resources),
808 + .resource = mcf_fec0_resources,
809 +- .dev.platform_data = FEC_PDATA,
810 ++ .dev = {
811 ++ .dma_mask = &mcf_fec0.dev.coherent_dma_mask,
812 ++ .coherent_dma_mask = DMA_BIT_MASK(32),
813 ++ .platform_data = FEC_PDATA,
814 ++ }
815 + };
816 +
817 + #ifdef MCFFEC_BASE1
818 +@@ -167,7 +171,11 @@ static struct platform_device mcf_fec1 = {
819 + .id = 1,
820 + .num_resources = ARRAY_SIZE(mcf_fec1_resources),
821 + .resource = mcf_fec1_resources,
822 +- .dev.platform_data = FEC_PDATA,
823 ++ .dev = {
824 ++ .dma_mask = &mcf_fec1.dev.coherent_dma_mask,
825 ++ .coherent_dma_mask = DMA_BIT_MASK(32),
826 ++ .platform_data = FEC_PDATA,
827 ++ }
828 + };
829 + #endif /* MCFFEC_BASE1 */
830 + #endif /* CONFIG_FEC */
831 +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
832 +index 6ed1ded87b8f..6420c83c29d1 100644
833 +--- a/arch/mips/cavium-octeon/octeon-irq.c
834 ++++ b/arch/mips/cavium-octeon/octeon-irq.c
835 +@@ -2271,7 +2271,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
836 +
837 + parent_irq = irq_of_parse_and_map(ciu_node, 0);
838 + if (!parent_irq) {
839 +- pr_err("ERROR: Couldn't acquire parent_irq for %s\n.",
840 ++ pr_err("ERROR: Couldn't acquire parent_irq for %s\n",
841 + ciu_node->name);
842 + return -EINVAL;
843 + }
844 +@@ -2283,7 +2283,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
845 +
846 + addr = of_get_address(ciu_node, 0, NULL, NULL);
847 + if (!addr) {
848 +- pr_err("ERROR: Couldn't acquire reg(0) %s\n.", ciu_node->name);
849 ++ pr_err("ERROR: Couldn't acquire reg(0) %s\n", ciu_node->name);
850 + return -EINVAL;
851 + }
852 + host_data->raw_reg = (u64)phys_to_virt(
853 +@@ -2291,7 +2291,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
854 +
855 + addr = of_get_address(ciu_node, 1, NULL, NULL);
856 + if (!addr) {
857 +- pr_err("ERROR: Couldn't acquire reg(1) %s\n.", ciu_node->name);
858 ++ pr_err("ERROR: Couldn't acquire reg(1) %s\n", ciu_node->name);
859 + return -EINVAL;
860 + }
861 + host_data->en_reg = (u64)phys_to_virt(
862 +@@ -2299,7 +2299,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
863 +
864 + r = of_property_read_u32(ciu_node, "cavium,max-bits", &val);
865 + if (r) {
866 +- pr_err("ERROR: Couldn't read cavium,max-bits from %s\n.",
867 ++ pr_err("ERROR: Couldn't read cavium,max-bits from %s\n",
868 + ciu_node->name);
869 + return r;
870 + }
871 +@@ -2309,7 +2309,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node,
872 + &octeon_irq_domain_cib_ops,
873 + host_data);
874 + if (!cib_domain) {
875 +- pr_err("ERROR: Couldn't irq_domain_add_linear()\n.");
876 ++ pr_err("ERROR: Couldn't irq_domain_add_linear()\n");
877 + return -ENOMEM;
878 + }
879 +
880 +diff --git a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
881 +index aa3800c82332..d99ca862dae3 100644
882 +--- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
883 ++++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h
884 +@@ -167,7 +167,7 @@
885 + #define AR71XX_AHB_DIV_MASK 0x7
886 +
887 + #define AR724X_PLL_REG_CPU_CONFIG 0x00
888 +-#define AR724X_PLL_REG_PCIE_CONFIG 0x18
889 ++#define AR724X_PLL_REG_PCIE_CONFIG 0x10
890 +
891 + #define AR724X_PLL_FB_SHIFT 0
892 + #define AR724X_PLL_FB_MASK 0x3ff
893 +diff --git a/arch/mips/include/asm/machine.h b/arch/mips/include/asm/machine.h
894 +index 6b444cd9526f..db930cdc715f 100644
895 +--- a/arch/mips/include/asm/machine.h
896 ++++ b/arch/mips/include/asm/machine.h
897 +@@ -52,7 +52,7 @@ mips_machine_is_compatible(const struct mips_machine *mach, const void *fdt)
898 + if (!mach->matches)
899 + return NULL;
900 +
901 +- for (match = mach->matches; match->compatible; match++) {
902 ++ for (match = mach->matches; match->compatible[0]; match++) {
903 + if (fdt_node_check_compatible(fdt, 0, match->compatible) == 0)
904 + return match;
905 + }
906 +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
907 +index 0c8ae2cc6380..8f7bf74d1c0b 100644
908 +--- a/arch/mips/kernel/ptrace.c
909 ++++ b/arch/mips/kernel/ptrace.c
910 +@@ -483,7 +483,7 @@ static int fpr_get_msa(struct task_struct *target,
911 + /*
912 + * Copy the floating-point context to the supplied NT_PRFPREG buffer.
913 + * Choose the appropriate helper for general registers, and then copy
914 +- * the FCSR register separately.
915 ++ * the FCSR and FIR registers separately.
916 + */
917 + static int fpr_get(struct task_struct *target,
918 + const struct user_regset *regset,
919 +@@ -491,6 +491,7 @@ static int fpr_get(struct task_struct *target,
920 + void *kbuf, void __user *ubuf)
921 + {
922 + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
923 ++ const int fir_pos = fcr31_pos + sizeof(u32);
924 + int err;
925 +
926 + if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t))
927 +@@ -503,6 +504,12 @@ static int fpr_get(struct task_struct *target,
928 + err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
929 + &target->thread.fpu.fcr31,
930 + fcr31_pos, fcr31_pos + sizeof(u32));
931 ++ if (err)
932 ++ return err;
933 ++
934 ++ err = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
935 ++ &boot_cpu_data.fpu_id,
936 ++ fir_pos, fir_pos + sizeof(u32));
937 +
938 + return err;
939 + }
940 +@@ -551,7 +558,8 @@ static int fpr_set_msa(struct task_struct *target,
941 + /*
942 + * Copy the supplied NT_PRFPREG buffer to the floating-point context.
943 + * Choose the appropriate helper for general registers, and then copy
944 +- * the FCSR register separately.
945 ++ * the FCSR register separately. Ignore the incoming FIR register
946 ++ * contents though, as the register is read-only.
947 + *
948 + * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0',
949 + * which is supposed to have been guaranteed by the kernel before
950 +@@ -565,6 +573,7 @@ static int fpr_set(struct task_struct *target,
951 + const void *kbuf, const void __user *ubuf)
952 + {
953 + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t);
954 ++ const int fir_pos = fcr31_pos + sizeof(u32);
955 + u32 fcr31;
956 + int err;
957 +
958 +@@ -592,6 +601,11 @@ static int fpr_set(struct task_struct *target,
959 + ptrace_setfcr31(target, fcr31);
960 + }
961 +
962 ++ if (count > 0)
963 ++ err = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
964 ++ fir_pos,
965 ++ fir_pos + sizeof(u32));
966 ++
967 + return err;
968 + }
969 +
970 +@@ -813,7 +827,7 @@ long arch_ptrace(struct task_struct *child, long request,
971 + fregs = get_fpu_regs(child);
972 +
973 + #ifdef CONFIG_32BIT
974 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
975 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
976 + /*
977 + * The odd registers are actually the high
978 + * order bits of the values stored in the even
979 +@@ -902,7 +916,7 @@ long arch_ptrace(struct task_struct *child, long request,
980 +
981 + init_fp_ctx(child);
982 + #ifdef CONFIG_32BIT
983 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
984 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
985 + /*
986 + * The odd registers are actually the high
987 + * order bits of the values stored in the even
988 +diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
989 +index 5fcbdcd7abd0..bc9afbabbe14 100644
990 +--- a/arch/mips/kernel/ptrace32.c
991 ++++ b/arch/mips/kernel/ptrace32.c
992 +@@ -97,7 +97,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
993 + break;
994 + }
995 + fregs = get_fpu_regs(child);
996 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
997 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
998 + /*
999 + * The odd registers are actually the high
1000 + * order bits of the values stored in the even
1001 +@@ -204,7 +204,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1002 + sizeof(child->thread.fpu));
1003 + child->thread.fpu.fcr31 = 0;
1004 + }
1005 +- if (test_thread_flag(TIF_32BIT_FPREGS)) {
1006 ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) {
1007 + /*
1008 + * The odd registers are actually the high
1009 + * order bits of the values stored in the even
1010 +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
1011 +index 29ec9ab3fd55..a2c46f539e3e 100644
1012 +--- a/arch/mips/kvm/mips.c
1013 ++++ b/arch/mips/kvm/mips.c
1014 +@@ -42,7 +42,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = {
1015 + { "cache", VCPU_STAT(cache_exits), KVM_STAT_VCPU },
1016 + { "signal", VCPU_STAT(signal_exits), KVM_STAT_VCPU },
1017 + { "interrupt", VCPU_STAT(int_exits), KVM_STAT_VCPU },
1018 +- { "cop_unsuable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
1019 ++ { "cop_unusable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU },
1020 + { "tlbmod", VCPU_STAT(tlbmod_exits), KVM_STAT_VCPU },
1021 + { "tlbmiss_ld", VCPU_STAT(tlbmiss_ld_exits), KVM_STAT_VCPU },
1022 + { "tlbmiss_st", VCPU_STAT(tlbmiss_st_exits), KVM_STAT_VCPU },
1023 +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
1024 +index 9d0107fbb169..43fa682e55da 100644
1025 +--- a/arch/mips/mm/c-r4k.c
1026 ++++ b/arch/mips/mm/c-r4k.c
1027 +@@ -851,9 +851,12 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
1028 + /*
1029 + * Either no secondary cache or the available caches don't have the
1030 + * subset property so we have to flush the primary caches
1031 +- * explicitly
1032 ++ * explicitly.
1033 ++ * If we would need IPI to perform an INDEX-type operation, then
1034 ++ * we have to use the HIT-type alternative as IPI cannot be used
1035 ++ * here due to interrupts possibly being disabled.
1036 + */
1037 +- if (size >= dcache_size) {
1038 ++ if (!r4k_op_needs_ipi(R4K_INDEX) && size >= dcache_size) {
1039 + r4k_blast_dcache();
1040 + } else {
1041 + R4600_HIT_CACHEOP_WAR_IMPL;
1042 +@@ -890,7 +893,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
1043 + return;
1044 + }
1045 +
1046 +- if (size >= dcache_size) {
1047 ++ if (!r4k_op_needs_ipi(R4K_INDEX) && size >= dcache_size) {
1048 + r4k_blast_dcache();
1049 + } else {
1050 + R4600_HIT_CACHEOP_WAR_IMPL;
1051 +diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
1052 +index 8b937300fb7f..fd26fadc8617 100644
1053 +--- a/arch/mips/txx9/rbtx4939/setup.c
1054 ++++ b/arch/mips/txx9/rbtx4939/setup.c
1055 +@@ -186,7 +186,7 @@ static void __init rbtx4939_update_ioc_pen(void)
1056 +
1057 + #define RBTX4939_MAX_7SEGLEDS 8
1058 +
1059 +-#if IS_ENABLED(CONFIG_LEDS_CLASS)
1060 ++#if IS_BUILTIN(CONFIG_LEDS_CLASS)
1061 + static u8 led_val[RBTX4939_MAX_7SEGLEDS];
1062 + struct rbtx4939_led_data {
1063 + struct led_classdev cdev;
1064 +@@ -261,7 +261,7 @@ static inline void rbtx4939_led_setup(void)
1065 +
1066 + static void __rbtx4939_7segled_putc(unsigned int pos, unsigned char val)
1067 + {
1068 +-#if IS_ENABLED(CONFIG_LEDS_CLASS)
1069 ++#if IS_BUILTIN(CONFIG_LEDS_CLASS)
1070 + unsigned long flags;
1071 + local_irq_save(flags);
1072 + /* bit7: reserved for LED class */
1073 +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
1074 +index 9d47f2efa830..bb69f3955b59 100644
1075 +--- a/arch/powerpc/boot/Makefile
1076 ++++ b/arch/powerpc/boot/Makefile
1077 +@@ -92,7 +92,8 @@ $(addprefix $(obj)/,$(zlib-y)): \
1078 + libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
1079 + libfdtheader := fdt.h libfdt.h libfdt_internal.h
1080 +
1081 +-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o): \
1082 ++$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o \
1083 ++ treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
1084 + $(addprefix $(obj)/,$(libfdtheader))
1085 +
1086 + src-wlib-y := string.S crt0.S crtsavres.S stdio.c decompress.c main.c \
1087 +diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h
1088 +index 744fd54de374..1bcc84903930 100644
1089 +--- a/arch/powerpc/include/asm/irq_work.h
1090 ++++ b/arch/powerpc/include/asm/irq_work.h
1091 +@@ -5,5 +5,6 @@ static inline bool arch_irq_work_has_interrupt(void)
1092 + {
1093 + return true;
1094 + }
1095 ++extern void arch_irq_work_raise(void);
1096 +
1097 + #endif /* _ASM_POWERPC_IRQ_WORK_H */
1098 +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
1099 +index 218cba2f5699..0a2b247dbc6b 100644
1100 +--- a/arch/powerpc/kvm/book3s_hv.c
1101 ++++ b/arch/powerpc/kvm/book3s_hv.c
1102 +@@ -3107,15 +3107,17 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu)
1103 + goto up_out;
1104 +
1105 + psize = vma_kernel_pagesize(vma);
1106 +- porder = __ilog2(psize);
1107 +
1108 + up_read(&current->mm->mmap_sem);
1109 +
1110 + /* We can handle 4k, 64k or 16M pages in the VRMA */
1111 +- err = -EINVAL;
1112 +- if (!(psize == 0x1000 || psize == 0x10000 ||
1113 +- psize == 0x1000000))
1114 +- goto out_srcu;
1115 ++ if (psize >= 0x1000000)
1116 ++ psize = 0x1000000;
1117 ++ else if (psize >= 0x10000)
1118 ++ psize = 0x10000;
1119 ++ else
1120 ++ psize = 0x1000;
1121 ++ porder = __ilog2(psize);
1122 +
1123 + /* Update VRMASD field in the LPCR */
1124 + senc = slb_pgsize_encoding(psize);
1125 +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
1126 +index a51c188b81f3..6cff96e0d77b 100644
1127 +--- a/arch/powerpc/mm/numa.c
1128 ++++ b/arch/powerpc/mm/numa.c
1129 +@@ -551,7 +551,7 @@ static int numa_setup_cpu(unsigned long lcpu)
1130 + nid = of_node_to_nid_single(cpu);
1131 +
1132 + out_present:
1133 +- if (nid < 0 || !node_online(nid))
1134 ++ if (nid < 0 || !node_possible(nid))
1135 + nid = first_online_node;
1136 +
1137 + map_cpu_to_node(lcpu, nid);
1138 +@@ -904,6 +904,32 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
1139 + NODE_DATA(nid)->node_spanned_pages = spanned_pages;
1140 + }
1141 +
1142 ++static void __init find_possible_nodes(void)
1143 ++{
1144 ++ struct device_node *rtas;
1145 ++ u32 numnodes, i;
1146 ++
1147 ++ if (min_common_depth <= 0)
1148 ++ return;
1149 ++
1150 ++ rtas = of_find_node_by_path("/rtas");
1151 ++ if (!rtas)
1152 ++ return;
1153 ++
1154 ++ if (of_property_read_u32_index(rtas,
1155 ++ "ibm,max-associativity-domains",
1156 ++ min_common_depth, &numnodes))
1157 ++ goto out;
1158 ++
1159 ++ for (i = 0; i < numnodes; i++) {
1160 ++ if (!node_possible(i))
1161 ++ node_set(i, node_possible_map);
1162 ++ }
1163 ++
1164 ++out:
1165 ++ of_node_put(rtas);
1166 ++}
1167 ++
1168 + void __init initmem_init(void)
1169 + {
1170 + int nid, cpu;
1171 +@@ -917,12 +943,15 @@ void __init initmem_init(void)
1172 + memblock_dump_all();
1173 +
1174 + /*
1175 +- * Reduce the possible NUMA nodes to the online NUMA nodes,
1176 +- * since we do not support node hotplug. This ensures that we
1177 +- * lower the maximum NUMA node ID to what is actually present.
1178 ++ * Modify the set of possible NUMA nodes to reflect information
1179 ++ * available about the set of online nodes, and the set of nodes
1180 ++ * that we expect to make use of for this platform's affinity
1181 ++ * calculations.
1182 + */
1183 + nodes_and(node_possible_map, node_possible_map, node_online_map);
1184 +
1185 ++ find_possible_nodes();
1186 ++
1187 + for_each_online_node(nid) {
1188 + unsigned long start_pfn, end_pfn;
1189 +
1190 +@@ -1274,6 +1303,40 @@ static long vphn_get_associativity(unsigned long cpu,
1191 + return rc;
1192 + }
1193 +
1194 ++static inline int find_and_online_cpu_nid(int cpu)
1195 ++{
1196 ++ __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
1197 ++ int new_nid;
1198 ++
1199 ++ /* Use associativity from first thread for all siblings */
1200 ++ vphn_get_associativity(cpu, associativity);
1201 ++ new_nid = associativity_to_nid(associativity);
1202 ++ if (new_nid < 0 || !node_possible(new_nid))
1203 ++ new_nid = first_online_node;
1204 ++
1205 ++ if (NODE_DATA(new_nid) == NULL) {
1206 ++#ifdef CONFIG_MEMORY_HOTPLUG
1207 ++ /*
1208 ++ * Need to ensure that NODE_DATA is initialized for a node from
1209 ++ * available memory (see memblock_alloc_try_nid). If unable to
1210 ++ * init the node, then default to nearest node that has memory
1211 ++ * installed.
1212 ++ */
1213 ++ if (try_online_node(new_nid))
1214 ++ new_nid = first_online_node;
1215 ++#else
1216 ++ /*
1217 ++ * Default to using the nearest node that has memory installed.
1218 ++ * Otherwise, it would be necessary to patch the kernel MM code
1219 ++ * to deal with more memoryless-node error conditions.
1220 ++ */
1221 ++ new_nid = first_online_node;
1222 ++#endif
1223 ++ }
1224 ++
1225 ++ return new_nid;
1226 ++}
1227 ++
1228 + /*
1229 + * Update the CPU maps and sysfs entries for a single CPU when its NUMA
1230 + * characteristics change. This function doesn't perform any locking and is
1231 +@@ -1339,7 +1402,6 @@ int arch_update_cpu_topology(void)
1232 + {
1233 + unsigned int cpu, sibling, changed = 0;
1234 + struct topology_update_data *updates, *ud;
1235 +- __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
1236 + cpumask_t updated_cpus;
1237 + struct device *dev;
1238 + int weight, new_nid, i = 0;
1239 +@@ -1374,11 +1436,7 @@ int arch_update_cpu_topology(void)
1240 + continue;
1241 + }
1242 +
1243 +- /* Use associativity from first thread for all siblings */
1244 +- vphn_get_associativity(cpu, associativity);
1245 +- new_nid = associativity_to_nid(associativity);
1246 +- if (new_nid < 0 || !node_online(new_nid))
1247 +- new_nid = first_online_node;
1248 ++ new_nid = find_and_online_cpu_nid(cpu);
1249 +
1250 + if (new_nid == numa_cpu_lookup_table[cpu]) {
1251 + cpumask_andnot(&cpu_associativity_changes_mask,
1252 +diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
1253 +index 7e706f36e364..9c58194c7ea5 100644
1254 +--- a/arch/powerpc/net/bpf_jit_comp.c
1255 ++++ b/arch/powerpc/net/bpf_jit_comp.c
1256 +@@ -329,6 +329,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
1257 + BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4);
1258 + PPC_LWZ_OFFS(r_A, r_skb, offsetof(struct sk_buff, len));
1259 + break;
1260 ++ case BPF_LDX | BPF_W | BPF_ABS: /* A = *((u32 *)(seccomp_data + K)); */
1261 ++ PPC_LWZ_OFFS(r_A, r_skb, K);
1262 ++ break;
1263 + case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */
1264 + PPC_LWZ_OFFS(r_X, r_skb, offsetof(struct sk_buff, len));
1265 + break;
1266 +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
1267 +index bf949623de90..771edffa2d40 100644
1268 +--- a/arch/powerpc/perf/core-book3s.c
1269 ++++ b/arch/powerpc/perf/core-book3s.c
1270 +@@ -448,6 +448,16 @@ static void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw)
1271 + /* invalid entry */
1272 + continue;
1273 +
1274 ++ /*
1275 ++ * BHRB rolling buffer could very much contain the kernel
1276 ++ * addresses at this point. Check the privileges before
1277 ++ * exporting it to userspace (avoid exposure of regions
1278 ++ * where we could have speculative execution)
1279 ++ */
1280 ++ if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) &&
1281 ++ is_kernel_addr(addr))
1282 ++ continue;
1283 ++
1284 + /* Branches are read most recent first (ie. mfbhrb 0 is
1285 + * the most recent branch).
1286 + * There are two types of valid entries:
1287 +@@ -1188,6 +1198,7 @@ static void power_pmu_disable(struct pmu *pmu)
1288 + */
1289 + write_mmcr0(cpuhw, val);
1290 + mb();
1291 ++ isync();
1292 +
1293 + /*
1294 + * Disable instruction sampling if it was enabled
1295 +@@ -1196,12 +1207,26 @@ static void power_pmu_disable(struct pmu *pmu)
1296 + mtspr(SPRN_MMCRA,
1297 + cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE);
1298 + mb();
1299 ++ isync();
1300 + }
1301 +
1302 + cpuhw->disabled = 1;
1303 + cpuhw->n_added = 0;
1304 +
1305 + ebb_switch_out(mmcr0);
1306 ++
1307 ++#ifdef CONFIG_PPC64
1308 ++ /*
1309 ++ * These are readable by userspace, may contain kernel
1310 ++ * addresses and are not switched by context switch, so clear
1311 ++ * them now to avoid leaking anything to userspace in general
1312 ++ * including to another process.
1313 ++ */
1314 ++ if (ppmu->flags & PPMU_ARCH_207S) {
1315 ++ mtspr(SPRN_SDAR, 0);
1316 ++ mtspr(SPRN_SIAR, 0);
1317 ++ }
1318 ++#endif
1319 + }
1320 +
1321 + local_irq_restore(flags);
1322 +diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
1323 +index b9aac951a90f..f37567ed640c 100644
1324 +--- a/arch/powerpc/sysdev/mpic.c
1325 ++++ b/arch/powerpc/sysdev/mpic.c
1326 +@@ -626,7 +626,7 @@ static inline u32 mpic_physmask(u32 cpumask)
1327 + int i;
1328 + u32 mask = 0;
1329 +
1330 +- for (i = 0; i < min(32, NR_CPUS); ++i, cpumask >>= 1)
1331 ++ for (i = 0; i < min(32, NR_CPUS) && cpu_possible(i); ++i, cpumask >>= 1)
1332 + mask |= (cpumask & 1) << get_hard_smp_processor_id(i);
1333 + return mask;
1334 + }
1335 +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
1336 +index ced6c9b8f04d..51f842c0a175 100644
1337 +--- a/arch/s390/kvm/vsie.c
1338 ++++ b/arch/s390/kvm/vsie.c
1339 +@@ -549,7 +549,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
1340 +
1341 + gpa = scb_o->itdba & ~0xffUL;
1342 + if (gpa && (scb_s->ecb & 0x10U)) {
1343 +- if (!(gpa & ~0x1fffU)) {
1344 ++ if (!(gpa & ~0x1fffUL)) {
1345 + rc = set_validity_icpt(scb_s, 0x0080U);
1346 + goto unpin;
1347 + }
1348 +diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
1349 +index c001f782c5f1..28cc61216b64 100644
1350 +--- a/arch/sh/kernel/entry-common.S
1351 ++++ b/arch/sh/kernel/entry-common.S
1352 +@@ -255,7 +255,7 @@ debug_trap:
1353 + mov.l @r8, r8
1354 + jsr @r8
1355 + nop
1356 +- bra __restore_all
1357 ++ bra ret_from_exception
1358 + nop
1359 + CFI_ENDPROC
1360 +
1361 +diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
1362 +index 24827a3f733a..89d299ccdfa6 100644
1363 +--- a/arch/sparc/include/asm/atomic_64.h
1364 ++++ b/arch/sparc/include/asm/atomic_64.h
1365 +@@ -82,7 +82,11 @@ ATOMIC_OPS(xor)
1366 + #define atomic64_add_negative(i, v) (atomic64_add_return(i, v) < 0)
1367 +
1368 + #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
1369 +-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
1370 ++
1371 ++static inline int atomic_xchg(atomic_t *v, int new)
1372 ++{
1373 ++ return xchg(&v->counter, new);
1374 ++}
1375 +
1376 + static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1377 + {
1378 +diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
1379 +index b6802b978140..81ad06a1672f 100644
1380 +--- a/arch/sparc/include/asm/pgtable_64.h
1381 ++++ b/arch/sparc/include/asm/pgtable_64.h
1382 +@@ -952,7 +952,7 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
1383 + pmd_t *pmd);
1384 +
1385 + #define __HAVE_ARCH_PMDP_INVALIDATE
1386 +-extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
1387 ++extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
1388 + pmd_t *pmdp);
1389 +
1390 + #define __HAVE_ARCH_PGTABLE_DEPOSIT
1391 +diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
1392 +index c56a195c9071..b2722ed31053 100644
1393 +--- a/arch/sparc/mm/tlb.c
1394 ++++ b/arch/sparc/mm/tlb.c
1395 +@@ -219,17 +219,28 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
1396 + }
1397 + }
1398 +
1399 ++static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
1400 ++ unsigned long address, pmd_t *pmdp, pmd_t pmd)
1401 ++{
1402 ++ pmd_t old;
1403 ++
1404 ++ do {
1405 ++ old = *pmdp;
1406 ++ } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd);
1407 ++
1408 ++ return old;
1409 ++}
1410 ++
1411 + /*
1412 + * This routine is only called when splitting a THP
1413 + */
1414 +-void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
1415 ++pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
1416 + pmd_t *pmdp)
1417 + {
1418 +- pmd_t entry = *pmdp;
1419 +-
1420 +- pmd_val(entry) &= ~_PAGE_VALID;
1421 ++ pmd_t old, entry;
1422 +
1423 +- set_pmd_at(vma->vm_mm, address, pmdp, entry);
1424 ++ entry = __pmd(pmd_val(*pmdp) & ~_PAGE_VALID);
1425 ++ old = pmdp_establish(vma, address, pmdp, entry);
1426 + flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
1427 +
1428 + /*
1429 +@@ -240,6 +251,8 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
1430 + if ((pmd_val(entry) & _PAGE_PMD_HUGE) &&
1431 + !is_huge_zero_page(pmd_page(entry)))
1432 + (vma->vm_mm)->context.thp_pte_count--;
1433 ++
1434 ++ return old;
1435 + }
1436 +
1437 + void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
1438 +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
1439 +index 02e547f9ca3f..655a65eaf105 100644
1440 +--- a/arch/x86/events/core.c
1441 ++++ b/arch/x86/events/core.c
1442 +@@ -1155,16 +1155,13 @@ int x86_perf_event_set_period(struct perf_event *event)
1443 +
1444 + per_cpu(pmc_prev_left[idx], smp_processor_id()) = left;
1445 +
1446 +- if (!(hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) ||
1447 +- local64_read(&hwc->prev_count) != (u64)-left) {
1448 +- /*
1449 +- * The hw event starts counting from this event offset,
1450 +- * mark it to be able to extra future deltas:
1451 +- */
1452 +- local64_set(&hwc->prev_count, (u64)-left);
1453 ++ /*
1454 ++ * The hw event starts counting from this event offset,
1455 ++ * mark it to be able to extra future deltas:
1456 ++ */
1457 ++ local64_set(&hwc->prev_count, (u64)-left);
1458 +
1459 +- wrmsrl(hwc->event_base, (u64)(-left) & x86_pmu.cntval_mask);
1460 +- }
1461 ++ wrmsrl(hwc->event_base, (u64)(-left) & x86_pmu.cntval_mask);
1462 +
1463 + /*
1464 + * Due to erratum on certan cpu we need
1465 +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
1466 +index 6f353a874178..815039327932 100644
1467 +--- a/arch/x86/events/intel/core.c
1468 ++++ b/arch/x86/events/intel/core.c
1469 +@@ -2066,9 +2066,15 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
1470 + int bit, loops;
1471 + u64 status;
1472 + int handled;
1473 ++ int pmu_enabled;
1474 +
1475 + cpuc = this_cpu_ptr(&cpu_hw_events);
1476 +
1477 ++ /*
1478 ++ * Save the PMU state.
1479 ++ * It needs to be restored when leaving the handler.
1480 ++ */
1481 ++ pmu_enabled = cpuc->enabled;
1482 + /*
1483 + * No known reason to not always do late ACK,
1484 + * but just in case do it opt-in.
1485 +@@ -2076,6 +2082,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
1486 + if (!x86_pmu.late_ack)
1487 + apic_write(APIC_LVTPC, APIC_DM_NMI);
1488 + intel_bts_disable_local();
1489 ++ cpuc->enabled = 0;
1490 + __intel_pmu_disable_all();
1491 + handled = intel_pmu_drain_bts_buffer();
1492 + handled += intel_bts_interrupt();
1493 +@@ -2173,7 +2180,8 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
1494 +
1495 + done:
1496 + /* Only restore PMU state when it's active. See x86_pmu_disable(). */
1497 +- if (cpuc->enabled)
1498 ++ cpuc->enabled = pmu_enabled;
1499 ++ if (pmu_enabled)
1500 + __intel_pmu_enable_all(0, true);
1501 + intel_bts_enable_local();
1502 +
1503 +@@ -3019,7 +3027,7 @@ hsw_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
1504 + * Therefore the effective (average) period matches the requested period,
1505 + * despite coarser hardware granularity.
1506 + */
1507 +-static unsigned bdw_limit_period(struct perf_event *event, unsigned left)
1508 ++static u64 bdw_limit_period(struct perf_event *event, u64 left)
1509 + {
1510 + if ((event->hw.config & INTEL_ARCH_EVENT_MASK) ==
1511 + X86_CONFIG(.event=0xc0, .umask=0x01)) {
1512 +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
1513 +index 8e7a3f1df3a5..f26e26e4d84f 100644
1514 +--- a/arch/x86/events/intel/ds.c
1515 ++++ b/arch/x86/events/intel/ds.c
1516 +@@ -1110,6 +1110,7 @@ static void setup_pebs_sample_data(struct perf_event *event,
1517 + if (pebs == NULL)
1518 + return;
1519 +
1520 ++ regs->flags &= ~PERF_EFLAGS_EXACT;
1521 + sample_type = event->attr.sample_type;
1522 + dsrc = sample_type & PERF_SAMPLE_DATA_SRC;
1523 +
1524 +@@ -1154,7 +1155,6 @@ static void setup_pebs_sample_data(struct perf_event *event,
1525 + */
1526 + *regs = *iregs;
1527 + regs->flags = pebs->flags;
1528 +- set_linear_ip(regs, pebs->ip);
1529 +
1530 + if (sample_type & PERF_SAMPLE_REGS_INTR) {
1531 + regs->ax = pebs->ax;
1532 +@@ -1190,13 +1190,22 @@ static void setup_pebs_sample_data(struct perf_event *event,
1533 + #endif
1534 + }
1535 +
1536 +- if (event->attr.precise_ip > 1 && x86_pmu.intel_cap.pebs_format >= 2) {
1537 +- regs->ip = pebs->real_ip;
1538 +- regs->flags |= PERF_EFLAGS_EXACT;
1539 +- } else if (event->attr.precise_ip > 1 && intel_pmu_pebs_fixup_ip(regs))
1540 +- regs->flags |= PERF_EFLAGS_EXACT;
1541 +- else
1542 +- regs->flags &= ~PERF_EFLAGS_EXACT;
1543 ++ if (event->attr.precise_ip > 1) {
1544 ++ /* Haswell and later have the eventing IP, so use it: */
1545 ++ if (x86_pmu.intel_cap.pebs_format >= 2) {
1546 ++ set_linear_ip(regs, pebs->real_ip);
1547 ++ regs->flags |= PERF_EFLAGS_EXACT;
1548 ++ } else {
1549 ++ /* Otherwise use PEBS off-by-1 IP: */
1550 ++ set_linear_ip(regs, pebs->ip);
1551 ++
1552 ++ /* ... and try to fix it up using the LBR entries: */
1553 ++ if (intel_pmu_pebs_fixup_ip(regs))
1554 ++ regs->flags |= PERF_EFLAGS_EXACT;
1555 ++ }
1556 ++ } else
1557 ++ set_linear_ip(regs, pebs->ip);
1558 ++
1559 +
1560 + if ((sample_type & PERF_SAMPLE_ADDR) &&
1561 + x86_pmu.intel_cap.pebs_format >= 1)
1562 +@@ -1263,17 +1272,84 @@ get_next_pebs_record_by_bit(void *base, void *top, int bit)
1563 + return NULL;
1564 + }
1565 +
1566 ++/*
1567 ++ * Special variant of intel_pmu_save_and_restart() for auto-reload.
1568 ++ */
1569 ++static int
1570 ++intel_pmu_save_and_restart_reload(struct perf_event *event, int count)
1571 ++{
1572 ++ struct hw_perf_event *hwc = &event->hw;
1573 ++ int shift = 64 - x86_pmu.cntval_bits;
1574 ++ u64 period = hwc->sample_period;
1575 ++ u64 prev_raw_count, new_raw_count;
1576 ++ s64 new, old;
1577 ++
1578 ++ WARN_ON(!period);
1579 ++
1580 ++ /*
1581 ++ * drain_pebs() only happens when the PMU is disabled.
1582 ++ */
1583 ++ WARN_ON(this_cpu_read(cpu_hw_events.enabled));
1584 ++
1585 ++ prev_raw_count = local64_read(&hwc->prev_count);
1586 ++ rdpmcl(hwc->event_base_rdpmc, new_raw_count);
1587 ++ local64_set(&hwc->prev_count, new_raw_count);
1588 ++
1589 ++ /*
1590 ++ * Since the counter increments a negative counter value and
1591 ++ * overflows on the sign switch, giving the interval:
1592 ++ *
1593 ++ * [-period, 0]
1594 ++ *
1595 ++ * the difference between two consequtive reads is:
1596 ++ *
1597 ++ * A) value2 - value1;
1598 ++ * when no overflows have happened in between,
1599 ++ *
1600 ++ * B) (0 - value1) + (value2 - (-period));
1601 ++ * when one overflow happened in between,
1602 ++ *
1603 ++ * C) (0 - value1) + (n - 1) * (period) + (value2 - (-period));
1604 ++ * when @n overflows happened in between.
1605 ++ *
1606 ++ * Here A) is the obvious difference, B) is the extension to the
1607 ++ * discrete interval, where the first term is to the top of the
1608 ++ * interval and the second term is from the bottom of the next
1609 ++ * interval and C) the extension to multiple intervals, where the
1610 ++ * middle term is the whole intervals covered.
1611 ++ *
1612 ++ * An equivalent of C, by reduction, is:
1613 ++ *
1614 ++ * value2 - value1 + n * period
1615 ++ */
1616 ++ new = ((s64)(new_raw_count << shift) >> shift);
1617 ++ old = ((s64)(prev_raw_count << shift) >> shift);
1618 ++ local64_add(new - old + count * period, &event->count);
1619 ++
1620 ++ perf_event_update_userpage(event);
1621 ++
1622 ++ return 0;
1623 ++}
1624 ++
1625 + static void __intel_pmu_pebs_event(struct perf_event *event,
1626 + struct pt_regs *iregs,
1627 + void *base, void *top,
1628 + int bit, int count)
1629 + {
1630 ++ struct hw_perf_event *hwc = &event->hw;
1631 + struct perf_sample_data data;
1632 + struct pt_regs regs;
1633 + void *at = get_next_pebs_record_by_bit(base, top, bit);
1634 +
1635 +- if (!intel_pmu_save_and_restart(event) &&
1636 +- !(event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD))
1637 ++ if (hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) {
1638 ++ /*
1639 ++ * Now, auto-reload is only enabled in fixed period mode.
1640 ++ * The reload value is always hwc->sample_period.
1641 ++ * May need to change it, if auto-reload is enabled in
1642 ++ * freq mode later.
1643 ++ */
1644 ++ intel_pmu_save_and_restart_reload(event, count);
1645 ++ } else if (!intel_pmu_save_and_restart(event))
1646 + return;
1647 +
1648 + while (count > 1) {
1649 +@@ -1325,8 +1401,11 @@ static void intel_pmu_drain_pebs_core(struct pt_regs *iregs)
1650 + return;
1651 +
1652 + n = top - at;
1653 +- if (n <= 0)
1654 ++ if (n <= 0) {
1655 ++ if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD)
1656 ++ intel_pmu_save_and_restart_reload(event, 0);
1657 + return;
1658 ++ }
1659 +
1660 + __intel_pmu_pebs_event(event, iregs, at, top, 0, n);
1661 + }
1662 +@@ -1349,8 +1428,22 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
1663 +
1664 + ds->pebs_index = ds->pebs_buffer_base;
1665 +
1666 +- if (unlikely(base >= top))
1667 ++ if (unlikely(base >= top)) {
1668 ++ /*
1669 ++ * The drain_pebs() could be called twice in a short period
1670 ++ * for auto-reload event in pmu::read(). There are no
1671 ++ * overflows have happened in between.
1672 ++ * It needs to call intel_pmu_save_and_restart_reload() to
1673 ++ * update the event->count for this case.
1674 ++ */
1675 ++ for_each_set_bit(bit, (unsigned long *)&cpuc->pebs_enabled,
1676 ++ x86_pmu.max_pebs_events) {
1677 ++ event = cpuc->events[bit];
1678 ++ if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD)
1679 ++ intel_pmu_save_and_restart_reload(event, 0);
1680 ++ }
1681 + return;
1682 ++ }
1683 +
1684 + for (at = base; at < top; at += x86_pmu.pebs_record_size) {
1685 + struct pebs_record_nhm *p = at;
1686 +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
1687 +index bcbb1d2ae10b..f3563179290b 100644
1688 +--- a/arch/x86/events/perf_event.h
1689 ++++ b/arch/x86/events/perf_event.h
1690 +@@ -548,7 +548,7 @@ struct x86_pmu {
1691 + struct x86_pmu_quirk *quirks;
1692 + int perfctr_second_write;
1693 + bool late_ack;
1694 +- unsigned (*limit_period)(struct perf_event *event, unsigned l);
1695 ++ u64 (*limit_period)(struct perf_event *event, u64 l);
1696 +
1697 + /*
1698 + * sysfs attrs
1699 +diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h
1700 +index 39bcefc20de7..bb078786a323 100644
1701 +--- a/arch/x86/include/asm/i8259.h
1702 ++++ b/arch/x86/include/asm/i8259.h
1703 +@@ -68,6 +68,11 @@ struct legacy_pic {
1704 + extern struct legacy_pic *legacy_pic;
1705 + extern struct legacy_pic null_legacy_pic;
1706 +
1707 ++static inline bool has_legacy_pic(void)
1708 ++{
1709 ++ return legacy_pic != &null_legacy_pic;
1710 ++}
1711 ++
1712 + static inline int nr_legacy_irqs(void)
1713 + {
1714 + return legacy_pic->nr_legacy_irqs;
1715 +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
1716 +index c6583efdbdaf..76cf21f887bd 100644
1717 +--- a/arch/x86/kernel/apic/apic.c
1718 ++++ b/arch/x86/kernel/apic/apic.c
1719 +@@ -1403,7 +1403,7 @@ void setup_local_APIC(void)
1720 + * TODO: set up through-local-APIC from through-I/O-APIC? --macro
1721 + */
1722 + value = apic_read(APIC_LVT0) & APIC_LVT_MASKED;
1723 +- if (!cpu && (pic_mode || !value)) {
1724 ++ if (!cpu && (pic_mode || !value || skip_ioapic_setup)) {
1725 + value = APIC_DM_EXTINT;
1726 + apic_printk(APIC_VERBOSE, "enabled ExtINT on CPU#%d\n", cpu);
1727 + } else {
1728 +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c
1729 +index 3fe45f84ced4..7a07b15b451c 100644
1730 +--- a/arch/x86/kernel/devicetree.c
1731 ++++ b/arch/x86/kernel/devicetree.c
1732 +@@ -11,6 +11,7 @@
1733 + #include <linux/of_address.h>
1734 + #include <linux/of_platform.h>
1735 + #include <linux/of_irq.h>
1736 ++#include <linux/libfdt.h>
1737 + #include <linux/slab.h>
1738 + #include <linux/pci.h>
1739 + #include <linux/of_pci.h>
1740 +@@ -199,19 +200,22 @@ static struct of_ioapic_type of_ioapic_type[] =
1741 + static int dt_irqdomain_alloc(struct irq_domain *domain, unsigned int virq,
1742 + unsigned int nr_irqs, void *arg)
1743 + {
1744 +- struct of_phandle_args *irq_data = (void *)arg;
1745 ++ struct irq_fwspec *fwspec = (struct irq_fwspec *)arg;
1746 + struct of_ioapic_type *it;
1747 + struct irq_alloc_info tmp;
1748 ++ int type_index;
1749 +
1750 +- if (WARN_ON(irq_data->args_count < 2))
1751 ++ if (WARN_ON(fwspec->param_count < 2))
1752 + return -EINVAL;
1753 +- if (irq_data->args[1] >= ARRAY_SIZE(of_ioapic_type))
1754 ++
1755 ++ type_index = fwspec->param[1];
1756 ++ if (type_index >= ARRAY_SIZE(of_ioapic_type))
1757 + return -EINVAL;
1758 +
1759 +- it = &of_ioapic_type[irq_data->args[1]];
1760 ++ it = &of_ioapic_type[type_index];
1761 + ioapic_set_alloc_attr(&tmp, NUMA_NO_NODE, it->trigger, it->polarity);
1762 + tmp.ioapic_id = mpc_ioapic_id(mp_irqdomain_ioapic_idx(domain));
1763 +- tmp.ioapic_pin = irq_data->args[0];
1764 ++ tmp.ioapic_pin = fwspec->param[0];
1765 +
1766 + return mp_irqdomain_alloc(domain, virq, nr_irqs, &tmp);
1767 + }
1768 +@@ -276,14 +280,15 @@ static void __init x86_flattree_get_config(void)
1769 +
1770 + map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128);
1771 +
1772 +- initial_boot_params = dt = early_memremap(initial_dtb, map_len);
1773 +- size = of_get_flat_dt_size();
1774 ++ dt = early_memremap(initial_dtb, map_len);
1775 ++ size = fdt_totalsize(dt);
1776 + if (map_len < size) {
1777 + early_memunmap(dt, map_len);
1778 +- initial_boot_params = dt = early_memremap(initial_dtb, size);
1779 ++ dt = early_memremap(initial_dtb, size);
1780 + map_len = size;
1781 + }
1782 +
1783 ++ early_init_dt_verify(dt);
1784 + unflatten_and_copy_device_tree();
1785 + early_memunmap(dt, map_len);
1786 + }
1787 +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
1788 +index cb945146b7c8..10b22fc6ef5a 100644
1789 +--- a/arch/x86/kernel/smpboot.c
1790 ++++ b/arch/x86/kernel/smpboot.c
1791 +@@ -1497,6 +1497,7 @@ static void remove_siblinginfo(int cpu)
1792 + cpumask_clear(topology_core_cpumask(cpu));
1793 + c->phys_proc_id = 0;
1794 + c->cpu_core_id = 0;
1795 ++ c->booted_cores = 0;
1796 + cpumask_clear_cpu(cpu, cpu_sibling_setup_mask);
1797 + recompute_smt_state();
1798 + }
1799 +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
1800 +index da6a287a11e4..769c370011d6 100644
1801 +--- a/arch/x86/kernel/tsc.c
1802 ++++ b/arch/x86/kernel/tsc.c
1803 +@@ -24,6 +24,7 @@
1804 + #include <asm/geode.h>
1805 + #include <asm/apic.h>
1806 + #include <asm/intel-family.h>
1807 ++#include <asm/i8259.h>
1808 +
1809 + unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */
1810 + EXPORT_SYMBOL(cpu_khz);
1811 +@@ -456,6 +457,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
1812 + unsigned long tscmin, tscmax;
1813 + int pitcnt;
1814 +
1815 ++ if (!has_legacy_pic()) {
1816 ++ /*
1817 ++ * Relies on tsc_early_delay_calibrate() to have given us semi
1818 ++ * usable udelay(), wait for the same 50ms we would have with
1819 ++ * the PIT loop below.
1820 ++ */
1821 ++ udelay(10 * USEC_PER_MSEC);
1822 ++ udelay(10 * USEC_PER_MSEC);
1823 ++ udelay(10 * USEC_PER_MSEC);
1824 ++ udelay(10 * USEC_PER_MSEC);
1825 ++ udelay(10 * USEC_PER_MSEC);
1826 ++ return ULONG_MAX;
1827 ++ }
1828 ++
1829 + /* Set the Gate high, disable speaker */
1830 + outb((inb(0x61) & ~0x02) | 0x01, 0x61);
1831 +
1832 +@@ -580,6 +595,9 @@ static unsigned long quick_pit_calibrate(void)
1833 + u64 tsc, delta;
1834 + unsigned long d1, d2;
1835 +
1836 ++ if (!has_legacy_pic())
1837 ++ return 0;
1838 ++
1839 + /* Set the Gate high, disable speaker */
1840 + outb((inb(0x61) & ~0x02) | 0x01, 0x61);
1841 +
1842 +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
1843 +index a69f18d4676c..7e5119c1d15c 100644
1844 +--- a/arch/x86/kvm/cpuid.c
1845 ++++ b/arch/x86/kvm/cpuid.c
1846 +@@ -382,7 +382,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
1847 +
1848 + /* cpuid 7.0.edx*/
1849 + const u32 kvm_cpuid_7_0_edx_x86_features =
1850 +- F(SPEC_CTRL) | F(SSBD) | F(ARCH_CAPABILITIES);
1851 ++ F(SPEC_CTRL) | F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES);
1852 +
1853 + /* all calls to cpuid_count() should be made on the same cpu */
1854 + get_cpu();
1855 +@@ -468,6 +468,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
1856 + entry->ecx &= ~F(PKU);
1857 + entry->edx &= kvm_cpuid_7_0_edx_x86_features;
1858 + cpuid_mask(&entry->edx, CPUID_7_EDX);
1859 ++ /*
1860 ++ * We emulate ARCH_CAPABILITIES in software even
1861 ++ * if the host doesn't support it.
1862 ++ */
1863 ++ entry->edx |= F(ARCH_CAPABILITIES);
1864 + } else {
1865 + entry->ebx = 0;
1866 + entry->ecx = 0;
1867 +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
1868 +index 5c3d416fff17..a8a86be8cf15 100644
1869 +--- a/arch/x86/kvm/lapic.c
1870 ++++ b/arch/x86/kvm/lapic.c
1871 +@@ -299,8 +299,16 @@ void kvm_apic_set_version(struct kvm_vcpu *vcpu)
1872 + if (!lapic_in_kernel(vcpu))
1873 + return;
1874 +
1875 ++ /*
1876 ++ * KVM emulates 82093AA datasheet (with in-kernel IOAPIC implementation)
1877 ++ * which doesn't have EOI register; Some buggy OSes (e.g. Windows with
1878 ++ * Hyper-V role) disable EOI broadcast in lapic not checking for IOAPIC
1879 ++ * version first and level-triggered interrupts never get EOIed in
1880 ++ * IOAPIC.
1881 ++ */
1882 + feat = kvm_find_cpuid_entry(apic->vcpu, 0x1, 0);
1883 +- if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31))))
1884 ++ if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31))) &&
1885 ++ !ioapic_in_kernel(vcpu->kvm))
1886 + v |= APIC_LVR_DIRECTED_EOI;
1887 + kvm_lapic_set_reg(apic, APIC_LVR, v);
1888 + }
1889 +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
1890 +index d92523afb425..2827a9622d97 100644
1891 +--- a/arch/x86/kvm/vmx.c
1892 ++++ b/arch/x86/kvm/vmx.c
1893 +@@ -2558,6 +2558,8 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu, unsigned nr,
1894 + return;
1895 + }
1896 +
1897 ++ WARN_ON_ONCE(vmx->emulation_required);
1898 ++
1899 + if (kvm_exception_is_soft(nr)) {
1900 + vmcs_write32(VM_ENTRY_INSTRUCTION_LEN,
1901 + vmx->vcpu.arch.event_exit_inst_len);
1902 +@@ -6430,12 +6432,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
1903 + goto out;
1904 + }
1905 +
1906 +- if (err != EMULATE_DONE) {
1907 +- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
1908 +- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
1909 +- vcpu->run->internal.ndata = 0;
1910 +- return 0;
1911 +- }
1912 ++ if (err != EMULATE_DONE)
1913 ++ goto emulation_error;
1914 ++
1915 ++ if (vmx->emulation_required && !vmx->rmode.vm86_active &&
1916 ++ vcpu->arch.exception.pending)
1917 ++ goto emulation_error;
1918 +
1919 + if (vcpu->arch.halt_request) {
1920 + vcpu->arch.halt_request = 0;
1921 +@@ -6451,6 +6453,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
1922 +
1923 + out:
1924 + return ret;
1925 ++
1926 ++emulation_error:
1927 ++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
1928 ++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
1929 ++ vcpu->run->internal.ndata = 0;
1930 ++ return 0;
1931 + }
1932 +
1933 + static int __grow_ple_window(int val)
1934 +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
1935 +index a0cb85f30c94..4aa265ae8cf7 100644
1936 +--- a/arch/x86/kvm/x86.c
1937 ++++ b/arch/x86/kvm/x86.c
1938 +@@ -4131,13 +4131,14 @@ long kvm_arch_vm_ioctl(struct file *filp,
1939 + mutex_unlock(&kvm->lock);
1940 + break;
1941 + case KVM_XEN_HVM_CONFIG: {
1942 ++ struct kvm_xen_hvm_config xhc;
1943 + r = -EFAULT;
1944 +- if (copy_from_user(&kvm->arch.xen_hvm_config, argp,
1945 +- sizeof(struct kvm_xen_hvm_config)))
1946 ++ if (copy_from_user(&xhc, argp, sizeof(xhc)))
1947 + goto out;
1948 + r = -EINVAL;
1949 +- if (kvm->arch.xen_hvm_config.flags)
1950 ++ if (xhc.flags)
1951 + goto out;
1952 ++ memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc));
1953 + r = 0;
1954 + break;
1955 + }
1956 +@@ -7258,6 +7259,7 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
1957 + {
1958 + struct msr_data apic_base_msr;
1959 + int mmu_reset_needed = 0;
1960 ++ int cpuid_update_needed = 0;
1961 + int pending_vec, max_bits, idx;
1962 + struct desc_ptr dt;
1963 +
1964 +@@ -7289,8 +7291,10 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
1965 + vcpu->arch.cr0 = sregs->cr0;
1966 +
1967 + mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4;
1968 ++ cpuid_update_needed |= ((kvm_read_cr4(vcpu) ^ sregs->cr4) &
1969 ++ (X86_CR4_OSXSAVE | X86_CR4_PKE));
1970 + kvm_x86_ops->set_cr4(vcpu, sregs->cr4);
1971 +- if (sregs->cr4 & (X86_CR4_OSXSAVE | X86_CR4_PKE))
1972 ++ if (cpuid_update_needed)
1973 + kvm_update_cpuid(vcpu);
1974 +
1975 + idx = srcu_read_lock(&vcpu->kvm->srcu);
1976 +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
1977 +index 7df8e3a79dc0..d35d0e4bbf99 100644
1978 +--- a/arch/x86/mm/init_64.c
1979 ++++ b/arch/x86/mm/init_64.c
1980 +@@ -1014,8 +1014,7 @@ void __init mem_init(void)
1981 + after_bootmem = 1;
1982 +
1983 + /* Register memory areas for /proc/kcore */
1984 +- kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR,
1985 +- PAGE_SIZE, KCORE_OTHER);
1986 ++ kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
1987 +
1988 + mem_init_print_info(NULL);
1989 + }
1990 +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
1991 +index 73dcb0e18c1b..dcd671467154 100644
1992 +--- a/arch/x86/mm/pageattr.c
1993 ++++ b/arch/x86/mm/pageattr.c
1994 +@@ -279,9 +279,11 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
1995 +
1996 + /*
1997 + * The .rodata section needs to be read-only. Using the pfn
1998 +- * catches all aliases.
1999 ++ * catches all aliases. This also includes __ro_after_init,
2000 ++ * so do not enforce until kernel_set_to_readonly is true.
2001 + */
2002 +- if (within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT,
2003 ++ if (kernel_set_to_readonly &&
2004 ++ within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT,
2005 + __pa_symbol(__end_rodata) >> PAGE_SHIFT))
2006 + pgprot_val(forbidden) |= _PAGE_RW;
2007 +
2008 +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
2009 +index b97ef29c940f..a3b63e5a527c 100644
2010 +--- a/arch/x86/mm/pgtable.c
2011 ++++ b/arch/x86/mm/pgtable.c
2012 +@@ -1,5 +1,6 @@
2013 + #include <linux/mm.h>
2014 + #include <linux/gfp.h>
2015 ++#include <linux/hugetlb.h>
2016 + #include <asm/pgalloc.h>
2017 + #include <asm/pgtable.h>
2018 + #include <asm/tlb.h>
2019 +@@ -577,6 +578,10 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot)
2020 + (mtrr != MTRR_TYPE_WRBACK))
2021 + return 0;
2022 +
2023 ++ /* Bail out if we are we on a populated non-leaf entry: */
2024 ++ if (pud_present(*pud) && !pud_huge(*pud))
2025 ++ return 0;
2026 ++
2027 + prot = pgprot_4k_2_large(prot);
2028 +
2029 + set_pte((pte_t *)pud, pfn_pte(
2030 +@@ -605,6 +610,10 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot)
2031 + return 0;
2032 + }
2033 +
2034 ++ /* Bail out if we are we on a populated non-leaf entry: */
2035 ++ if (pmd_present(*pmd) && !pmd_huge(*pmd))
2036 ++ return 0;
2037 ++
2038 + prot = pgprot_4k_2_large(prot);
2039 +
2040 + set_pte((pte_t *)pmd, pfn_pte(
2041 +diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
2042 +index 9f14bd34581d..74b516cb39df 100644
2043 +--- a/arch/x86/power/hibernate_32.c
2044 ++++ b/arch/x86/power/hibernate_32.c
2045 +@@ -142,7 +142,7 @@ static inline void resume_init_first_level_page_table(pgd_t *pg_dir)
2046 + #endif
2047 + }
2048 +
2049 +-int swsusp_arch_resume(void)
2050 ++asmlinkage int swsusp_arch_resume(void)
2051 + {
2052 + int error;
2053 +
2054 +diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
2055 +index 9634557a5444..0cb1dd461529 100644
2056 +--- a/arch/x86/power/hibernate_64.c
2057 ++++ b/arch/x86/power/hibernate_64.c
2058 +@@ -149,7 +149,7 @@ static int relocate_restore_code(void)
2059 + return 0;
2060 + }
2061 +
2062 +-int swsusp_arch_resume(void)
2063 ++asmlinkage int swsusp_arch_resume(void)
2064 + {
2065 + int error;
2066 +
2067 +diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
2068 +index f6a009d88a33..52e5ea3b8e40 100644
2069 +--- a/crypto/asymmetric_keys/pkcs7_trust.c
2070 ++++ b/crypto/asymmetric_keys/pkcs7_trust.c
2071 +@@ -106,6 +106,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7,
2072 + pr_devel("sinfo %u: Direct signer is key %x\n",
2073 + sinfo->index, key_serial(key));
2074 + x509 = NULL;
2075 ++ sig = sinfo->sig;
2076 + goto matched;
2077 + }
2078 + if (PTR_ERR(key) != -ENOKEY)
2079 +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
2080 +index eb76a4c10dbf..8ce203f84ec4 100644
2081 +--- a/drivers/acpi/acpi_pad.c
2082 ++++ b/drivers/acpi/acpi_pad.c
2083 +@@ -109,6 +109,7 @@ static void round_robin_cpu(unsigned int tsk_index)
2084 + cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus);
2085 + if (cpumask_empty(tmp)) {
2086 + mutex_unlock(&round_robin_lock);
2087 ++ free_cpumask_var(tmp);
2088 + return;
2089 + }
2090 + for_each_cpu(cpu, tmp) {
2091 +@@ -126,6 +127,8 @@ static void round_robin_cpu(unsigned int tsk_index)
2092 + mutex_unlock(&round_robin_lock);
2093 +
2094 + set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu));
2095 ++
2096 ++ free_cpumask_var(tmp);
2097 + }
2098 +
2099 + static void exit_round_robin(unsigned int tsk_index)
2100 +diff --git a/drivers/acpi/acpica/evevent.c b/drivers/acpi/acpica/evevent.c
2101 +index 80fc0b9b11e5..f362841881e6 100644
2102 +--- a/drivers/acpi/acpica/evevent.c
2103 ++++ b/drivers/acpi/acpica/evevent.c
2104 +@@ -204,6 +204,7 @@ u32 acpi_ev_fixed_event_detect(void)
2105 + u32 fixed_status;
2106 + u32 fixed_enable;
2107 + u32 i;
2108 ++ acpi_status status;
2109 +
2110 + ACPI_FUNCTION_NAME(ev_fixed_event_detect);
2111 +
2112 +@@ -211,8 +212,12 @@ u32 acpi_ev_fixed_event_detect(void)
2113 + * Read the fixed feature status and enable registers, as all the cases
2114 + * depend on their values. Ignore errors here.
2115 + */
2116 +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status);
2117 +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable);
2118 ++ status = acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status);
2119 ++ status |=
2120 ++ acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable);
2121 ++ if (ACPI_FAILURE(status)) {
2122 ++ return (int_status);
2123 ++ }
2124 +
2125 + ACPI_DEBUG_PRINT((ACPI_DB_INTERRUPTS,
2126 + "Fixed Event Block: Enable %08X Status %08X\n",
2127 +diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c
2128 +index 5d59cfcef6f4..c5d6701a5ad2 100644
2129 +--- a/drivers/acpi/acpica/nseval.c
2130 ++++ b/drivers/acpi/acpica/nseval.c
2131 +@@ -308,6 +308,14 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info)
2132 + /* Map AE_CTRL_RETURN_VALUE to AE_OK, we are done with it */
2133 +
2134 + status = AE_OK;
2135 ++ } else if (ACPI_FAILURE(status)) {
2136 ++
2137 ++ /* If return_object exists, delete it */
2138 ++
2139 ++ if (info->return_object) {
2140 ++ acpi_ut_remove_reference(info->return_object);
2141 ++ info->return_object = NULL;
2142 ++ }
2143 + }
2144 +
2145 + ACPI_DEBUG_PRINT((ACPI_DB_NAMES,
2146 +diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
2147 +index bb01dea39fdc..9825780a1cd2 100644
2148 +--- a/drivers/acpi/processor_perflib.c
2149 ++++ b/drivers/acpi/processor_perflib.c
2150 +@@ -161,7 +161,7 @@ int acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag)
2151 + {
2152 + int ret;
2153 +
2154 +- if (ignore_ppc) {
2155 ++ if (ignore_ppc || !pr->performance) {
2156 + /*
2157 + * Only when it is notification event, the _OST object
2158 + * will be evaluated. Otherwise it is skipped.
2159 +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
2160 +index cf725d581cae..145dcf293c6f 100644
2161 +--- a/drivers/acpi/scan.c
2162 ++++ b/drivers/acpi/scan.c
2163 +@@ -1422,6 +1422,8 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
2164 + device_initialize(&device->dev);
2165 + dev_set_uevent_suppress(&device->dev, true);
2166 + acpi_init_coherency(device);
2167 ++ /* Assume there are unmet deps until acpi_device_dep_initialize() runs */
2168 ++ device->dep_unmet = 1;
2169 + }
2170 +
2171 + void acpi_device_add_finalize(struct acpi_device *device)
2172 +@@ -1445,6 +1447,14 @@ static int acpi_add_single_object(struct acpi_device **child,
2173 + }
2174 +
2175 + acpi_init_device_object(device, handle, type, sta);
2176 ++ /*
2177 ++ * For ACPI_BUS_TYPE_DEVICE getting the status is delayed till here so
2178 ++ * that we can call acpi_bus_get_status() and use its quirk handling.
2179 ++ * Note this must be done before the get power-/wakeup_dev-flags calls.
2180 ++ */
2181 ++ if (type == ACPI_BUS_TYPE_DEVICE)
2182 ++ acpi_bus_get_status(device);
2183 ++
2184 + acpi_bus_get_power_flags(device);
2185 + acpi_bus_get_wakeup_device_flags(device);
2186 +
2187 +@@ -1517,9 +1527,11 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type,
2188 + return -ENODEV;
2189 +
2190 + *type = ACPI_BUS_TYPE_DEVICE;
2191 +- status = acpi_bus_get_status_handle(handle, sta);
2192 +- if (ACPI_FAILURE(status))
2193 +- *sta = 0;
2194 ++ /*
2195 ++ * acpi_add_single_object updates this once we've an acpi_device
2196 ++ * so that acpi_bus_get_status' quirk handling can be used.
2197 ++ */
2198 ++ *sta = 0;
2199 + break;
2200 + case ACPI_TYPE_PROCESSOR:
2201 + *type = ACPI_BUS_TYPE_PROCESSOR;
2202 +@@ -1621,6 +1633,8 @@ static void acpi_device_dep_initialize(struct acpi_device *adev)
2203 + acpi_status status;
2204 + int i;
2205 +
2206 ++ adev->dep_unmet = 0;
2207 ++
2208 + if (!acpi_has_method(adev->handle, "_DEP"))
2209 + return;
2210 +
2211 +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
2212 +index 4fe3ec122bf0..0e2c0ac5792d 100644
2213 +--- a/drivers/ata/libata-core.c
2214 ++++ b/drivers/ata/libata-core.c
2215 +@@ -4366,6 +4366,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
2216 + /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */
2217 + { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, },
2218 +
2219 ++ /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on
2220 ++ SD7SN6S256G and SD8SN8U256G */
2221 ++ { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, },
2222 ++
2223 + /* devices which puke on READ_NATIVE_MAX */
2224 + { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, },
2225 + { "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA },
2226 +@@ -4426,6 +4430,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
2227 + { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, },
2228 +
2229 + /* devices that don't properly handle queued TRIM commands */
2230 ++ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
2231 ++ ATA_HORKAGE_ZERO_AFTER_TRIM, },
2232 + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
2233 + ATA_HORKAGE_ZERO_AFTER_TRIM, },
2234 + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
2235 +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
2236 +index 9babbc845750..fb2c00fce8f9 100644
2237 +--- a/drivers/ata/libata-scsi.c
2238 ++++ b/drivers/ata/libata-scsi.c
2239 +@@ -4156,7 +4156,7 @@ static inline void ata_scsi_dump_cdb(struct ata_port *ap,
2240 + #ifdef ATA_DEBUG
2241 + struct scsi_device *scsidev = cmd->device;
2242 +
2243 +- DPRINTK("CDB (%u:%d,%d,%d) %9ph\n",
2244 ++ DPRINTK("CDB (%u:%d,%d,%lld) %9ph\n",
2245 + ap->print_id,
2246 + scsidev->channel, scsidev->id, scsidev->lun,
2247 + cmd->cmnd);
2248 +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
2249 +index a7b0fc7cb468..69c84fddfe8a 100644
2250 +--- a/drivers/base/regmap/regmap.c
2251 ++++ b/drivers/base/regmap/regmap.c
2252 +@@ -98,7 +98,7 @@ bool regmap_cached(struct regmap *map, unsigned int reg)
2253 + int ret;
2254 + unsigned int val;
2255 +
2256 +- if (map->cache == REGCACHE_NONE)
2257 ++ if (map->cache_type == REGCACHE_NONE)
2258 + return false;
2259 +
2260 + if (!map->cache_ops)
2261 +diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c
2262 +index 93362362aa55..8474a1b0740f 100644
2263 +--- a/drivers/block/paride/pcd.c
2264 ++++ b/drivers/block/paride/pcd.c
2265 +@@ -230,6 +230,8 @@ static int pcd_block_open(struct block_device *bdev, fmode_t mode)
2266 + struct pcd_unit *cd = bdev->bd_disk->private_data;
2267 + int ret;
2268 +
2269 ++ check_disk_change(bdev);
2270 ++
2271 + mutex_lock(&pcd_mutex);
2272 + ret = cdrom_open(&cd->info, bdev, mode);
2273 + mutex_unlock(&pcd_mutex);
2274 +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
2275 +index 128ebd439221..07b77fb102a1 100644
2276 +--- a/drivers/cdrom/cdrom.c
2277 ++++ b/drivers/cdrom/cdrom.c
2278 +@@ -1154,9 +1154,6 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev,
2279 +
2280 + cd_dbg(CD_OPEN, "entering cdrom_open\n");
2281 +
2282 +- /* open is event synchronization point, check events first */
2283 +- check_disk_change(bdev);
2284 +-
2285 + /* if this was a O_NONBLOCK open and we should honor the flags,
2286 + * do a quick open without drive/disc integrity checks. */
2287 + cdi->use_count++;
2288 +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
2289 +index 584bc3126403..e2808fefbb78 100644
2290 +--- a/drivers/cdrom/gdrom.c
2291 ++++ b/drivers/cdrom/gdrom.c
2292 +@@ -497,6 +497,9 @@ static struct cdrom_device_ops gdrom_ops = {
2293 + static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
2294 + {
2295 + int ret;
2296 ++
2297 ++ check_disk_change(bdev);
2298 ++
2299 + mutex_lock(&gdrom_mutex);
2300 + ret = cdrom_open(gd.cd_info, bdev, mode);
2301 + mutex_unlock(&gdrom_mutex);
2302 +diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c
2303 +index 63d84e6f1891..83c695938a2d 100644
2304 +--- a/drivers/char/hw_random/stm32-rng.c
2305 ++++ b/drivers/char/hw_random/stm32-rng.c
2306 +@@ -21,6 +21,7 @@
2307 + #include <linux/of_address.h>
2308 + #include <linux/of_platform.h>
2309 + #include <linux/pm_runtime.h>
2310 ++#include <linux/reset.h>
2311 + #include <linux/slab.h>
2312 +
2313 + #define RNG_CR 0x00
2314 +@@ -46,6 +47,7 @@ struct stm32_rng_private {
2315 + struct hwrng rng;
2316 + void __iomem *base;
2317 + struct clk *clk;
2318 ++ struct reset_control *rst;
2319 + };
2320 +
2321 + static int stm32_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
2322 +@@ -140,6 +142,13 @@ static int stm32_rng_probe(struct platform_device *ofdev)
2323 + if (IS_ERR(priv->clk))
2324 + return PTR_ERR(priv->clk);
2325 +
2326 ++ priv->rst = devm_reset_control_get(&ofdev->dev, NULL);
2327 ++ if (!IS_ERR(priv->rst)) {
2328 ++ reset_control_assert(priv->rst);
2329 ++ udelay(2);
2330 ++ reset_control_deassert(priv->rst);
2331 ++ }
2332 ++
2333 + dev_set_drvdata(dev, priv);
2334 +
2335 + priv->rng.name = dev_driver_string(dev),
2336 +diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c
2337 +index 6e658aa114f1..a70518a4fcec 100644
2338 +--- a/drivers/char/ipmi/ipmi_powernv.c
2339 ++++ b/drivers/char/ipmi/ipmi_powernv.c
2340 +@@ -251,8 +251,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev)
2341 + ipmi->irq = opal_event_request(prop);
2342 + }
2343 +
2344 +- if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
2345 +- "opal-ipmi", ipmi)) {
2346 ++ rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
2347 ++ "opal-ipmi", ipmi);
2348 ++ if (rc) {
2349 + dev_warn(dev, "Unable to request irq\n");
2350 + goto err_dispose;
2351 + }
2352 +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
2353 +index f11c1c7e84c6..121319198478 100644
2354 +--- a/drivers/char/ipmi/ipmi_ssif.c
2355 ++++ b/drivers/char/ipmi/ipmi_ssif.c
2356 +@@ -761,7 +761,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
2357 + ssif_info->ssif_state = SSIF_NORMAL;
2358 + ipmi_ssif_unlock_cond(ssif_info, flags);
2359 + pr_warn(PFX "Error getting flags: %d %d, %x\n",
2360 +- result, len, data[2]);
2361 ++ result, len, (len >= 3) ? data[2] : 0);
2362 + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
2363 + || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
2364 + /*
2365 +@@ -783,7 +783,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
2366 + if ((result < 0) || (len < 3) || (data[2] != 0)) {
2367 + /* Error clearing flags */
2368 + pr_warn(PFX "Error clearing flags: %d %d, %x\n",
2369 +- result, len, data[2]);
2370 ++ result, len, (len >= 3) ? data[2] : 0);
2371 + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
2372 + || data[1] != IPMI_CLEAR_MSG_FLAGS_CMD) {
2373 + pr_warn(PFX "Invalid response clearing flags: %x %x\n",
2374 +diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c
2375 +index 738515b89073..a22c1d704901 100644
2376 +--- a/drivers/clocksource/fsl_ftm_timer.c
2377 ++++ b/drivers/clocksource/fsl_ftm_timer.c
2378 +@@ -281,7 +281,7 @@ static int __init __ftm_clk_init(struct device_node *np, char *cnt_name,
2379 +
2380 + static unsigned long __init ftm_clk_init(struct device_node *np)
2381 + {
2382 +- unsigned long freq;
2383 ++ long freq;
2384 +
2385 + freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt");
2386 + if (freq <= 0)
2387 +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
2388 +index 4852d9efe74e..9f09752169ea 100644
2389 +--- a/drivers/cpufreq/cppc_cpufreq.c
2390 ++++ b/drivers/cpufreq/cppc_cpufreq.c
2391 +@@ -151,9 +151,19 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
2392 + policy->cpuinfo.transition_latency = cppc_get_transition_latency(cpu_num);
2393 + policy->shared_type = cpu->shared_type;
2394 +
2395 +- if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY)
2396 ++ if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) {
2397 ++ int i;
2398 ++
2399 + cpumask_copy(policy->cpus, cpu->shared_cpu_map);
2400 +- else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
2401 ++
2402 ++ for_each_cpu(i, policy->cpus) {
2403 ++ if (unlikely(i == policy->cpu))
2404 ++ continue;
2405 ++
2406 ++ memcpy(&all_cpu_data[i]->perf_caps, &cpu->perf_caps,
2407 ++ sizeof(cpu->perf_caps));
2408 ++ }
2409 ++ } else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) {
2410 + /* Support only SW_ANY for now. */
2411 + pr_debug("Unsupported CPU co-ord type\n");
2412 + return -EFAULT;
2413 +@@ -218,8 +228,13 @@ static int __init cppc_cpufreq_init(void)
2414 + return ret;
2415 +
2416 + out:
2417 +- for_each_possible_cpu(i)
2418 +- kfree(all_cpu_data[i]);
2419 ++ for_each_possible_cpu(i) {
2420 ++ cpu = all_cpu_data[i];
2421 ++ if (!cpu)
2422 ++ break;
2423 ++ free_cpumask_var(cpu->shared_cpu_map);
2424 ++ kfree(cpu);
2425 ++ }
2426 +
2427 + kfree(all_cpu_data);
2428 + return -ENODEV;
2429 +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
2430 +index 35e34c0e0429..7523929becdc 100644
2431 +--- a/drivers/cpufreq/cpufreq.c
2432 ++++ b/drivers/cpufreq/cpufreq.c
2433 +@@ -1288,14 +1288,14 @@ static int cpufreq_online(unsigned int cpu)
2434 + return 0;
2435 +
2436 + out_exit_policy:
2437 ++ for_each_cpu(j, policy->real_cpus)
2438 ++ remove_cpu_dev_symlink(policy, get_cpu_device(j));
2439 ++
2440 + up_write(&policy->rwsem);
2441 +
2442 + if (cpufreq_driver->exit)
2443 + cpufreq_driver->exit(policy);
2444 +
2445 +- for_each_cpu(j, policy->real_cpus)
2446 +- remove_cpu_dev_symlink(policy, get_cpu_device(j));
2447 +-
2448 + out_free_policy:
2449 + cpufreq_policy_free(policy, !new_policy);
2450 + return ret;
2451 +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
2452 +index f3e211f8f6c5..71866646ffef 100644
2453 +--- a/drivers/dma/mv_xor_v2.c
2454 ++++ b/drivers/dma/mv_xor_v2.c
2455 +@@ -152,6 +152,7 @@ struct mv_xor_v2_device {
2456 + void __iomem *dma_base;
2457 + void __iomem *glob_base;
2458 + struct clk *clk;
2459 ++ struct clk *reg_clk;
2460 + struct tasklet_struct irq_tasklet;
2461 + struct list_head free_sw_desc;
2462 + struct dma_device dmadev;
2463 +@@ -697,13 +698,26 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
2464 + if (ret)
2465 + return ret;
2466 +
2467 ++ xor_dev->reg_clk = devm_clk_get(&pdev->dev, "reg");
2468 ++ if (PTR_ERR(xor_dev->reg_clk) != -ENOENT) {
2469 ++ if (!IS_ERR(xor_dev->reg_clk)) {
2470 ++ ret = clk_prepare_enable(xor_dev->reg_clk);
2471 ++ if (ret)
2472 ++ return ret;
2473 ++ } else {
2474 ++ return PTR_ERR(xor_dev->reg_clk);
2475 ++ }
2476 ++ }
2477 ++
2478 + xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
2479 +- if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER)
2480 +- return -EPROBE_DEFER;
2481 ++ if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
2482 ++ ret = EPROBE_DEFER;
2483 ++ goto disable_reg_clk;
2484 ++ }
2485 + if (!IS_ERR(xor_dev->clk)) {
2486 + ret = clk_prepare_enable(xor_dev->clk);
2487 + if (ret)
2488 +- return ret;
2489 ++ goto disable_reg_clk;
2490 + }
2491 +
2492 + ret = platform_msi_domain_alloc_irqs(&pdev->dev, 1,
2493 +@@ -812,8 +826,9 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
2494 + free_msi_irqs:
2495 + platform_msi_domain_free_irqs(&pdev->dev);
2496 + disable_clk:
2497 +- if (!IS_ERR(xor_dev->clk))
2498 +- clk_disable_unprepare(xor_dev->clk);
2499 ++ clk_disable_unprepare(xor_dev->clk);
2500 ++disable_reg_clk:
2501 ++ clk_disable_unprepare(xor_dev->reg_clk);
2502 + return ret;
2503 + }
2504 +
2505 +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
2506 +index fb2e7476d96b..2c449bdacb91 100644
2507 +--- a/drivers/dma/pl330.c
2508 ++++ b/drivers/dma/pl330.c
2509 +@@ -1570,7 +1570,7 @@ static void pl330_dotask(unsigned long data)
2510 + /* Returns 1 if state was updated, 0 otherwise */
2511 + static int pl330_update(struct pl330_dmac *pl330)
2512 + {
2513 +- struct dma_pl330_desc *descdone, *tmp;
2514 ++ struct dma_pl330_desc *descdone;
2515 + unsigned long flags;
2516 + void __iomem *regs;
2517 + u32 val;
2518 +@@ -1648,7 +1648,9 @@ static int pl330_update(struct pl330_dmac *pl330)
2519 + }
2520 +
2521 + /* Now that we are in no hurry, do the callbacks */
2522 +- list_for_each_entry_safe(descdone, tmp, &pl330->req_done, rqd) {
2523 ++ while (!list_empty(&pl330->req_done)) {
2524 ++ descdone = list_first_entry(&pl330->req_done,
2525 ++ struct dma_pl330_desc, rqd);
2526 + list_del(&descdone->rqd);
2527 + spin_unlock_irqrestore(&pl330->lock, flags);
2528 + dma_pl330_rqcb(descdone, PL330_ERR_NONE);
2529 +diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
2530 +index 03c4eb3fd314..6497f5283e3b 100644
2531 +--- a/drivers/dma/qcom/bam_dma.c
2532 ++++ b/drivers/dma/qcom/bam_dma.c
2533 +@@ -387,6 +387,7 @@ struct bam_device {
2534 + struct device_dma_parameters dma_parms;
2535 + struct bam_chan *channels;
2536 + u32 num_channels;
2537 ++ u32 num_ees;
2538 +
2539 + /* execution environment ID, from DT */
2540 + u32 ee;
2541 +@@ -1076,15 +1077,19 @@ static int bam_init(struct bam_device *bdev)
2542 + u32 val;
2543 +
2544 + /* read revision and configuration information */
2545 +- val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION)) >> NUM_EES_SHIFT;
2546 +- val &= NUM_EES_MASK;
2547 ++ if (!bdev->num_ees) {
2548 ++ val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION));
2549 ++ bdev->num_ees = (val >> NUM_EES_SHIFT) & NUM_EES_MASK;
2550 ++ }
2551 +
2552 + /* check that configured EE is within range */
2553 +- if (bdev->ee >= val)
2554 ++ if (bdev->ee >= bdev->num_ees)
2555 + return -EINVAL;
2556 +
2557 +- val = readl_relaxed(bam_addr(bdev, 0, BAM_NUM_PIPES));
2558 +- bdev->num_channels = val & BAM_NUM_PIPES_MASK;
2559 ++ if (!bdev->num_channels) {
2560 ++ val = readl_relaxed(bam_addr(bdev, 0, BAM_NUM_PIPES));
2561 ++ bdev->num_channels = val & BAM_NUM_PIPES_MASK;
2562 ++ }
2563 +
2564 + if (bdev->controlled_remotely)
2565 + return 0;
2566 +@@ -1179,6 +1184,18 @@ static int bam_dma_probe(struct platform_device *pdev)
2567 + bdev->controlled_remotely = of_property_read_bool(pdev->dev.of_node,
2568 + "qcom,controlled-remotely");
2569 +
2570 ++ if (bdev->controlled_remotely) {
2571 ++ ret = of_property_read_u32(pdev->dev.of_node, "num-channels",
2572 ++ &bdev->num_channels);
2573 ++ if (ret)
2574 ++ dev_err(bdev->dev, "num-channels unspecified in dt\n");
2575 ++
2576 ++ ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees",
2577 ++ &bdev->num_ees);
2578 ++ if (ret)
2579 ++ dev_err(bdev->dev, "num-ees unspecified in dt\n");
2580 ++ }
2581 ++
2582 + bdev->bamclk = devm_clk_get(bdev->dev, "bam_clk");
2583 + if (IS_ERR(bdev->bamclk))
2584 + return PTR_ERR(bdev->bamclk);
2585 +diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
2586 +index 4c357d475465..d032032337e7 100644
2587 +--- a/drivers/dma/sh/rcar-dmac.c
2588 ++++ b/drivers/dma/sh/rcar-dmac.c
2589 +@@ -870,7 +870,7 @@ rcar_dmac_chan_prep_sg(struct rcar_dmac_chan *chan, struct scatterlist *sgl,
2590 +
2591 + rcar_dmac_chan_configure_desc(chan, desc);
2592 +
2593 +- max_chunk_size = (RCAR_DMATCR_MASK + 1) << desc->xfer_shift;
2594 ++ max_chunk_size = RCAR_DMATCR_MASK << desc->xfer_shift;
2595 +
2596 + /*
2597 + * Allocate and fill the transfer chunk descriptors. We own the only
2598 +@@ -1246,8 +1246,17 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan,
2599 + * If the cookie doesn't correspond to the currently running transfer
2600 + * then the descriptor hasn't been processed yet, and the residue is
2601 + * equal to the full descriptor size.
2602 ++ * Also, a client driver is possible to call this function before
2603 ++ * rcar_dmac_isr_channel_thread() runs. In this case, the "desc.running"
2604 ++ * will be the next descriptor, and the done list will appear. So, if
2605 ++ * the argument cookie matches the done list's cookie, we can assume
2606 ++ * the residue is zero.
2607 + */
2608 + if (cookie != desc->async_tx.cookie) {
2609 ++ list_for_each_entry(desc, &chan->desc.done, node) {
2610 ++ if (cookie == desc->async_tx.cookie)
2611 ++ return 0;
2612 ++ }
2613 + list_for_each_entry(desc, &chan->desc.pending, node) {
2614 + if (cookie == desc->async_tx.cookie)
2615 + return desc->size;
2616 +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
2617 +index 8bf89267dc25..d731b413cb2c 100644
2618 +--- a/drivers/firewire/ohci.c
2619 ++++ b/drivers/firewire/ohci.c
2620 +@@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx)
2621 + return -ENOMEM;
2622 +
2623 + offset = (void *)&desc->buffer - (void *)desc;
2624 +- desc->buffer_size = PAGE_SIZE - offset;
2625 ++ /*
2626 ++ * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
2627 ++ * for descriptors, even 0x10-byte ones. This can cause page faults when
2628 ++ * an IOMMU is in use and the oversized read crosses a page boundary.
2629 ++ * Work around this by always leaving at least 0x10 bytes of padding.
2630 ++ */
2631 ++ desc->buffer_size = PAGE_SIZE - offset - 0x10;
2632 + desc->buffer_bus = bus_addr + offset;
2633 + desc->used = 0;
2634 +
2635 +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
2636 +index 88bebe1968b7..42844c318445 100644
2637 +--- a/drivers/firmware/dmi_scan.c
2638 ++++ b/drivers/firmware/dmi_scan.c
2639 +@@ -18,7 +18,7 @@ EXPORT_SYMBOL_GPL(dmi_kobj);
2640 + * of and an antecedent to, SMBIOS, which stands for System
2641 + * Management BIOS. See further: http://www.dmtf.org/standards
2642 + */
2643 +-static const char dmi_empty_string[] = " ";
2644 ++static const char dmi_empty_string[] = "";
2645 +
2646 + static u32 dmi_ver __initdata;
2647 + static u32 dmi_len;
2648 +@@ -44,25 +44,21 @@ static int dmi_memdev_nr;
2649 + static const char * __init dmi_string_nosave(const struct dmi_header *dm, u8 s)
2650 + {
2651 + const u8 *bp = ((u8 *) dm) + dm->length;
2652 ++ const u8 *nsp;
2653 +
2654 + if (s) {
2655 +- s--;
2656 +- while (s > 0 && *bp) {
2657 ++ while (--s > 0 && *bp)
2658 + bp += strlen(bp) + 1;
2659 +- s--;
2660 +- }
2661 +-
2662 +- if (*bp != 0) {
2663 +- size_t len = strlen(bp)+1;
2664 +- size_t cmp_len = len > 8 ? 8 : len;
2665 +
2666 +- if (!memcmp(bp, dmi_empty_string, cmp_len))
2667 +- return dmi_empty_string;
2668 ++ /* Strings containing only spaces are considered empty */
2669 ++ nsp = bp;
2670 ++ while (*nsp == ' ')
2671 ++ nsp++;
2672 ++ if (*nsp != '\0')
2673 + return bp;
2674 +- }
2675 + }
2676 +
2677 +- return "";
2678 ++ return dmi_empty_string;
2679 + }
2680 +
2681 + static const char * __init dmi_string(const struct dmi_header *dm, u8 s)
2682 +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
2683 +index 603d8425cca6..699db138c5de 100644
2684 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
2685 ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
2686 +@@ -926,7 +926,7 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no)
2687 + struct drm_device *drm_dev = g2d->subdrv.drm_dev;
2688 + struct g2d_runqueue_node *runqueue_node = g2d->runqueue_node;
2689 + struct drm_exynos_pending_g2d_event *e;
2690 +- struct timeval now;
2691 ++ struct timespec64 now;
2692 +
2693 + if (list_empty(&runqueue_node->event_list))
2694 + return;
2695 +@@ -934,9 +934,9 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no)
2696 + e = list_first_entry(&runqueue_node->event_list,
2697 + struct drm_exynos_pending_g2d_event, base.link);
2698 +
2699 +- do_gettimeofday(&now);
2700 ++ ktime_get_ts64(&now);
2701 + e->event.tv_sec = now.tv_sec;
2702 +- e->event.tv_usec = now.tv_usec;
2703 ++ e->event.tv_usec = now.tv_nsec / NSEC_PER_USEC;
2704 + e->event.cmdlist_no = cmdlist_no;
2705 +
2706 + drm_send_event(drm_dev, &e->base);
2707 +diff --git a/drivers/gpu/drm/exynos/regs-fimc.h b/drivers/gpu/drm/exynos/regs-fimc.h
2708 +index 30496134a3d0..d7cbe53c4c01 100644
2709 +--- a/drivers/gpu/drm/exynos/regs-fimc.h
2710 ++++ b/drivers/gpu/drm/exynos/regs-fimc.h
2711 +@@ -569,7 +569,7 @@
2712 + #define EXYNOS_CIIMGEFF_FIN_EMBOSSING (4 << 26)
2713 + #define EXYNOS_CIIMGEFF_FIN_SILHOUETTE (5 << 26)
2714 + #define EXYNOS_CIIMGEFF_FIN_MASK (7 << 26)
2715 +-#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff < 13) | (0xff < 0))
2716 ++#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff << 13) | (0xff << 0))
2717 +
2718 + /* Real input DMA size register */
2719 + #define EXYNOS_CIREAL_ISIZE_AUTOLOAD_ENABLE (1 << 31)
2720 +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
2721 +index 6be515a9fb69..8dbba61a2708 100644
2722 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
2723 ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
2724 +@@ -189,7 +189,11 @@ static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
2725 + struct drm_crtc_state *old_crtc_state)
2726 + {
2727 + drm_crtc_vblank_on(crtc);
2728 ++}
2729 +
2730 ++static void ipu_crtc_atomic_flush(struct drm_crtc *crtc,
2731 ++ struct drm_crtc_state *old_crtc_state)
2732 ++{
2733 + spin_lock_irq(&crtc->dev->event_lock);
2734 + if (crtc->state->event) {
2735 + WARN_ON(drm_crtc_vblank_get(crtc));
2736 +@@ -257,6 +261,7 @@ static const struct drm_crtc_helper_funcs ipu_helper_funcs = {
2737 + .mode_set_nofb = ipu_crtc_mode_set_nofb,
2738 + .atomic_check = ipu_crtc_atomic_check,
2739 + .atomic_begin = ipu_crtc_atomic_begin,
2740 ++ .atomic_flush = ipu_crtc_atomic_flush,
2741 + .atomic_disable = ipu_crtc_atomic_disable,
2742 + .enable = ipu_crtc_enable,
2743 + };
2744 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
2745 +index e2faccffee6f..d66e0e76faf4 100644
2746 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
2747 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
2748 +@@ -46,8 +46,8 @@ uint32_t gf100_pmu_data[] = {
2749 + 0x00000000,
2750 + 0x00000000,
2751 + 0x584d454d,
2752 +- 0x00000756,
2753 +- 0x00000748,
2754 ++ 0x00000754,
2755 ++ 0x00000746,
2756 + 0x00000000,
2757 + 0x00000000,
2758 + 0x00000000,
2759 +@@ -68,8 +68,8 @@ uint32_t gf100_pmu_data[] = {
2760 + 0x00000000,
2761 + 0x00000000,
2762 + 0x46524550,
2763 +- 0x0000075a,
2764 + 0x00000758,
2765 ++ 0x00000756,
2766 + 0x00000000,
2767 + 0x00000000,
2768 + 0x00000000,
2769 +@@ -90,8 +90,8 @@ uint32_t gf100_pmu_data[] = {
2770 + 0x00000000,
2771 + 0x00000000,
2772 + 0x5f433249,
2773 +- 0x00000b8a,
2774 +- 0x00000a2d,
2775 ++ 0x00000b88,
2776 ++ 0x00000a2b,
2777 + 0x00000000,
2778 + 0x00000000,
2779 + 0x00000000,
2780 +@@ -112,8 +112,8 @@ uint32_t gf100_pmu_data[] = {
2781 + 0x00000000,
2782 + 0x00000000,
2783 + 0x54534554,
2784 +- 0x00000bb3,
2785 +- 0x00000b8c,
2786 ++ 0x00000bb1,
2787 ++ 0x00000b8a,
2788 + 0x00000000,
2789 + 0x00000000,
2790 + 0x00000000,
2791 +@@ -134,8 +134,8 @@ uint32_t gf100_pmu_data[] = {
2792 + 0x00000000,
2793 + 0x00000000,
2794 + 0x454c4449,
2795 +- 0x00000bbf,
2796 + 0x00000bbd,
2797 ++ 0x00000bbb,
2798 + 0x00000000,
2799 + 0x00000000,
2800 + 0x00000000,
2801 +@@ -236,19 +236,19 @@ uint32_t gf100_pmu_data[] = {
2802 + 0x000005d3,
2803 + 0x00000003,
2804 + 0x00000002,
2805 +- 0x0000069d,
2806 ++ 0x0000069b,
2807 + 0x00040004,
2808 + 0x00000000,
2809 +- 0x000006b9,
2810 ++ 0x000006b7,
2811 + 0x00010005,
2812 + 0x00000000,
2813 +- 0x000006d6,
2814 ++ 0x000006d4,
2815 + 0x00010006,
2816 + 0x00000000,
2817 + 0x0000065b,
2818 + 0x00000007,
2819 + 0x00000000,
2820 +- 0x000006e1,
2821 ++ 0x000006df,
2822 + /* 0x03c4: memx_func_tail */
2823 + /* 0x03c4: memx_ts_start */
2824 + 0x00000000,
2825 +@@ -1372,432 +1372,432 @@ uint32_t gf100_pmu_code[] = {
2826 + /* 0x065b: memx_func_wait_vblank */
2827 + 0x9800f840,
2828 + 0x66b00016,
2829 +- 0x130bf400,
2830 ++ 0x120bf400,
2831 + 0xf40166b0,
2832 + 0x0ef4060b,
2833 + /* 0x066d: memx_func_wait_vblank_head1 */
2834 +- 0x2077f12e,
2835 +- 0x070ef400,
2836 +-/* 0x0674: memx_func_wait_vblank_head0 */
2837 +- 0x000877f1,
2838 +-/* 0x0678: memx_func_wait_vblank_0 */
2839 +- 0x07c467f1,
2840 +- 0xcf0664b6,
2841 +- 0x67fd0066,
2842 +- 0xf31bf404,
2843 +-/* 0x0688: memx_func_wait_vblank_1 */
2844 +- 0x07c467f1,
2845 +- 0xcf0664b6,
2846 +- 0x67fd0066,
2847 +- 0xf30bf404,
2848 +-/* 0x0698: memx_func_wait_vblank_fini */
2849 +- 0xf80410b6,
2850 +-/* 0x069d: memx_func_wr32 */
2851 +- 0x00169800,
2852 +- 0xb6011598,
2853 +- 0x60f90810,
2854 +- 0xd0fc50f9,
2855 +- 0x21f4e0fc,
2856 +- 0x0242b640,
2857 +- 0xf8e91bf4,
2858 +-/* 0x06b9: memx_func_wait */
2859 +- 0x2c87f000,
2860 +- 0xcf0684b6,
2861 +- 0x1e980088,
2862 +- 0x011d9800,
2863 +- 0x98021c98,
2864 +- 0x10b6031b,
2865 +- 0xa321f410,
2866 +-/* 0x06d6: memx_func_delay */
2867 +- 0x1e9800f8,
2868 +- 0x0410b600,
2869 +- 0xf87e21f4,
2870 +-/* 0x06e1: memx_func_train */
2871 +-/* 0x06e3: memx_exec */
2872 +- 0xf900f800,
2873 +- 0xb9d0f9e0,
2874 +- 0xb2b902c1,
2875 +-/* 0x06ed: memx_exec_next */
2876 +- 0x00139802,
2877 +- 0xe70410b6,
2878 +- 0xe701f034,
2879 +- 0xb601e033,
2880 +- 0x30f00132,
2881 +- 0xde35980c,
2882 +- 0x12b855f9,
2883 +- 0xe41ef406,
2884 +- 0x98f10b98,
2885 +- 0xcbbbf20c,
2886 +- 0xc4b7f102,
2887 +- 0x06b4b607,
2888 +- 0xfc00bbcf,
2889 +- 0xf5e0fcd0,
2890 +- 0xf8033621,
2891 +-/* 0x0729: memx_info */
2892 +- 0x01c67000,
2893 +-/* 0x072f: memx_info_data */
2894 +- 0xf10e0bf4,
2895 +- 0xf103ccc7,
2896 +- 0xf40800b7,
2897 +-/* 0x073a: memx_info_train */
2898 +- 0xc7f10b0e,
2899 +- 0xb7f10bcc,
2900 +-/* 0x0742: memx_info_send */
2901 +- 0x21f50100,
2902 +- 0x00f80336,
2903 +-/* 0x0748: memx_recv */
2904 +- 0xf401d6b0,
2905 +- 0xd6b0980b,
2906 +- 0xd80bf400,
2907 +-/* 0x0756: memx_init */
2908 +- 0x00f800f8,
2909 +-/* 0x0758: perf_recv */
2910 +-/* 0x075a: perf_init */
2911 ++ 0x2077f02c,
2912 ++/* 0x0673: memx_func_wait_vblank_head0 */
2913 ++ 0xf0060ef4,
2914 ++/* 0x0676: memx_func_wait_vblank_0 */
2915 ++ 0x67f10877,
2916 ++ 0x64b607c4,
2917 ++ 0x0066cf06,
2918 ++ 0xf40467fd,
2919 ++/* 0x0686: memx_func_wait_vblank_1 */
2920 ++ 0x67f1f31b,
2921 ++ 0x64b607c4,
2922 ++ 0x0066cf06,
2923 ++ 0xf40467fd,
2924 ++/* 0x0696: memx_func_wait_vblank_fini */
2925 ++ 0x10b6f30b,
2926 ++/* 0x069b: memx_func_wr32 */
2927 ++ 0x9800f804,
2928 ++ 0x15980016,
2929 ++ 0x0810b601,
2930 ++ 0x50f960f9,
2931 ++ 0xe0fcd0fc,
2932 ++ 0xb64021f4,
2933 ++ 0x1bf40242,
2934 ++/* 0x06b7: memx_func_wait */
2935 ++ 0xf000f8e9,
2936 ++ 0x84b62c87,
2937 ++ 0x0088cf06,
2938 ++ 0x98001e98,
2939 ++ 0x1c98011d,
2940 ++ 0x031b9802,
2941 ++ 0xf41010b6,
2942 ++ 0x00f8a321,
2943 ++/* 0x06d4: memx_func_delay */
2944 ++ 0xb6001e98,
2945 ++ 0x21f40410,
2946 ++/* 0x06df: memx_func_train */
2947 ++ 0xf800f87e,
2948 ++/* 0x06e1: memx_exec */
2949 ++ 0xf9e0f900,
2950 ++ 0x02c1b9d0,
2951 ++/* 0x06eb: memx_exec_next */
2952 ++ 0x9802b2b9,
2953 ++ 0x10b60013,
2954 ++ 0xf034e704,
2955 ++ 0xe033e701,
2956 ++ 0x0132b601,
2957 ++ 0x980c30f0,
2958 ++ 0x55f9de35,
2959 ++ 0xf40612b8,
2960 ++ 0x0b98e41e,
2961 ++ 0xf20c98f1,
2962 ++ 0xf102cbbb,
2963 ++ 0xb607c4b7,
2964 ++ 0xbbcf06b4,
2965 ++ 0xfcd0fc00,
2966 ++ 0x3621f5e0,
2967 ++/* 0x0727: memx_info */
2968 ++ 0x7000f803,
2969 ++ 0x0bf401c6,
2970 ++/* 0x072d: memx_info_data */
2971 ++ 0xccc7f10e,
2972 ++ 0x00b7f103,
2973 ++ 0x0b0ef408,
2974 ++/* 0x0738: memx_info_train */
2975 ++ 0x0bccc7f1,
2976 ++ 0x0100b7f1,
2977 ++/* 0x0740: memx_info_send */
2978 ++ 0x033621f5,
2979 ++/* 0x0746: memx_recv */
2980 ++ 0xd6b000f8,
2981 ++ 0x980bf401,
2982 ++ 0xf400d6b0,
2983 ++ 0x00f8d80b,
2984 ++/* 0x0754: memx_init */
2985 ++/* 0x0756: perf_recv */
2986 + 0x00f800f8,
2987 +-/* 0x075c: i2c_drive_scl */
2988 +- 0xf40036b0,
2989 +- 0x07f1110b,
2990 +- 0x04b607e0,
2991 +- 0x0001d006,
2992 +- 0x00f804bd,
2993 +-/* 0x0770: i2c_drive_scl_lo */
2994 +- 0x07e407f1,
2995 +- 0xd00604b6,
2996 +- 0x04bd0001,
2997 +-/* 0x077e: i2c_drive_sda */
2998 ++/* 0x0758: perf_init */
2999 ++/* 0x075a: i2c_drive_scl */
3000 + 0x36b000f8,
3001 + 0x110bf400,
3002 + 0x07e007f1,
3003 + 0xd00604b6,
3004 +- 0x04bd0002,
3005 +-/* 0x0792: i2c_drive_sda_lo */
3006 ++ 0x04bd0001,
3007 ++/* 0x076e: i2c_drive_scl_lo */
3008 + 0x07f100f8,
3009 + 0x04b607e4,
3010 ++ 0x0001d006,
3011 ++ 0x00f804bd,
3012 ++/* 0x077c: i2c_drive_sda */
3013 ++ 0xf40036b0,
3014 ++ 0x07f1110b,
3015 ++ 0x04b607e0,
3016 + 0x0002d006,
3017 + 0x00f804bd,
3018 +-/* 0x07a0: i2c_sense_scl */
3019 +- 0xf10132f4,
3020 +- 0xb607c437,
3021 +- 0x33cf0634,
3022 +- 0x0431fd00,
3023 +- 0xf4060bf4,
3024 +-/* 0x07b6: i2c_sense_scl_done */
3025 +- 0x00f80131,
3026 +-/* 0x07b8: i2c_sense_sda */
3027 +- 0xf10132f4,
3028 +- 0xb607c437,
3029 +- 0x33cf0634,
3030 +- 0x0432fd00,
3031 +- 0xf4060bf4,
3032 +-/* 0x07ce: i2c_sense_sda_done */
3033 +- 0x00f80131,
3034 +-/* 0x07d0: i2c_raise_scl */
3035 +- 0x47f140f9,
3036 +- 0x37f00898,
3037 +- 0x5c21f501,
3038 +-/* 0x07dd: i2c_raise_scl_wait */
3039 +- 0xe8e7f107,
3040 +- 0x7e21f403,
3041 +- 0x07a021f5,
3042 +- 0xb60901f4,
3043 +- 0x1bf40142,
3044 +-/* 0x07f1: i2c_raise_scl_done */
3045 +- 0xf840fcef,
3046 +-/* 0x07f5: i2c_start */
3047 +- 0xa021f500,
3048 +- 0x0d11f407,
3049 +- 0x07b821f5,
3050 +- 0xf40611f4,
3051 +-/* 0x0806: i2c_start_rep */
3052 +- 0x37f0300e,
3053 +- 0x5c21f500,
3054 +- 0x0137f007,
3055 +- 0x077e21f5,
3056 +- 0xb60076bb,
3057 +- 0x50f90465,
3058 +- 0xbb046594,
3059 +- 0x50bd0256,
3060 +- 0xfc0475fd,
3061 +- 0xd021f550,
3062 +- 0x0464b607,
3063 +-/* 0x0833: i2c_start_send */
3064 +- 0xf01f11f4,
3065 ++/* 0x0790: i2c_drive_sda_lo */
3066 ++ 0x07e407f1,
3067 ++ 0xd00604b6,
3068 ++ 0x04bd0002,
3069 ++/* 0x079e: i2c_sense_scl */
3070 ++ 0x32f400f8,
3071 ++ 0xc437f101,
3072 ++ 0x0634b607,
3073 ++ 0xfd0033cf,
3074 ++ 0x0bf40431,
3075 ++ 0x0131f406,
3076 ++/* 0x07b4: i2c_sense_scl_done */
3077 ++/* 0x07b6: i2c_sense_sda */
3078 ++ 0x32f400f8,
3079 ++ 0xc437f101,
3080 ++ 0x0634b607,
3081 ++ 0xfd0033cf,
3082 ++ 0x0bf40432,
3083 ++ 0x0131f406,
3084 ++/* 0x07cc: i2c_sense_sda_done */
3085 ++/* 0x07ce: i2c_raise_scl */
3086 ++ 0x40f900f8,
3087 ++ 0x089847f1,
3088 ++ 0xf50137f0,
3089 ++/* 0x07db: i2c_raise_scl_wait */
3090 ++ 0xf1075a21,
3091 ++ 0xf403e8e7,
3092 ++ 0x21f57e21,
3093 ++ 0x01f4079e,
3094 ++ 0x0142b609,
3095 ++/* 0x07ef: i2c_raise_scl_done */
3096 ++ 0xfcef1bf4,
3097 ++/* 0x07f3: i2c_start */
3098 ++ 0xf500f840,
3099 ++ 0xf4079e21,
3100 ++ 0x21f50d11,
3101 ++ 0x11f407b6,
3102 ++ 0x300ef406,
3103 ++/* 0x0804: i2c_start_rep */
3104 ++ 0xf50037f0,
3105 ++ 0xf0075a21,
3106 ++ 0x21f50137,
3107 ++ 0x76bb077c,
3108 ++ 0x0465b600,
3109 ++ 0x659450f9,
3110 ++ 0x0256bb04,
3111 ++ 0x75fd50bd,
3112 ++ 0xf550fc04,
3113 ++ 0xb607ce21,
3114 ++ 0x11f40464,
3115 ++/* 0x0831: i2c_start_send */
3116 ++ 0x0037f01f,
3117 ++ 0x077c21f5,
3118 ++ 0x1388e7f1,
3119 ++ 0xf07e21f4,
3120 + 0x21f50037,
3121 +- 0xe7f1077e,
3122 ++ 0xe7f1075a,
3123 + 0x21f41388,
3124 +- 0x0037f07e,
3125 +- 0x075c21f5,
3126 +- 0x1388e7f1,
3127 +-/* 0x084f: i2c_start_out */
3128 +- 0xf87e21f4,
3129 +-/* 0x0851: i2c_stop */
3130 +- 0x0037f000,
3131 +- 0x075c21f5,
3132 +- 0xf50037f0,
3133 +- 0xf1077e21,
3134 +- 0xf403e8e7,
3135 +- 0x37f07e21,
3136 +- 0x5c21f501,
3137 +- 0x88e7f107,
3138 +- 0x7e21f413,
3139 ++/* 0x084d: i2c_start_out */
3140 ++/* 0x084f: i2c_stop */
3141 ++ 0xf000f87e,
3142 ++ 0x21f50037,
3143 ++ 0x37f0075a,
3144 ++ 0x7c21f500,
3145 ++ 0xe8e7f107,
3146 ++ 0x7e21f403,
3147 + 0xf50137f0,
3148 +- 0xf1077e21,
3149 ++ 0xf1075a21,
3150 + 0xf41388e7,
3151 +- 0x00f87e21,
3152 +-/* 0x0884: i2c_bitw */
3153 +- 0x077e21f5,
3154 +- 0x03e8e7f1,
3155 +- 0xbb7e21f4,
3156 +- 0x65b60076,
3157 +- 0x9450f904,
3158 +- 0x56bb0465,
3159 +- 0xfd50bd02,
3160 +- 0x50fc0475,
3161 +- 0x07d021f5,
3162 +- 0xf40464b6,
3163 +- 0xe7f11811,
3164 +- 0x21f41388,
3165 +- 0x0037f07e,
3166 +- 0x075c21f5,
3167 +- 0x1388e7f1,
3168 +-/* 0x08c3: i2c_bitw_out */
3169 +- 0xf87e21f4,
3170 +-/* 0x08c5: i2c_bitr */
3171 +- 0x0137f000,
3172 +- 0x077e21f5,
3173 +- 0x03e8e7f1,
3174 +- 0xbb7e21f4,
3175 +- 0x65b60076,
3176 +- 0x9450f904,
3177 +- 0x56bb0465,
3178 +- 0xfd50bd02,
3179 +- 0x50fc0475,
3180 +- 0x07d021f5,
3181 +- 0xf40464b6,
3182 +- 0x21f51b11,
3183 +- 0x37f007b8,
3184 +- 0x5c21f500,
3185 ++ 0x37f07e21,
3186 ++ 0x7c21f501,
3187 + 0x88e7f107,
3188 + 0x7e21f413,
3189 +- 0xf4013cf0,
3190 +-/* 0x090a: i2c_bitr_done */
3191 +- 0x00f80131,
3192 +-/* 0x090c: i2c_get_byte */
3193 +- 0xf00057f0,
3194 +-/* 0x0912: i2c_get_byte_next */
3195 +- 0x54b60847,
3196 +- 0x0076bb01,
3197 ++/* 0x0882: i2c_bitw */
3198 ++ 0x21f500f8,
3199 ++ 0xe7f1077c,
3200 ++ 0x21f403e8,
3201 ++ 0x0076bb7e,
3202 + 0xf90465b6,
3203 + 0x04659450,
3204 + 0xbd0256bb,
3205 + 0x0475fd50,
3206 + 0x21f550fc,
3207 +- 0x64b608c5,
3208 +- 0x2b11f404,
3209 +- 0xb60553fd,
3210 +- 0x1bf40142,
3211 +- 0x0137f0d8,
3212 +- 0xb60076bb,
3213 +- 0x50f90465,
3214 +- 0xbb046594,
3215 +- 0x50bd0256,
3216 +- 0xfc0475fd,
3217 +- 0x8421f550,
3218 +- 0x0464b608,
3219 +-/* 0x095c: i2c_get_byte_done */
3220 +-/* 0x095e: i2c_put_byte */
3221 +- 0x47f000f8,
3222 +-/* 0x0961: i2c_put_byte_next */
3223 +- 0x0142b608,
3224 +- 0xbb3854ff,
3225 ++ 0x64b607ce,
3226 ++ 0x1811f404,
3227 ++ 0x1388e7f1,
3228 ++ 0xf07e21f4,
3229 ++ 0x21f50037,
3230 ++ 0xe7f1075a,
3231 ++ 0x21f41388,
3232 ++/* 0x08c1: i2c_bitw_out */
3233 ++/* 0x08c3: i2c_bitr */
3234 ++ 0xf000f87e,
3235 ++ 0x21f50137,
3236 ++ 0xe7f1077c,
3237 ++ 0x21f403e8,
3238 ++ 0x0076bb7e,
3239 ++ 0xf90465b6,
3240 ++ 0x04659450,
3241 ++ 0xbd0256bb,
3242 ++ 0x0475fd50,
3243 ++ 0x21f550fc,
3244 ++ 0x64b607ce,
3245 ++ 0x1b11f404,
3246 ++ 0x07b621f5,
3247 ++ 0xf50037f0,
3248 ++ 0xf1075a21,
3249 ++ 0xf41388e7,
3250 ++ 0x3cf07e21,
3251 ++ 0x0131f401,
3252 ++/* 0x0908: i2c_bitr_done */
3253 ++/* 0x090a: i2c_get_byte */
3254 ++ 0x57f000f8,
3255 ++ 0x0847f000,
3256 ++/* 0x0910: i2c_get_byte_next */
3257 ++ 0xbb0154b6,
3258 + 0x65b60076,
3259 + 0x9450f904,
3260 + 0x56bb0465,
3261 + 0xfd50bd02,
3262 + 0x50fc0475,
3263 +- 0x088421f5,
3264 ++ 0x08c321f5,
3265 + 0xf40464b6,
3266 +- 0x46b03411,
3267 +- 0xd81bf400,
3268 +- 0xb60076bb,
3269 +- 0x50f90465,
3270 +- 0xbb046594,
3271 +- 0x50bd0256,
3272 +- 0xfc0475fd,
3273 +- 0xc521f550,
3274 +- 0x0464b608,
3275 +- 0xbb0f11f4,
3276 +- 0x36b00076,
3277 +- 0x061bf401,
3278 +-/* 0x09b7: i2c_put_byte_done */
3279 +- 0xf80132f4,
3280 +-/* 0x09b9: i2c_addr */
3281 +- 0x0076bb00,
3282 ++ 0x53fd2b11,
3283 ++ 0x0142b605,
3284 ++ 0xf0d81bf4,
3285 ++ 0x76bb0137,
3286 ++ 0x0465b600,
3287 ++ 0x659450f9,
3288 ++ 0x0256bb04,
3289 ++ 0x75fd50bd,
3290 ++ 0xf550fc04,
3291 ++ 0xb6088221,
3292 ++/* 0x095a: i2c_get_byte_done */
3293 ++ 0x00f80464,
3294 ++/* 0x095c: i2c_put_byte */
3295 ++/* 0x095f: i2c_put_byte_next */
3296 ++ 0xb60847f0,
3297 ++ 0x54ff0142,
3298 ++ 0x0076bb38,
3299 + 0xf90465b6,
3300 + 0x04659450,
3301 + 0xbd0256bb,
3302 + 0x0475fd50,
3303 + 0x21f550fc,
3304 +- 0x64b607f5,
3305 +- 0x2911f404,
3306 +- 0x012ec3e7,
3307 +- 0xfd0134b6,
3308 +- 0x76bb0553,
3309 ++ 0x64b60882,
3310 ++ 0x3411f404,
3311 ++ 0xf40046b0,
3312 ++ 0x76bbd81b,
3313 + 0x0465b600,
3314 + 0x659450f9,
3315 + 0x0256bb04,
3316 + 0x75fd50bd,
3317 + 0xf550fc04,
3318 +- 0xb6095e21,
3319 +-/* 0x09fe: i2c_addr_done */
3320 +- 0x00f80464,
3321 +-/* 0x0a00: i2c_acquire_addr */
3322 +- 0xb6f8cec7,
3323 +- 0xe0b702e4,
3324 +- 0xee980d1c,
3325 +-/* 0x0a0f: i2c_acquire */
3326 +- 0xf500f800,
3327 +- 0xf40a0021,
3328 +- 0xd9f00421,
3329 +- 0x4021f403,
3330 +-/* 0x0a1e: i2c_release */
3331 +- 0x21f500f8,
3332 +- 0x21f40a00,
3333 +- 0x03daf004,
3334 +- 0xf84021f4,
3335 +-/* 0x0a2d: i2c_recv */
3336 +- 0x0132f400,
3337 +- 0xb6f8c1c7,
3338 +- 0x16b00214,
3339 +- 0x3a1ff528,
3340 +- 0xf413a001,
3341 +- 0x0032980c,
3342 +- 0x0ccc13a0,
3343 +- 0xf4003198,
3344 +- 0xd0f90231,
3345 +- 0xd0f9e0f9,
3346 +- 0x000067f1,
3347 +- 0x100063f1,
3348 +- 0xbb016792,
3349 ++ 0xb608c321,
3350 ++ 0x11f40464,
3351 ++ 0x0076bb0f,
3352 ++ 0xf40136b0,
3353 ++ 0x32f4061b,
3354 ++/* 0x09b5: i2c_put_byte_done */
3355 ++/* 0x09b7: i2c_addr */
3356 ++ 0xbb00f801,
3357 + 0x65b60076,
3358 + 0x9450f904,
3359 + 0x56bb0465,
3360 + 0xfd50bd02,
3361 + 0x50fc0475,
3362 +- 0x0a0f21f5,
3363 +- 0xfc0464b6,
3364 +- 0x00d6b0d0,
3365 +- 0x00b31bf5,
3366 +- 0xbb0057f0,
3367 +- 0x65b60076,
3368 +- 0x9450f904,
3369 +- 0x56bb0465,
3370 +- 0xfd50bd02,
3371 +- 0x50fc0475,
3372 +- 0x09b921f5,
3373 +- 0xf50464b6,
3374 +- 0xc700d011,
3375 +- 0x76bbe0c5,
3376 +- 0x0465b600,
3377 +- 0x659450f9,
3378 +- 0x0256bb04,
3379 +- 0x75fd50bd,
3380 +- 0xf550fc04,
3381 +- 0xb6095e21,
3382 +- 0x11f50464,
3383 +- 0x57f000ad,
3384 ++ 0x07f321f5,
3385 ++ 0xf40464b6,
3386 ++ 0xc3e72911,
3387 ++ 0x34b6012e,
3388 ++ 0x0553fd01,
3389 ++ 0xb60076bb,
3390 ++ 0x50f90465,
3391 ++ 0xbb046594,
3392 ++ 0x50bd0256,
3393 ++ 0xfc0475fd,
3394 ++ 0x5c21f550,
3395 ++ 0x0464b609,
3396 ++/* 0x09fc: i2c_addr_done */
3397 ++/* 0x09fe: i2c_acquire_addr */
3398 ++ 0xcec700f8,
3399 ++ 0x02e4b6f8,
3400 ++ 0x0d1ce0b7,
3401 ++ 0xf800ee98,
3402 ++/* 0x0a0d: i2c_acquire */
3403 ++ 0xfe21f500,
3404 ++ 0x0421f409,
3405 ++ 0xf403d9f0,
3406 ++ 0x00f84021,
3407 ++/* 0x0a1c: i2c_release */
3408 ++ 0x09fe21f5,
3409 ++ 0xf00421f4,
3410 ++ 0x21f403da,
3411 ++/* 0x0a2b: i2c_recv */
3412 ++ 0xf400f840,
3413 ++ 0xc1c70132,
3414 ++ 0x0214b6f8,
3415 ++ 0xf52816b0,
3416 ++ 0xa0013a1f,
3417 ++ 0x980cf413,
3418 ++ 0x13a00032,
3419 ++ 0x31980ccc,
3420 ++ 0x0231f400,
3421 ++ 0xe0f9d0f9,
3422 ++ 0x67f1d0f9,
3423 ++ 0x63f10000,
3424 ++ 0x67921000,
3425 + 0x0076bb01,
3426 + 0xf90465b6,
3427 + 0x04659450,
3428 + 0xbd0256bb,
3429 + 0x0475fd50,
3430 + 0x21f550fc,
3431 +- 0x64b609b9,
3432 +- 0x8a11f504,
3433 ++ 0x64b60a0d,
3434 ++ 0xb0d0fc04,
3435 ++ 0x1bf500d6,
3436 ++ 0x57f000b3,
3437 + 0x0076bb00,
3438 + 0xf90465b6,
3439 + 0x04659450,
3440 + 0xbd0256bb,
3441 + 0x0475fd50,
3442 + 0x21f550fc,
3443 +- 0x64b6090c,
3444 +- 0x6a11f404,
3445 +- 0xbbe05bcb,
3446 ++ 0x64b609b7,
3447 ++ 0xd011f504,
3448 ++ 0xe0c5c700,
3449 ++ 0xb60076bb,
3450 ++ 0x50f90465,
3451 ++ 0xbb046594,
3452 ++ 0x50bd0256,
3453 ++ 0xfc0475fd,
3454 ++ 0x5c21f550,
3455 ++ 0x0464b609,
3456 ++ 0x00ad11f5,
3457 ++ 0xbb0157f0,
3458 + 0x65b60076,
3459 + 0x9450f904,
3460 + 0x56bb0465,
3461 + 0xfd50bd02,
3462 + 0x50fc0475,
3463 +- 0x085121f5,
3464 +- 0xb90464b6,
3465 +- 0x74bd025b,
3466 +-/* 0x0b33: i2c_recv_not_rd08 */
3467 +- 0xb0430ef4,
3468 +- 0x1bf401d6,
3469 +- 0x0057f03d,
3470 +- 0x09b921f5,
3471 +- 0xc73311f4,
3472 +- 0x21f5e0c5,
3473 +- 0x11f4095e,
3474 +- 0x0057f029,
3475 +- 0x09b921f5,
3476 +- 0xc71f11f4,
3477 +- 0x21f5e0b5,
3478 +- 0x11f4095e,
3479 +- 0x5121f515,
3480 +- 0xc774bd08,
3481 +- 0x1bf408c5,
3482 +- 0x0232f409,
3483 +-/* 0x0b73: i2c_recv_not_wr08 */
3484 +-/* 0x0b73: i2c_recv_done */
3485 +- 0xc7030ef4,
3486 +- 0x21f5f8ce,
3487 +- 0xe0fc0a1e,
3488 +- 0x12f4d0fc,
3489 +- 0x027cb90a,
3490 +- 0x033621f5,
3491 +-/* 0x0b88: i2c_recv_exit */
3492 +-/* 0x0b8a: i2c_init */
3493 +- 0x00f800f8,
3494 +-/* 0x0b8c: test_recv */
3495 +- 0x05d817f1,
3496 ++ 0x09b721f5,
3497 ++ 0xf50464b6,
3498 ++ 0xbb008a11,
3499 ++ 0x65b60076,
3500 ++ 0x9450f904,
3501 ++ 0x56bb0465,
3502 ++ 0xfd50bd02,
3503 ++ 0x50fc0475,
3504 ++ 0x090a21f5,
3505 ++ 0xf40464b6,
3506 ++ 0x5bcb6a11,
3507 ++ 0x0076bbe0,
3508 ++ 0xf90465b6,
3509 ++ 0x04659450,
3510 ++ 0xbd0256bb,
3511 ++ 0x0475fd50,
3512 ++ 0x21f550fc,
3513 ++ 0x64b6084f,
3514 ++ 0x025bb904,
3515 ++ 0x0ef474bd,
3516 ++/* 0x0b31: i2c_recv_not_rd08 */
3517 ++ 0x01d6b043,
3518 ++ 0xf03d1bf4,
3519 ++ 0x21f50057,
3520 ++ 0x11f409b7,
3521 ++ 0xe0c5c733,
3522 ++ 0x095c21f5,
3523 ++ 0xf02911f4,
3524 ++ 0x21f50057,
3525 ++ 0x11f409b7,
3526 ++ 0xe0b5c71f,
3527 ++ 0x095c21f5,
3528 ++ 0xf51511f4,
3529 ++ 0xbd084f21,
3530 ++ 0x08c5c774,
3531 ++ 0xf4091bf4,
3532 ++ 0x0ef40232,
3533 ++/* 0x0b71: i2c_recv_not_wr08 */
3534 ++/* 0x0b71: i2c_recv_done */
3535 ++ 0xf8cec703,
3536 ++ 0x0a1c21f5,
3537 ++ 0xd0fce0fc,
3538 ++ 0xb90a12f4,
3539 ++ 0x21f5027c,
3540 ++/* 0x0b86: i2c_recv_exit */
3541 ++ 0x00f80336,
3542 ++/* 0x0b88: i2c_init */
3543 ++/* 0x0b8a: test_recv */
3544 ++ 0x17f100f8,
3545 ++ 0x14b605d8,
3546 ++ 0x0011cf06,
3547 ++ 0xf10110b6,
3548 ++ 0xb605d807,
3549 ++ 0x01d00604,
3550 ++ 0xf104bd00,
3551 ++ 0xf1d900e7,
3552 ++ 0xf5134fe3,
3553 ++ 0xf8025621,
3554 ++/* 0x0bb1: test_init */
3555 ++ 0x00e7f100,
3556 ++ 0x5621f508,
3557 ++/* 0x0bbb: idle_recv */
3558 ++ 0xf800f802,
3559 ++/* 0x0bbd: idle */
3560 ++ 0x0031f400,
3561 ++ 0x05d417f1,
3562 + 0xcf0614b6,
3563 + 0x10b60011,
3564 +- 0xd807f101,
3565 ++ 0xd407f101,
3566 + 0x0604b605,
3567 + 0xbd0001d0,
3568 +- 0x00e7f104,
3569 +- 0x4fe3f1d9,
3570 +- 0x5621f513,
3571 +-/* 0x0bb3: test_init */
3572 +- 0xf100f802,
3573 +- 0xf50800e7,
3574 +- 0xf8025621,
3575 +-/* 0x0bbd: idle_recv */
3576 +-/* 0x0bbf: idle */
3577 +- 0xf400f800,
3578 +- 0x17f10031,
3579 +- 0x14b605d4,
3580 +- 0x0011cf06,
3581 +- 0xf10110b6,
3582 +- 0xb605d407,
3583 +- 0x01d00604,
3584 +-/* 0x0bdb: idle_loop */
3585 +- 0xf004bd00,
3586 +- 0x32f45817,
3587 +-/* 0x0be1: idle_proc */
3588 +-/* 0x0be1: idle_proc_exec */
3589 +- 0xb910f902,
3590 +- 0x21f5021e,
3591 +- 0x10fc033f,
3592 +- 0xf40911f4,
3593 +- 0x0ef40231,
3594 +-/* 0x0bf5: idle_proc_next */
3595 +- 0x5810b6ef,
3596 +- 0xf4061fb8,
3597 +- 0x02f4e61b,
3598 +- 0x0028f4dd,
3599 +- 0x00bb0ef4,
3600 ++/* 0x0bd9: idle_loop */
3601 ++ 0x5817f004,
3602 ++/* 0x0bdf: idle_proc */
3603 ++/* 0x0bdf: idle_proc_exec */
3604 ++ 0xf90232f4,
3605 ++ 0x021eb910,
3606 ++ 0x033f21f5,
3607 ++ 0x11f410fc,
3608 ++ 0x0231f409,
3609 ++/* 0x0bf3: idle_proc_next */
3610 ++ 0xb6ef0ef4,
3611 ++ 0x1fb85810,
3612 ++ 0xe61bf406,
3613 ++ 0xf4dd02f4,
3614 ++ 0x0ef40028,
3615 ++ 0x000000bb,
3616 + 0x00000000,
3617 + 0x00000000,
3618 + 0x00000000,
3619 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
3620 +index 3c731ff12871..958222415a34 100644
3621 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
3622 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
3623 +@@ -46,8 +46,8 @@ uint32_t gk208_pmu_data[] = {
3624 + 0x00000000,
3625 + 0x00000000,
3626 + 0x584d454d,
3627 +- 0x000005f3,
3628 +- 0x000005e5,
3629 ++ 0x000005ee,
3630 ++ 0x000005e0,
3631 + 0x00000000,
3632 + 0x00000000,
3633 + 0x00000000,
3634 +@@ -68,8 +68,8 @@ uint32_t gk208_pmu_data[] = {
3635 + 0x00000000,
3636 + 0x00000000,
3637 + 0x46524550,
3638 +- 0x000005f7,
3639 +- 0x000005f5,
3640 ++ 0x000005f2,
3641 ++ 0x000005f0,
3642 + 0x00000000,
3643 + 0x00000000,
3644 + 0x00000000,
3645 +@@ -90,8 +90,8 @@ uint32_t gk208_pmu_data[] = {
3646 + 0x00000000,
3647 + 0x00000000,
3648 + 0x5f433249,
3649 +- 0x000009f8,
3650 +- 0x000008a2,
3651 ++ 0x000009f3,
3652 ++ 0x0000089d,
3653 + 0x00000000,
3654 + 0x00000000,
3655 + 0x00000000,
3656 +@@ -112,8 +112,8 @@ uint32_t gk208_pmu_data[] = {
3657 + 0x00000000,
3658 + 0x00000000,
3659 + 0x54534554,
3660 +- 0x00000a16,
3661 +- 0x000009fa,
3662 ++ 0x00000a11,
3663 ++ 0x000009f5,
3664 + 0x00000000,
3665 + 0x00000000,
3666 + 0x00000000,
3667 +@@ -134,8 +134,8 @@ uint32_t gk208_pmu_data[] = {
3668 + 0x00000000,
3669 + 0x00000000,
3670 + 0x454c4449,
3671 +- 0x00000a21,
3672 +- 0x00000a1f,
3673 ++ 0x00000a1c,
3674 ++ 0x00000a1a,
3675 + 0x00000000,
3676 + 0x00000000,
3677 + 0x00000000,
3678 +@@ -233,22 +233,22 @@ uint32_t gk208_pmu_data[] = {
3679 + /* 0x037c: memx_func_next */
3680 + 0x00000002,
3681 + 0x00000000,
3682 +- 0x000004cf,
3683 ++ 0x000004cc,
3684 + 0x00000003,
3685 + 0x00000002,
3686 +- 0x00000546,
3687 ++ 0x00000541,
3688 + 0x00040004,
3689 + 0x00000000,
3690 +- 0x00000563,
3691 ++ 0x0000055e,
3692 + 0x00010005,
3693 + 0x00000000,
3694 +- 0x0000057d,
3695 ++ 0x00000578,
3696 + 0x00010006,
3697 + 0x00000000,
3698 +- 0x00000541,
3699 ++ 0x0000053c,
3700 + 0x00000007,
3701 + 0x00000000,
3702 +- 0x00000589,
3703 ++ 0x00000584,
3704 + /* 0x03c4: memx_func_tail */
3705 + /* 0x03c4: memx_ts_start */
3706 + 0x00000000,
3707 +@@ -1238,454 +1238,454 @@ uint32_t gk208_pmu_code[] = {
3708 + 0x0001f604,
3709 + 0x00f804bd,
3710 + /* 0x045c: memx_func_enter */
3711 +- 0x162067f1,
3712 +- 0xf55d77f1,
3713 +- 0x047e6eb2,
3714 +- 0xd8b20000,
3715 +- 0xf90487fd,
3716 +- 0xfc80f960,
3717 +- 0x7ee0fcd0,
3718 +- 0x0700002d,
3719 +- 0x7e6eb2fe,
3720 ++ 0x47162046,
3721 ++ 0x6eb2f55d,
3722 ++ 0x0000047e,
3723 ++ 0x87fdd8b2,
3724 ++ 0xf960f904,
3725 ++ 0xfcd0fc80,
3726 ++ 0x002d7ee0,
3727 ++ 0xb2fe0700,
3728 ++ 0x00047e6e,
3729 ++ 0xfdd8b200,
3730 ++ 0x60f90487,
3731 ++ 0xd0fc80f9,
3732 ++ 0x2d7ee0fc,
3733 ++ 0xf0460000,
3734 ++ 0x7e6eb226,
3735 + 0xb2000004,
3736 + 0x0487fdd8,
3737 + 0x80f960f9,
3738 + 0xe0fcd0fc,
3739 + 0x00002d7e,
3740 +- 0x26f067f1,
3741 +- 0x047e6eb2,
3742 +- 0xd8b20000,
3743 +- 0xf90487fd,
3744 +- 0xfc80f960,
3745 +- 0x7ee0fcd0,
3746 +- 0x0600002d,
3747 +- 0x07e04004,
3748 +- 0xbd0006f6,
3749 +-/* 0x04b9: memx_func_enter_wait */
3750 +- 0x07c04604,
3751 +- 0xf00066cf,
3752 +- 0x0bf40464,
3753 +- 0xcf2c06f7,
3754 +- 0x06b50066,
3755 +-/* 0x04cf: memx_func_leave */
3756 +- 0x0600f8f1,
3757 +- 0x0066cf2c,
3758 +- 0x06f206b5,
3759 +- 0x07e44004,
3760 +- 0xbd0006f6,
3761 +-/* 0x04e1: memx_func_leave_wait */
3762 +- 0x07c04604,
3763 +- 0xf00066cf,
3764 +- 0x1bf40464,
3765 +- 0xf067f1f7,
3766 ++ 0xe0400406,
3767 ++ 0x0006f607,
3768 ++/* 0x04b6: memx_func_enter_wait */
3769 ++ 0xc04604bd,
3770 ++ 0x0066cf07,
3771 ++ 0xf40464f0,
3772 ++ 0x2c06f70b,
3773 ++ 0xb50066cf,
3774 ++ 0x00f8f106,
3775 ++/* 0x04cc: memx_func_leave */
3776 ++ 0x66cf2c06,
3777 ++ 0xf206b500,
3778 ++ 0xe4400406,
3779 ++ 0x0006f607,
3780 ++/* 0x04de: memx_func_leave_wait */
3781 ++ 0xc04604bd,
3782 ++ 0x0066cf07,
3783 ++ 0xf40464f0,
3784 ++ 0xf046f71b,
3785 + 0xb2010726,
3786 + 0x00047e6e,
3787 + 0xfdd8b200,
3788 + 0x60f90587,
3789 + 0xd0fc80f9,
3790 + 0x2d7ee0fc,
3791 +- 0x67f10000,
3792 +- 0x6eb21620,
3793 +- 0x0000047e,
3794 +- 0x87fdd8b2,
3795 +- 0xf960f905,
3796 +- 0xfcd0fc80,
3797 +- 0x002d7ee0,
3798 +- 0x0aa24700,
3799 +- 0x047e6eb2,
3800 +- 0xd8b20000,
3801 +- 0xf90587fd,
3802 +- 0xfc80f960,
3803 +- 0x7ee0fcd0,
3804 +- 0xf800002d,
3805 +-/* 0x0541: memx_func_wait_vblank */
3806 ++ 0x20460000,
3807 ++ 0x7e6eb216,
3808 ++ 0xb2000004,
3809 ++ 0x0587fdd8,
3810 ++ 0x80f960f9,
3811 ++ 0xe0fcd0fc,
3812 ++ 0x00002d7e,
3813 ++ 0xb20aa247,
3814 ++ 0x00047e6e,
3815 ++ 0xfdd8b200,
3816 ++ 0x60f90587,
3817 ++ 0xd0fc80f9,
3818 ++ 0x2d7ee0fc,
3819 ++ 0x00f80000,
3820 ++/* 0x053c: memx_func_wait_vblank */
3821 ++ 0xf80410b6,
3822 ++/* 0x0541: memx_func_wr32 */
3823 ++ 0x00169800,
3824 ++ 0xb6011598,
3825 ++ 0x60f90810,
3826 ++ 0xd0fc50f9,
3827 ++ 0x2d7ee0fc,
3828 ++ 0x42b60000,
3829 ++ 0xe81bf402,
3830 ++/* 0x055e: memx_func_wait */
3831 ++ 0x2c0800f8,
3832 ++ 0x980088cf,
3833 ++ 0x1d98001e,
3834 ++ 0x021c9801,
3835 ++ 0xb6031b98,
3836 ++ 0x747e1010,
3837 ++ 0x00f80000,
3838 ++/* 0x0578: memx_func_delay */
3839 ++ 0xb6001e98,
3840 ++ 0x587e0410,
3841 ++ 0x00f80000,
3842 ++/* 0x0584: memx_func_train */
3843 ++/* 0x0586: memx_exec */
3844 ++ 0xe0f900f8,
3845 ++ 0xc1b2d0f9,
3846 ++/* 0x058e: memx_exec_next */
3847 ++ 0x1398b2b2,
3848 + 0x0410b600,
3849 +-/* 0x0546: memx_func_wr32 */
3850 +- 0x169800f8,
3851 +- 0x01159800,
3852 +- 0xf90810b6,
3853 +- 0xfc50f960,
3854 ++ 0x01f034e7,
3855 ++ 0x01e033e7,
3856 ++ 0xf00132b6,
3857 ++ 0x35980c30,
3858 ++ 0xa655f9de,
3859 ++ 0xe51ef412,
3860 ++ 0x98f10b98,
3861 ++ 0xcbbbf20c,
3862 ++ 0x07c44b02,
3863 ++ 0xfc00bbcf,
3864 + 0x7ee0fcd0,
3865 +- 0xb600002d,
3866 +- 0x1bf40242,
3867 +-/* 0x0563: memx_func_wait */
3868 +- 0x0800f8e8,
3869 +- 0x0088cf2c,
3870 +- 0x98001e98,
3871 +- 0x1c98011d,
3872 +- 0x031b9802,
3873 +- 0x7e1010b6,
3874 +- 0xf8000074,
3875 +-/* 0x057d: memx_func_delay */
3876 +- 0x001e9800,
3877 +- 0x7e0410b6,
3878 +- 0xf8000058,
3879 +-/* 0x0589: memx_func_train */
3880 +-/* 0x058b: memx_exec */
3881 +- 0xf900f800,
3882 +- 0xb2d0f9e0,
3883 +-/* 0x0593: memx_exec_next */
3884 +- 0x98b2b2c1,
3885 +- 0x10b60013,
3886 +- 0xf034e704,
3887 +- 0xe033e701,
3888 +- 0x0132b601,
3889 +- 0x980c30f0,
3890 +- 0x55f9de35,
3891 +- 0x1ef412a6,
3892 +- 0xf10b98e5,
3893 +- 0xbbf20c98,
3894 +- 0xc44b02cb,
3895 +- 0x00bbcf07,
3896 +- 0xe0fcd0fc,
3897 +- 0x00029f7e,
3898 +-/* 0x05ca: memx_info */
3899 +- 0xc67000f8,
3900 +- 0x0c0bf401,
3901 +-/* 0x05d0: memx_info_data */
3902 +- 0x4b03cc4c,
3903 +- 0x0ef40800,
3904 +-/* 0x05d9: memx_info_train */
3905 +- 0x0bcc4c09,
3906 +-/* 0x05df: memx_info_send */
3907 +- 0x7e01004b,
3908 + 0xf800029f,
3909 +-/* 0x05e5: memx_recv */
3910 +- 0x01d6b000,
3911 +- 0xb0a30bf4,
3912 +- 0x0bf400d6,
3913 +-/* 0x05f3: memx_init */
3914 +- 0xf800f8dc,
3915 +-/* 0x05f5: perf_recv */
3916 +-/* 0x05f7: perf_init */
3917 +- 0xf800f800,
3918 +-/* 0x05f9: i2c_drive_scl */
3919 +- 0x0036b000,
3920 +- 0x400d0bf4,
3921 +- 0x01f607e0,
3922 +- 0xf804bd00,
3923 +-/* 0x0609: i2c_drive_scl_lo */
3924 +- 0x07e44000,
3925 +- 0xbd0001f6,
3926 +-/* 0x0613: i2c_drive_sda */
3927 +- 0xb000f804,
3928 +- 0x0bf40036,
3929 +- 0x07e0400d,
3930 +- 0xbd0002f6,
3931 +-/* 0x0623: i2c_drive_sda_lo */
3932 +- 0x4000f804,
3933 +- 0x02f607e4,
3934 +- 0xf804bd00,
3935 +-/* 0x062d: i2c_sense_scl */
3936 +- 0x0132f400,
3937 +- 0xcf07c443,
3938 +- 0x31fd0033,
3939 +- 0x060bf404,
3940 +-/* 0x063f: i2c_sense_scl_done */
3941 +- 0xf80131f4,
3942 +-/* 0x0641: i2c_sense_sda */
3943 +- 0x0132f400,
3944 +- 0xcf07c443,
3945 +- 0x32fd0033,
3946 +- 0x060bf404,
3947 +-/* 0x0653: i2c_sense_sda_done */
3948 +- 0xf80131f4,
3949 +-/* 0x0655: i2c_raise_scl */
3950 +- 0x4440f900,
3951 +- 0x01030898,
3952 +- 0x0005f97e,
3953 +-/* 0x0660: i2c_raise_scl_wait */
3954 +- 0x7e03e84e,
3955 +- 0x7e000058,
3956 +- 0xf400062d,
3957 +- 0x42b60901,
3958 +- 0xef1bf401,
3959 +-/* 0x0674: i2c_raise_scl_done */
3960 +- 0x00f840fc,
3961 +-/* 0x0678: i2c_start */
3962 +- 0x00062d7e,
3963 +- 0x7e0d11f4,
3964 +- 0xf4000641,
3965 +- 0x0ef40611,
3966 +-/* 0x0689: i2c_start_rep */
3967 +- 0x7e00032e,
3968 +- 0x030005f9,
3969 +- 0x06137e01,
3970 ++/* 0x05c5: memx_info */
3971 ++ 0x01c67000,
3972 ++/* 0x05cb: memx_info_data */
3973 ++ 0x4c0c0bf4,
3974 ++ 0x004b03cc,
3975 ++ 0x090ef408,
3976 ++/* 0x05d4: memx_info_train */
3977 ++ 0x4b0bcc4c,
3978 ++/* 0x05da: memx_info_send */
3979 ++ 0x9f7e0100,
3980 ++ 0x00f80002,
3981 ++/* 0x05e0: memx_recv */
3982 ++ 0xf401d6b0,
3983 ++ 0xd6b0a30b,
3984 ++ 0xdc0bf400,
3985 ++/* 0x05ee: memx_init */
3986 ++ 0x00f800f8,
3987 ++/* 0x05f0: perf_recv */
3988 ++/* 0x05f2: perf_init */
3989 ++ 0x00f800f8,
3990 ++/* 0x05f4: i2c_drive_scl */
3991 ++ 0xf40036b0,
3992 ++ 0xe0400d0b,
3993 ++ 0x0001f607,
3994 ++ 0x00f804bd,
3995 ++/* 0x0604: i2c_drive_scl_lo */
3996 ++ 0xf607e440,
3997 ++ 0x04bd0001,
3998 ++/* 0x060e: i2c_drive_sda */
3999 ++ 0x36b000f8,
4000 ++ 0x0d0bf400,
4001 ++ 0xf607e040,
4002 ++ 0x04bd0002,
4003 ++/* 0x061e: i2c_drive_sda_lo */
4004 ++ 0xe44000f8,
4005 ++ 0x0002f607,
4006 ++ 0x00f804bd,
4007 ++/* 0x0628: i2c_sense_scl */
4008 ++ 0x430132f4,
4009 ++ 0x33cf07c4,
4010 ++ 0x0431fd00,
4011 ++ 0xf4060bf4,
4012 ++/* 0x063a: i2c_sense_scl_done */
4013 ++ 0x00f80131,
4014 ++/* 0x063c: i2c_sense_sda */
4015 ++ 0x430132f4,
4016 ++ 0x33cf07c4,
4017 ++ 0x0432fd00,
4018 ++ 0xf4060bf4,
4019 ++/* 0x064e: i2c_sense_sda_done */
4020 ++ 0x00f80131,
4021 ++/* 0x0650: i2c_raise_scl */
4022 ++ 0x984440f9,
4023 ++ 0x7e010308,
4024 ++/* 0x065b: i2c_raise_scl_wait */
4025 ++ 0x4e0005f4,
4026 ++ 0x587e03e8,
4027 ++ 0x287e0000,
4028 ++ 0x01f40006,
4029 ++ 0x0142b609,
4030 ++/* 0x066f: i2c_raise_scl_done */
4031 ++ 0xfcef1bf4,
4032 ++/* 0x0673: i2c_start */
4033 ++ 0x7e00f840,
4034 ++ 0xf4000628,
4035 ++ 0x3c7e0d11,
4036 ++ 0x11f40006,
4037 ++ 0x2e0ef406,
4038 ++/* 0x0684: i2c_start_rep */
4039 ++ 0xf47e0003,
4040 ++ 0x01030005,
4041 ++ 0x00060e7e,
4042 ++ 0xb60076bb,
4043 ++ 0x50f90465,
4044 ++ 0xbb046594,
4045 ++ 0x50bd0256,
4046 ++ 0xfc0475fd,
4047 ++ 0x06507e50,
4048 ++ 0x0464b600,
4049 ++/* 0x06af: i2c_start_send */
4050 ++ 0x031d11f4,
4051 ++ 0x060e7e00,
4052 ++ 0x13884e00,
4053 ++ 0x0000587e,
4054 ++ 0xf47e0003,
4055 ++ 0x884e0005,
4056 ++ 0x00587e13,
4057 ++/* 0x06c9: i2c_start_out */
4058 ++/* 0x06cb: i2c_stop */
4059 ++ 0x0300f800,
4060 ++ 0x05f47e00,
4061 ++ 0x7e000300,
4062 ++ 0x4e00060e,
4063 ++ 0x587e03e8,
4064 ++ 0x01030000,
4065 ++ 0x0005f47e,
4066 ++ 0x7e13884e,
4067 ++ 0x03000058,
4068 ++ 0x060e7e01,
4069 ++ 0x13884e00,
4070 ++ 0x0000587e,
4071 ++/* 0x06fa: i2c_bitw */
4072 ++ 0x0e7e00f8,
4073 ++ 0xe84e0006,
4074 ++ 0x00587e03,
4075 + 0x0076bb00,
4076 + 0xf90465b6,
4077 + 0x04659450,
4078 + 0xbd0256bb,
4079 + 0x0475fd50,
4080 +- 0x557e50fc,
4081 ++ 0x507e50fc,
4082 + 0x64b60006,
4083 +- 0x1d11f404,
4084 +-/* 0x06b4: i2c_start_send */
4085 +- 0x137e0003,
4086 +- 0x884e0006,
4087 +- 0x00587e13,
4088 +- 0x7e000300,
4089 +- 0x4e0005f9,
4090 +- 0x587e1388,
4091 +-/* 0x06ce: i2c_start_out */
4092 +- 0x00f80000,
4093 +-/* 0x06d0: i2c_stop */
4094 +- 0xf97e0003,
4095 +- 0x00030005,
4096 +- 0x0006137e,
4097 +- 0x7e03e84e,
4098 ++ 0x1711f404,
4099 ++ 0x7e13884e,
4100 + 0x03000058,
4101 +- 0x05f97e01,
4102 ++ 0x05f47e00,
4103 + 0x13884e00,
4104 + 0x0000587e,
4105 +- 0x137e0103,
4106 +- 0x884e0006,
4107 +- 0x00587e13,
4108 +-/* 0x06ff: i2c_bitw */
4109 +- 0x7e00f800,
4110 +- 0x4e000613,
4111 +- 0x587e03e8,
4112 +- 0x76bb0000,
4113 ++/* 0x0738: i2c_bitw_out */
4114 ++/* 0x073a: i2c_bitr */
4115 ++ 0x010300f8,
4116 ++ 0x00060e7e,
4117 ++ 0x7e03e84e,
4118 ++ 0xbb000058,
4119 ++ 0x65b60076,
4120 ++ 0x9450f904,
4121 ++ 0x56bb0465,
4122 ++ 0xfd50bd02,
4123 ++ 0x50fc0475,
4124 ++ 0x0006507e,
4125 ++ 0xf40464b6,
4126 ++ 0x3c7e1a11,
4127 ++ 0x00030006,
4128 ++ 0x0005f47e,
4129 ++ 0x7e13884e,
4130 ++ 0xf0000058,
4131 ++ 0x31f4013c,
4132 ++/* 0x077d: i2c_bitr_done */
4133 ++/* 0x077f: i2c_get_byte */
4134 ++ 0x0500f801,
4135 ++/* 0x0783: i2c_get_byte_next */
4136 ++ 0xb6080400,
4137 ++ 0x76bb0154,
4138 + 0x0465b600,
4139 + 0x659450f9,
4140 + 0x0256bb04,
4141 + 0x75fd50bd,
4142 + 0x7e50fc04,
4143 +- 0xb6000655,
4144 ++ 0xb600073a,
4145 + 0x11f40464,
4146 +- 0x13884e17,
4147 +- 0x0000587e,
4148 +- 0xf97e0003,
4149 +- 0x884e0005,
4150 +- 0x00587e13,
4151 +-/* 0x073d: i2c_bitw_out */
4152 +-/* 0x073f: i2c_bitr */
4153 +- 0x0300f800,
4154 +- 0x06137e01,
4155 +- 0x03e84e00,
4156 +- 0x0000587e,
4157 ++ 0x0553fd2a,
4158 ++ 0xf40142b6,
4159 ++ 0x0103d81b,
4160 + 0xb60076bb,
4161 + 0x50f90465,
4162 + 0xbb046594,
4163 + 0x50bd0256,
4164 + 0xfc0475fd,
4165 +- 0x06557e50,
4166 ++ 0x06fa7e50,
4167 + 0x0464b600,
4168 +- 0x7e1a11f4,
4169 +- 0x03000641,
4170 +- 0x05f97e00,
4171 +- 0x13884e00,
4172 +- 0x0000587e,
4173 +- 0xf4013cf0,
4174 +-/* 0x0782: i2c_bitr_done */
4175 +- 0x00f80131,
4176 +-/* 0x0784: i2c_get_byte */
4177 +- 0x08040005,
4178 +-/* 0x0788: i2c_get_byte_next */
4179 +- 0xbb0154b6,
4180 +- 0x65b60076,
4181 +- 0x9450f904,
4182 +- 0x56bb0465,
4183 +- 0xfd50bd02,
4184 +- 0x50fc0475,
4185 +- 0x00073f7e,
4186 +- 0xf40464b6,
4187 +- 0x53fd2a11,
4188 +- 0x0142b605,
4189 +- 0x03d81bf4,
4190 +- 0x0076bb01,
4191 +- 0xf90465b6,
4192 +- 0x04659450,
4193 +- 0xbd0256bb,
4194 +- 0x0475fd50,
4195 +- 0xff7e50fc,
4196 +- 0x64b60006,
4197 +-/* 0x07d1: i2c_get_byte_done */
4198 +-/* 0x07d3: i2c_put_byte */
4199 +- 0x0400f804,
4200 +-/* 0x07d5: i2c_put_byte_next */
4201 +- 0x0142b608,
4202 +- 0xbb3854ff,
4203 ++/* 0x07cc: i2c_get_byte_done */
4204 ++/* 0x07ce: i2c_put_byte */
4205 ++ 0x080400f8,
4206 ++/* 0x07d0: i2c_put_byte_next */
4207 ++ 0xff0142b6,
4208 ++ 0x76bb3854,
4209 ++ 0x0465b600,
4210 ++ 0x659450f9,
4211 ++ 0x0256bb04,
4212 ++ 0x75fd50bd,
4213 ++ 0x7e50fc04,
4214 ++ 0xb60006fa,
4215 ++ 0x11f40464,
4216 ++ 0x0046b034,
4217 ++ 0xbbd81bf4,
4218 + 0x65b60076,
4219 + 0x9450f904,
4220 + 0x56bb0465,
4221 + 0xfd50bd02,
4222 + 0x50fc0475,
4223 +- 0x0006ff7e,
4224 ++ 0x00073a7e,
4225 + 0xf40464b6,
4226 +- 0x46b03411,
4227 +- 0xd81bf400,
4228 ++ 0x76bb0f11,
4229 ++ 0x0136b000,
4230 ++ 0xf4061bf4,
4231 ++/* 0x0826: i2c_put_byte_done */
4232 ++ 0x00f80132,
4233 ++/* 0x0828: i2c_addr */
4234 + 0xb60076bb,
4235 + 0x50f90465,
4236 + 0xbb046594,
4237 + 0x50bd0256,
4238 + 0xfc0475fd,
4239 +- 0x073f7e50,
4240 ++ 0x06737e50,
4241 + 0x0464b600,
4242 +- 0xbb0f11f4,
4243 +- 0x36b00076,
4244 +- 0x061bf401,
4245 +-/* 0x082b: i2c_put_byte_done */
4246 +- 0xf80132f4,
4247 +-/* 0x082d: i2c_addr */
4248 +- 0x0076bb00,
4249 ++ 0xe72911f4,
4250 ++ 0xb6012ec3,
4251 ++ 0x53fd0134,
4252 ++ 0x0076bb05,
4253 + 0xf90465b6,
4254 + 0x04659450,
4255 + 0xbd0256bb,
4256 + 0x0475fd50,
4257 +- 0x787e50fc,
4258 +- 0x64b60006,
4259 +- 0x2911f404,
4260 +- 0x012ec3e7,
4261 +- 0xfd0134b6,
4262 +- 0x76bb0553,
4263 +- 0x0465b600,
4264 +- 0x659450f9,
4265 +- 0x0256bb04,
4266 +- 0x75fd50bd,
4267 +- 0x7e50fc04,
4268 +- 0xb60007d3,
4269 +-/* 0x0872: i2c_addr_done */
4270 +- 0x00f80464,
4271 +-/* 0x0874: i2c_acquire_addr */
4272 +- 0xb6f8cec7,
4273 +- 0xe0b705e4,
4274 +- 0x00f8d014,
4275 +-/* 0x0880: i2c_acquire */
4276 +- 0x0008747e,
4277 ++ 0xce7e50fc,
4278 ++ 0x64b60007,
4279 ++/* 0x086d: i2c_addr_done */
4280 ++/* 0x086f: i2c_acquire_addr */
4281 ++ 0xc700f804,
4282 ++ 0xe4b6f8ce,
4283 ++ 0x14e0b705,
4284 ++/* 0x087b: i2c_acquire */
4285 ++ 0x7e00f8d0,
4286 ++ 0x7e00086f,
4287 ++ 0xf0000004,
4288 ++ 0x2d7e03d9,
4289 ++ 0x00f80000,
4290 ++/* 0x088c: i2c_release */
4291 ++ 0x00086f7e,
4292 + 0x0000047e,
4293 +- 0x7e03d9f0,
4294 ++ 0x7e03daf0,
4295 + 0xf800002d,
4296 +-/* 0x0891: i2c_release */
4297 +- 0x08747e00,
4298 +- 0x00047e00,
4299 +- 0x03daf000,
4300 +- 0x00002d7e,
4301 +-/* 0x08a2: i2c_recv */
4302 +- 0x32f400f8,
4303 +- 0xf8c1c701,
4304 +- 0xb00214b6,
4305 +- 0x1ff52816,
4306 +- 0x13b80134,
4307 +- 0x98000cf4,
4308 +- 0x13b80032,
4309 +- 0x98000ccc,
4310 +- 0x31f40031,
4311 +- 0xf9d0f902,
4312 +- 0xd6d0f9e0,
4313 +- 0x10000000,
4314 +- 0xbb016792,
4315 +- 0x65b60076,
4316 +- 0x9450f904,
4317 +- 0x56bb0465,
4318 +- 0xfd50bd02,
4319 +- 0x50fc0475,
4320 +- 0x0008807e,
4321 +- 0xfc0464b6,
4322 +- 0x00d6b0d0,
4323 +- 0x00b01bf5,
4324 +- 0x76bb0005,
4325 ++/* 0x089d: i2c_recv */
4326 ++ 0x0132f400,
4327 ++ 0xb6f8c1c7,
4328 ++ 0x16b00214,
4329 ++ 0x341ff528,
4330 ++ 0xf413b801,
4331 ++ 0x3298000c,
4332 ++ 0xcc13b800,
4333 ++ 0x3198000c,
4334 ++ 0x0231f400,
4335 ++ 0xe0f9d0f9,
4336 ++ 0x00d6d0f9,
4337 ++ 0x92100000,
4338 ++ 0x76bb0167,
4339 + 0x0465b600,
4340 + 0x659450f9,
4341 + 0x0256bb04,
4342 + 0x75fd50bd,
4343 + 0x7e50fc04,
4344 +- 0xb600082d,
4345 +- 0x11f50464,
4346 +- 0xc5c700cc,
4347 +- 0x0076bbe0,
4348 +- 0xf90465b6,
4349 +- 0x04659450,
4350 +- 0xbd0256bb,
4351 +- 0x0475fd50,
4352 +- 0xd37e50fc,
4353 +- 0x64b60007,
4354 +- 0xa911f504,
4355 +- 0xbb010500,
4356 +- 0x65b60076,
4357 +- 0x9450f904,
4358 +- 0x56bb0465,
4359 +- 0xfd50bd02,
4360 +- 0x50fc0475,
4361 +- 0x00082d7e,
4362 +- 0xf50464b6,
4363 +- 0xbb008711,
4364 +- 0x65b60076,
4365 +- 0x9450f904,
4366 +- 0x56bb0465,
4367 +- 0xfd50bd02,
4368 +- 0x50fc0475,
4369 +- 0x0007847e,
4370 +- 0xf40464b6,
4371 +- 0x5bcb6711,
4372 +- 0x0076bbe0,
4373 ++ 0xb600087b,
4374 ++ 0xd0fc0464,
4375 ++ 0xf500d6b0,
4376 ++ 0x0500b01b,
4377 ++ 0x0076bb00,
4378 + 0xf90465b6,
4379 + 0x04659450,
4380 + 0xbd0256bb,
4381 + 0x0475fd50,
4382 +- 0xd07e50fc,
4383 +- 0x64b60006,
4384 +- 0xbd5bb204,
4385 +- 0x410ef474,
4386 +-/* 0x09a4: i2c_recv_not_rd08 */
4387 +- 0xf401d6b0,
4388 +- 0x00053b1b,
4389 +- 0x00082d7e,
4390 +- 0xc73211f4,
4391 +- 0xd37ee0c5,
4392 +- 0x11f40007,
4393 +- 0x7e000528,
4394 +- 0xf400082d,
4395 +- 0xb5c71f11,
4396 +- 0x07d37ee0,
4397 +- 0x1511f400,
4398 +- 0x0006d07e,
4399 +- 0xc5c774bd,
4400 +- 0x091bf408,
4401 +- 0xf40232f4,
4402 +-/* 0x09e2: i2c_recv_not_wr08 */
4403 +-/* 0x09e2: i2c_recv_done */
4404 +- 0xcec7030e,
4405 +- 0x08917ef8,
4406 +- 0xfce0fc00,
4407 +- 0x0912f4d0,
4408 +- 0x9f7e7cb2,
4409 +-/* 0x09f6: i2c_recv_exit */
4410 +- 0x00f80002,
4411 +-/* 0x09f8: i2c_init */
4412 +-/* 0x09fa: test_recv */
4413 +- 0x584100f8,
4414 +- 0x0011cf04,
4415 +- 0x400110b6,
4416 +- 0x01f60458,
4417 +- 0xde04bd00,
4418 +- 0x134fd900,
4419 +- 0x0001de7e,
4420 +-/* 0x0a16: test_init */
4421 +- 0x004e00f8,
4422 +- 0x01de7e08,
4423 +-/* 0x0a1f: idle_recv */
4424 ++ 0x287e50fc,
4425 ++ 0x64b60008,
4426 ++ 0xcc11f504,
4427 ++ 0xe0c5c700,
4428 ++ 0xb60076bb,
4429 ++ 0x50f90465,
4430 ++ 0xbb046594,
4431 ++ 0x50bd0256,
4432 ++ 0xfc0475fd,
4433 ++ 0x07ce7e50,
4434 ++ 0x0464b600,
4435 ++ 0x00a911f5,
4436 ++ 0x76bb0105,
4437 ++ 0x0465b600,
4438 ++ 0x659450f9,
4439 ++ 0x0256bb04,
4440 ++ 0x75fd50bd,
4441 ++ 0x7e50fc04,
4442 ++ 0xb6000828,
4443 ++ 0x11f50464,
4444 ++ 0x76bb0087,
4445 ++ 0x0465b600,
4446 ++ 0x659450f9,
4447 ++ 0x0256bb04,
4448 ++ 0x75fd50bd,
4449 ++ 0x7e50fc04,
4450 ++ 0xb600077f,
4451 ++ 0x11f40464,
4452 ++ 0xe05bcb67,
4453 ++ 0xb60076bb,
4454 ++ 0x50f90465,
4455 ++ 0xbb046594,
4456 ++ 0x50bd0256,
4457 ++ 0xfc0475fd,
4458 ++ 0x06cb7e50,
4459 ++ 0x0464b600,
4460 ++ 0x74bd5bb2,
4461 ++/* 0x099f: i2c_recv_not_rd08 */
4462 ++ 0xb0410ef4,
4463 ++ 0x1bf401d6,
4464 ++ 0x7e00053b,
4465 ++ 0xf4000828,
4466 ++ 0xc5c73211,
4467 ++ 0x07ce7ee0,
4468 ++ 0x2811f400,
4469 ++ 0x287e0005,
4470 ++ 0x11f40008,
4471 ++ 0xe0b5c71f,
4472 ++ 0x0007ce7e,
4473 ++ 0x7e1511f4,
4474 ++ 0xbd0006cb,
4475 ++ 0x08c5c774,
4476 ++ 0xf4091bf4,
4477 ++ 0x0ef40232,
4478 ++/* 0x09dd: i2c_recv_not_wr08 */
4479 ++/* 0x09dd: i2c_recv_done */
4480 ++ 0xf8cec703,
4481 ++ 0x00088c7e,
4482 ++ 0xd0fce0fc,
4483 ++ 0xb20912f4,
4484 ++ 0x029f7e7c,
4485 ++/* 0x09f1: i2c_recv_exit */
4486 ++/* 0x09f3: i2c_init */
4487 + 0xf800f800,
4488 +-/* 0x0a21: idle */
4489 +- 0x0031f400,
4490 +- 0xcf045441,
4491 +- 0x10b60011,
4492 +- 0x04544001,
4493 +- 0xbd0001f6,
4494 +-/* 0x0a35: idle_loop */
4495 +- 0xf4580104,
4496 +-/* 0x0a3a: idle_proc */
4497 +-/* 0x0a3a: idle_proc_exec */
4498 +- 0x10f90232,
4499 +- 0xa87e1eb2,
4500 +- 0x10fc0002,
4501 +- 0xf40911f4,
4502 +- 0x0ef40231,
4503 +-/* 0x0a4d: idle_proc_next */
4504 +- 0x5810b6f0,
4505 +- 0x1bf41fa6,
4506 +- 0xe002f4e8,
4507 +- 0xf40028f4,
4508 +- 0x0000c60e,
4509 ++/* 0x09f5: test_recv */
4510 ++ 0x04584100,
4511 ++ 0xb60011cf,
4512 ++ 0x58400110,
4513 ++ 0x0001f604,
4514 ++ 0x00de04bd,
4515 ++ 0x7e134fd9,
4516 ++ 0xf80001de,
4517 ++/* 0x0a11: test_init */
4518 ++ 0x08004e00,
4519 ++ 0x0001de7e,
4520 ++/* 0x0a1a: idle_recv */
4521 ++ 0x00f800f8,
4522 ++/* 0x0a1c: idle */
4523 ++ 0x410031f4,
4524 ++ 0x11cf0454,
4525 ++ 0x0110b600,
4526 ++ 0xf6045440,
4527 ++ 0x04bd0001,
4528 ++/* 0x0a30: idle_loop */
4529 ++ 0x32f45801,
4530 ++/* 0x0a35: idle_proc */
4531 ++/* 0x0a35: idle_proc_exec */
4532 ++ 0xb210f902,
4533 ++ 0x02a87e1e,
4534 ++ 0xf410fc00,
4535 ++ 0x31f40911,
4536 ++ 0xf00ef402,
4537 ++/* 0x0a48: idle_proc_next */
4538 ++ 0xa65810b6,
4539 ++ 0xe81bf41f,
4540 ++ 0xf4e002f4,
4541 ++ 0x0ef40028,
4542 ++ 0x000000c6,
4543 ++ 0x00000000,
4544 + 0x00000000,
4545 + 0x00000000,
4546 + 0x00000000,
4547 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
4548 +index e83341815ec6..e29b785d9f22 100644
4549 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
4550 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
4551 +@@ -46,8 +46,8 @@ uint32_t gt215_pmu_data[] = {
4552 + 0x00000000,
4553 + 0x00000000,
4554 + 0x584d454d,
4555 +- 0x0000083a,
4556 +- 0x0000082c,
4557 ++ 0x00000833,
4558 ++ 0x00000825,
4559 + 0x00000000,
4560 + 0x00000000,
4561 + 0x00000000,
4562 +@@ -68,8 +68,8 @@ uint32_t gt215_pmu_data[] = {
4563 + 0x00000000,
4564 + 0x00000000,
4565 + 0x46524550,
4566 +- 0x0000083e,
4567 +- 0x0000083c,
4568 ++ 0x00000837,
4569 ++ 0x00000835,
4570 + 0x00000000,
4571 + 0x00000000,
4572 + 0x00000000,
4573 +@@ -90,8 +90,8 @@ uint32_t gt215_pmu_data[] = {
4574 + 0x00000000,
4575 + 0x00000000,
4576 + 0x5f433249,
4577 +- 0x00000c6e,
4578 +- 0x00000b11,
4579 ++ 0x00000c67,
4580 ++ 0x00000b0a,
4581 + 0x00000000,
4582 + 0x00000000,
4583 + 0x00000000,
4584 +@@ -112,8 +112,8 @@ uint32_t gt215_pmu_data[] = {
4585 + 0x00000000,
4586 + 0x00000000,
4587 + 0x54534554,
4588 +- 0x00000c97,
4589 +- 0x00000c70,
4590 ++ 0x00000c90,
4591 ++ 0x00000c69,
4592 + 0x00000000,
4593 + 0x00000000,
4594 + 0x00000000,
4595 +@@ -134,8 +134,8 @@ uint32_t gt215_pmu_data[] = {
4596 + 0x00000000,
4597 + 0x00000000,
4598 + 0x454c4449,
4599 +- 0x00000ca3,
4600 +- 0x00000ca1,
4601 ++ 0x00000c9c,
4602 ++ 0x00000c9a,
4603 + 0x00000000,
4604 + 0x00000000,
4605 + 0x00000000,
4606 +@@ -233,22 +233,22 @@ uint32_t gt215_pmu_data[] = {
4607 + /* 0x037c: memx_func_next */
4608 + 0x00000002,
4609 + 0x00000000,
4610 +- 0x000005a0,
4611 ++ 0x0000059f,
4612 + 0x00000003,
4613 + 0x00000002,
4614 +- 0x00000632,
4615 ++ 0x0000062f,
4616 + 0x00040004,
4617 + 0x00000000,
4618 +- 0x0000064e,
4619 ++ 0x0000064b,
4620 + 0x00010005,
4621 + 0x00000000,
4622 +- 0x0000066b,
4623 ++ 0x00000668,
4624 + 0x00010006,
4625 + 0x00000000,
4626 +- 0x000005f0,
4627 ++ 0x000005ef,
4628 + 0x00000007,
4629 + 0x00000000,
4630 +- 0x00000676,
4631 ++ 0x00000673,
4632 + /* 0x03c4: memx_func_tail */
4633 + /* 0x03c4: memx_ts_start */
4634 + 0x00000000,
4635 +@@ -1304,560 +1304,560 @@ uint32_t gt215_pmu_code[] = {
4636 + 0x67f102d7,
4637 + 0x63f1fffc,
4638 + 0x76fdffff,
4639 +- 0x0267f104,
4640 +- 0x0576fd00,
4641 +- 0x70f980f9,
4642 +- 0xe0fcd0fc,
4643 +- 0xf04021f4,
4644 ++ 0x0267f004,
4645 ++ 0xf90576fd,
4646 ++ 0xfc70f980,
4647 ++ 0xf4e0fcd0,
4648 ++ 0x67f04021,
4649 ++ 0xe007f104,
4650 ++ 0x0604b607,
4651 ++ 0xbd0006d0,
4652 ++/* 0x0581: memx_func_enter_wait */
4653 ++ 0xc067f104,
4654 ++ 0x0664b607,
4655 ++ 0xf00066cf,
4656 ++ 0x0bf40464,
4657 ++ 0x2c67f0f3,
4658 ++ 0xcf0664b6,
4659 ++ 0x06800066,
4660 ++/* 0x059f: memx_func_leave */
4661 ++ 0xf000f8f1,
4662 ++ 0x64b62c67,
4663 ++ 0x0066cf06,
4664 ++ 0xf0f20680,
4665 + 0x07f10467,
4666 +- 0x04b607e0,
4667 ++ 0x04b607e4,
4668 + 0x0006d006,
4669 +-/* 0x0582: memx_func_enter_wait */
4670 ++/* 0x05ba: memx_func_leave_wait */
4671 + 0x67f104bd,
4672 + 0x64b607c0,
4673 + 0x0066cf06,
4674 + 0xf40464f0,
4675 +- 0x67f0f30b,
4676 +- 0x0664b62c,
4677 +- 0x800066cf,
4678 +- 0x00f8f106,
4679 +-/* 0x05a0: memx_func_leave */
4680 +- 0xb62c67f0,
4681 +- 0x66cf0664,
4682 +- 0xf2068000,
4683 +- 0xf10467f0,
4684 +- 0xb607e407,
4685 +- 0x06d00604,
4686 +-/* 0x05bb: memx_func_leave_wait */
4687 +- 0xf104bd00,
4688 +- 0xb607c067,
4689 +- 0x66cf0664,
4690 +- 0x0464f000,
4691 +- 0xf1f31bf4,
4692 +- 0xb9161087,
4693 +- 0x21f4028e,
4694 +- 0x02d7b904,
4695 +- 0xffcc67f1,
4696 +- 0xffff63f1,
4697 +- 0xf90476fd,
4698 +- 0xfc70f980,
4699 +- 0xf4e0fcd0,
4700 +- 0x00f84021,
4701 +-/* 0x05f0: memx_func_wait_vblank */
4702 +- 0xb0001698,
4703 +- 0x0bf40066,
4704 +- 0x0166b013,
4705 +- 0xf4060bf4,
4706 +-/* 0x0602: memx_func_wait_vblank_head1 */
4707 +- 0x77f12e0e,
4708 +- 0x0ef40020,
4709 +-/* 0x0609: memx_func_wait_vblank_head0 */
4710 +- 0x0877f107,
4711 +-/* 0x060d: memx_func_wait_vblank_0 */
4712 +- 0xc467f100,
4713 +- 0x0664b607,
4714 +- 0xfd0066cf,
4715 +- 0x1bf40467,
4716 +-/* 0x061d: memx_func_wait_vblank_1 */
4717 +- 0xc467f1f3,
4718 +- 0x0664b607,
4719 +- 0xfd0066cf,
4720 +- 0x0bf40467,
4721 +-/* 0x062d: memx_func_wait_vblank_fini */
4722 +- 0x0410b6f3,
4723 +-/* 0x0632: memx_func_wr32 */
4724 +- 0x169800f8,
4725 +- 0x01159800,
4726 +- 0xf90810b6,
4727 +- 0xfc50f960,
4728 +- 0xf4e0fcd0,
4729 +- 0x42b64021,
4730 +- 0xe91bf402,
4731 +-/* 0x064e: memx_func_wait */
4732 +- 0x87f000f8,
4733 +- 0x0684b62c,
4734 +- 0x980088cf,
4735 +- 0x1d98001e,
4736 +- 0x021c9801,
4737 +- 0xb6031b98,
4738 +- 0x21f41010,
4739 +-/* 0x066b: memx_func_delay */
4740 +- 0x9800f8a3,
4741 +- 0x10b6001e,
4742 +- 0x7e21f404,
4743 +-/* 0x0676: memx_func_train */
4744 +- 0x57f100f8,
4745 +- 0x77f10003,
4746 +- 0x97f10000,
4747 +- 0x93f00000,
4748 +- 0x029eb970,
4749 +- 0xb90421f4,
4750 +- 0xe7f102d8,
4751 +- 0x21f42710,
4752 +-/* 0x0695: memx_func_train_loop_outer */
4753 +- 0x0158e07e,
4754 +- 0x0083f101,
4755 +- 0xe097f102,
4756 +- 0x1193f011,
4757 +- 0x80f990f9,
4758 ++ 0x87f1f31b,
4759 ++ 0x8eb91610,
4760 ++ 0x0421f402,
4761 ++ 0xf102d7b9,
4762 ++ 0xf1ffcc67,
4763 ++ 0xfdffff63,
4764 ++ 0x80f90476,
4765 ++ 0xd0fc70f9,
4766 ++ 0x21f4e0fc,
4767 ++/* 0x05ef: memx_func_wait_vblank */
4768 ++ 0x9800f840,
4769 ++ 0x66b00016,
4770 ++ 0x120bf400,
4771 ++ 0xf40166b0,
4772 ++ 0x0ef4060b,
4773 ++/* 0x0601: memx_func_wait_vblank_head1 */
4774 ++ 0x2077f02c,
4775 ++/* 0x0607: memx_func_wait_vblank_head0 */
4776 ++ 0xf0060ef4,
4777 ++/* 0x060a: memx_func_wait_vblank_0 */
4778 ++ 0x67f10877,
4779 ++ 0x64b607c4,
4780 ++ 0x0066cf06,
4781 ++ 0xf40467fd,
4782 ++/* 0x061a: memx_func_wait_vblank_1 */
4783 ++ 0x67f1f31b,
4784 ++ 0x64b607c4,
4785 ++ 0x0066cf06,
4786 ++ 0xf40467fd,
4787 ++/* 0x062a: memx_func_wait_vblank_fini */
4788 ++ 0x10b6f30b,
4789 ++/* 0x062f: memx_func_wr32 */
4790 ++ 0x9800f804,
4791 ++ 0x15980016,
4792 ++ 0x0810b601,
4793 ++ 0x50f960f9,
4794 + 0xe0fcd0fc,
4795 +- 0xf94021f4,
4796 +- 0x0067f150,
4797 +-/* 0x06b5: memx_func_train_loop_inner */
4798 +- 0x1187f100,
4799 +- 0x9068ff11,
4800 +- 0xfd109894,
4801 +- 0x97f10589,
4802 +- 0x93f00720,
4803 +- 0xf990f910,
4804 +- 0xfcd0fc80,
4805 +- 0x4021f4e0,
4806 +- 0x008097f1,
4807 +- 0xb91093f0,
4808 +- 0x21f4029e,
4809 +- 0x02d8b904,
4810 +- 0xf92088c5,
4811 ++ 0xb64021f4,
4812 ++ 0x1bf40242,
4813 ++/* 0x064b: memx_func_wait */
4814 ++ 0xf000f8e9,
4815 ++ 0x84b62c87,
4816 ++ 0x0088cf06,
4817 ++ 0x98001e98,
4818 ++ 0x1c98011d,
4819 ++ 0x031b9802,
4820 ++ 0xf41010b6,
4821 ++ 0x00f8a321,
4822 ++/* 0x0668: memx_func_delay */
4823 ++ 0xb6001e98,
4824 ++ 0x21f40410,
4825 ++/* 0x0673: memx_func_train */
4826 ++ 0xf000f87e,
4827 ++ 0x77f00357,
4828 ++ 0x0097f100,
4829 ++ 0x7093f000,
4830 ++ 0xf4029eb9,
4831 ++ 0xd8b90421,
4832 ++ 0x10e7f102,
4833 ++ 0x7e21f427,
4834 ++/* 0x0690: memx_func_train_loop_outer */
4835 ++ 0x010158e0,
4836 ++ 0x020083f1,
4837 ++ 0x11e097f1,
4838 ++ 0xf91193f0,
4839 ++ 0xfc80f990,
4840 ++ 0xf4e0fcd0,
4841 ++ 0x50f94021,
4842 ++/* 0x06af: memx_func_train_loop_inner */
4843 ++ 0xf10067f0,
4844 ++ 0xff111187,
4845 ++ 0x98949068,
4846 ++ 0x0589fd10,
4847 ++ 0x072097f1,
4848 ++ 0xf91093f0,
4849 + 0xfc80f990,
4850 + 0xf4e0fcd0,
4851 + 0x97f14021,
4852 +- 0x93f0053c,
4853 +- 0x0287f110,
4854 +- 0x0083f130,
4855 +- 0xf990f980,
4856 ++ 0x93f00080,
4857 ++ 0x029eb910,
4858 ++ 0xb90421f4,
4859 ++ 0x88c502d8,
4860 ++ 0xf990f920,
4861 + 0xfcd0fc80,
4862 + 0x4021f4e0,
4863 +- 0x0560e7f1,
4864 +- 0xf110e3f0,
4865 +- 0xf10000d7,
4866 +- 0x908000d3,
4867 +- 0xb7f100dc,
4868 +- 0xb3f08480,
4869 +- 0xa321f41e,
4870 +- 0x000057f1,
4871 +- 0xffff97f1,
4872 +- 0x830093f1,
4873 +-/* 0x0734: memx_func_train_loop_4x */
4874 +- 0x0080a7f1,
4875 +- 0xb910a3f0,
4876 +- 0x21f402ae,
4877 +- 0x02d8b904,
4878 +- 0xffdfb7f1,
4879 +- 0xffffb3f1,
4880 +- 0xf9048bfd,
4881 +- 0xfc80f9a0,
4882 ++ 0x053c97f1,
4883 ++ 0xf11093f0,
4884 ++ 0xf1300287,
4885 ++ 0xf9800083,
4886 ++ 0xfc80f990,
4887 + 0xf4e0fcd0,
4888 +- 0xa7f14021,
4889 +- 0xa3f0053c,
4890 +- 0x0287f110,
4891 +- 0x0083f130,
4892 +- 0xf9a0f980,
4893 +- 0xfcd0fc80,
4894 +- 0x4021f4e0,
4895 +- 0x0560e7f1,
4896 +- 0xf110e3f0,
4897 +- 0xf10000d7,
4898 +- 0xb98000d3,
4899 +- 0xb7f102dc,
4900 +- 0xb3f02710,
4901 +- 0xa321f400,
4902 +- 0xf402eeb9,
4903 +- 0xddb90421,
4904 +- 0x949dff02,
4905 ++ 0xe7f14021,
4906 ++ 0xe3f00560,
4907 ++ 0x00d7f110,
4908 ++ 0x00d3f100,
4909 ++ 0x00dc9080,
4910 ++ 0x8480b7f1,
4911 ++ 0xf41eb3f0,
4912 ++ 0x57f0a321,
4913 ++ 0xff97f100,
4914 ++ 0x0093f1ff,
4915 ++/* 0x072d: memx_func_train_loop_4x */
4916 ++ 0x80a7f183,
4917 ++ 0x10a3f000,
4918 ++ 0xf402aeb9,
4919 ++ 0xd8b90421,
4920 ++ 0xdfb7f102,
4921 ++ 0xffb3f1ff,
4922 ++ 0x048bfdff,
4923 ++ 0x80f9a0f9,
4924 ++ 0xe0fcd0fc,
4925 ++ 0xf14021f4,
4926 ++ 0xf0053ca7,
4927 ++ 0x87f110a3,
4928 ++ 0x83f13002,
4929 ++ 0xa0f98000,
4930 ++ 0xd0fc80f9,
4931 ++ 0x21f4e0fc,
4932 ++ 0x60e7f140,
4933 ++ 0x10e3f005,
4934 ++ 0x0000d7f1,
4935 ++ 0x8000d3f1,
4936 ++ 0xf102dcb9,
4937 ++ 0xf02710b7,
4938 ++ 0x21f400b3,
4939 ++ 0x02eeb9a3,
4940 ++ 0xb90421f4,
4941 ++ 0x9dff02dd,
4942 ++ 0x0150b694,
4943 ++ 0xf4045670,
4944 ++ 0x7aa0921e,
4945 ++ 0xa9800bcc,
4946 ++ 0x0160b600,
4947 ++ 0x700470b6,
4948 ++ 0x1ef51066,
4949 ++ 0x50fcff01,
4950 + 0x700150b6,
4951 +- 0x1ef40456,
4952 +- 0xcc7aa092,
4953 +- 0x00a9800b,
4954 +- 0xb60160b6,
4955 +- 0x66700470,
4956 +- 0x001ef510,
4957 +- 0xb650fcff,
4958 +- 0x56700150,
4959 +- 0xd41ef507,
4960 +-/* 0x07c7: memx_exec */
4961 +- 0xf900f8fe,
4962 +- 0xb9d0f9e0,
4963 +- 0xb2b902c1,
4964 +-/* 0x07d1: memx_exec_next */
4965 +- 0x00139802,
4966 +- 0xe70410b6,
4967 +- 0xe701f034,
4968 +- 0xb601e033,
4969 +- 0x30f00132,
4970 +- 0xde35980c,
4971 +- 0x12b855f9,
4972 +- 0xe41ef406,
4973 +- 0x98f10b98,
4974 +- 0xcbbbf20c,
4975 +- 0xc4b7f102,
4976 +- 0x06b4b607,
4977 +- 0xfc00bbcf,
4978 +- 0xf5e0fcd0,
4979 ++ 0x1ef50756,
4980 ++ 0x00f8fed6,
4981 ++/* 0x07c0: memx_exec */
4982 ++ 0xd0f9e0f9,
4983 ++ 0xb902c1b9,
4984 ++/* 0x07ca: memx_exec_next */
4985 ++ 0x139802b2,
4986 ++ 0x0410b600,
4987 ++ 0x01f034e7,
4988 ++ 0x01e033e7,
4989 ++ 0xf00132b6,
4990 ++ 0x35980c30,
4991 ++ 0xb855f9de,
4992 ++ 0x1ef40612,
4993 ++ 0xf10b98e4,
4994 ++ 0xbbf20c98,
4995 ++ 0xb7f102cb,
4996 ++ 0xb4b607c4,
4997 ++ 0x00bbcf06,
4998 ++ 0xe0fcd0fc,
4999 ++ 0x033621f5,
5000 ++/* 0x0806: memx_info */
5001 ++ 0xc67000f8,
5002 ++ 0x0e0bf401,
5003 ++/* 0x080c: memx_info_data */
5004 ++ 0x03ccc7f1,
5005 ++ 0x0800b7f1,
5006 ++/* 0x0817: memx_info_train */
5007 ++ 0xf10b0ef4,
5008 ++ 0xf10bccc7,
5009 ++/* 0x081f: memx_info_send */
5010 ++ 0xf50100b7,
5011 + 0xf8033621,
5012 +-/* 0x080d: memx_info */
5013 +- 0x01c67000,
5014 +-/* 0x0813: memx_info_data */
5015 +- 0xf10e0bf4,
5016 +- 0xf103ccc7,
5017 +- 0xf40800b7,
5018 +-/* 0x081e: memx_info_train */
5019 +- 0xc7f10b0e,
5020 +- 0xb7f10bcc,
5021 +-/* 0x0826: memx_info_send */
5022 +- 0x21f50100,
5023 +- 0x00f80336,
5024 +-/* 0x082c: memx_recv */
5025 +- 0xf401d6b0,
5026 +- 0xd6b0980b,
5027 +- 0xd80bf400,
5028 +-/* 0x083a: memx_init */
5029 +- 0x00f800f8,
5030 +-/* 0x083c: perf_recv */
5031 +-/* 0x083e: perf_init */
5032 +- 0x00f800f8,
5033 +-/* 0x0840: i2c_drive_scl */
5034 +- 0xf40036b0,
5035 +- 0x07f1110b,
5036 +- 0x04b607e0,
5037 +- 0x0001d006,
5038 +- 0x00f804bd,
5039 +-/* 0x0854: i2c_drive_scl_lo */
5040 +- 0x07e407f1,
5041 +- 0xd00604b6,
5042 +- 0x04bd0001,
5043 +-/* 0x0862: i2c_drive_sda */
5044 +- 0x36b000f8,
5045 +- 0x110bf400,
5046 +- 0x07e007f1,
5047 +- 0xd00604b6,
5048 +- 0x04bd0002,
5049 +-/* 0x0876: i2c_drive_sda_lo */
5050 +- 0x07f100f8,
5051 +- 0x04b607e4,
5052 +- 0x0002d006,
5053 +- 0x00f804bd,
5054 +-/* 0x0884: i2c_sense_scl */
5055 +- 0xf10132f4,
5056 +- 0xb607c437,
5057 +- 0x33cf0634,
5058 +- 0x0431fd00,
5059 +- 0xf4060bf4,
5060 +-/* 0x089a: i2c_sense_scl_done */
5061 +- 0x00f80131,
5062 +-/* 0x089c: i2c_sense_sda */
5063 +- 0xf10132f4,
5064 +- 0xb607c437,
5065 +- 0x33cf0634,
5066 +- 0x0432fd00,
5067 +- 0xf4060bf4,
5068 +-/* 0x08b2: i2c_sense_sda_done */
5069 +- 0x00f80131,
5070 +-/* 0x08b4: i2c_raise_scl */
5071 +- 0x47f140f9,
5072 +- 0x37f00898,
5073 +- 0x4021f501,
5074 +-/* 0x08c1: i2c_raise_scl_wait */
5075 ++/* 0x0825: memx_recv */
5076 ++ 0x01d6b000,
5077 ++ 0xb0980bf4,
5078 ++ 0x0bf400d6,
5079 ++/* 0x0833: memx_init */
5080 ++ 0xf800f8d8,
5081 ++/* 0x0835: perf_recv */
5082 ++/* 0x0837: perf_init */
5083 ++ 0xf800f800,
5084 ++/* 0x0839: i2c_drive_scl */
5085 ++ 0x0036b000,
5086 ++ 0xf1110bf4,
5087 ++ 0xb607e007,
5088 ++ 0x01d00604,
5089 ++ 0xf804bd00,
5090 ++/* 0x084d: i2c_drive_scl_lo */
5091 ++ 0xe407f100,
5092 ++ 0x0604b607,
5093 ++ 0xbd0001d0,
5094 ++/* 0x085b: i2c_drive_sda */
5095 ++ 0xb000f804,
5096 ++ 0x0bf40036,
5097 ++ 0xe007f111,
5098 ++ 0x0604b607,
5099 ++ 0xbd0002d0,
5100 ++/* 0x086f: i2c_drive_sda_lo */
5101 ++ 0xf100f804,
5102 ++ 0xb607e407,
5103 ++ 0x02d00604,
5104 ++ 0xf804bd00,
5105 ++/* 0x087d: i2c_sense_scl */
5106 ++ 0x0132f400,
5107 ++ 0x07c437f1,
5108 ++ 0xcf0634b6,
5109 ++ 0x31fd0033,
5110 ++ 0x060bf404,
5111 ++/* 0x0893: i2c_sense_scl_done */
5112 ++ 0xf80131f4,
5113 ++/* 0x0895: i2c_sense_sda */
5114 ++ 0x0132f400,
5115 ++ 0x07c437f1,
5116 ++ 0xcf0634b6,
5117 ++ 0x32fd0033,
5118 ++ 0x060bf404,
5119 ++/* 0x08ab: i2c_sense_sda_done */
5120 ++ 0xf80131f4,
5121 ++/* 0x08ad: i2c_raise_scl */
5122 ++ 0xf140f900,
5123 ++ 0xf0089847,
5124 ++ 0x21f50137,
5125 ++/* 0x08ba: i2c_raise_scl_wait */
5126 ++ 0xe7f10839,
5127 ++ 0x21f403e8,
5128 ++ 0x7d21f57e,
5129 ++ 0x0901f408,
5130 ++ 0xf40142b6,
5131 ++/* 0x08ce: i2c_raise_scl_done */
5132 ++ 0x40fcef1b,
5133 ++/* 0x08d2: i2c_start */
5134 ++ 0x21f500f8,
5135 ++ 0x11f4087d,
5136 ++ 0x9521f50d,
5137 ++ 0x0611f408,
5138 ++/* 0x08e3: i2c_start_rep */
5139 ++ 0xf0300ef4,
5140 ++ 0x21f50037,
5141 ++ 0x37f00839,
5142 ++ 0x5b21f501,
5143 ++ 0x0076bb08,
5144 ++ 0xf90465b6,
5145 ++ 0x04659450,
5146 ++ 0xbd0256bb,
5147 ++ 0x0475fd50,
5148 ++ 0x21f550fc,
5149 ++ 0x64b608ad,
5150 ++ 0x1f11f404,
5151 ++/* 0x0910: i2c_start_send */
5152 ++ 0xf50037f0,
5153 ++ 0xf1085b21,
5154 ++ 0xf41388e7,
5155 ++ 0x37f07e21,
5156 ++ 0x3921f500,
5157 ++ 0x88e7f108,
5158 ++ 0x7e21f413,
5159 ++/* 0x092c: i2c_start_out */
5160 ++/* 0x092e: i2c_stop */
5161 ++ 0x37f000f8,
5162 ++ 0x3921f500,
5163 ++ 0x0037f008,
5164 ++ 0x085b21f5,
5165 ++ 0x03e8e7f1,
5166 ++ 0xf07e21f4,
5167 ++ 0x21f50137,
5168 ++ 0xe7f10839,
5169 ++ 0x21f41388,
5170 ++ 0x0137f07e,
5171 ++ 0x085b21f5,
5172 ++ 0x1388e7f1,
5173 ++ 0xf87e21f4,
5174 ++/* 0x0961: i2c_bitw */
5175 ++ 0x5b21f500,
5176 + 0xe8e7f108,
5177 + 0x7e21f403,
5178 +- 0x088421f5,
5179 +- 0xb60901f4,
5180 +- 0x1bf40142,
5181 +-/* 0x08d5: i2c_raise_scl_done */
5182 +- 0xf840fcef,
5183 +-/* 0x08d9: i2c_start */
5184 +- 0x8421f500,
5185 +- 0x0d11f408,
5186 +- 0x089c21f5,
5187 +- 0xf40611f4,
5188 +-/* 0x08ea: i2c_start_rep */
5189 +- 0x37f0300e,
5190 +- 0x4021f500,
5191 +- 0x0137f008,
5192 +- 0x086221f5,
5193 + 0xb60076bb,
5194 + 0x50f90465,
5195 + 0xbb046594,
5196 + 0x50bd0256,
5197 + 0xfc0475fd,
5198 +- 0xb421f550,
5199 ++ 0xad21f550,
5200 + 0x0464b608,
5201 +-/* 0x0917: i2c_start_send */
5202 +- 0xf01f11f4,
5203 +- 0x21f50037,
5204 +- 0xe7f10862,
5205 +- 0x21f41388,
5206 +- 0x0037f07e,
5207 +- 0x084021f5,
5208 +- 0x1388e7f1,
5209 +-/* 0x0933: i2c_start_out */
5210 +- 0xf87e21f4,
5211 +-/* 0x0935: i2c_stop */
5212 +- 0x0037f000,
5213 +- 0x084021f5,
5214 +- 0xf50037f0,
5215 +- 0xf1086221,
5216 +- 0xf403e8e7,
5217 ++ 0xf11811f4,
5218 ++ 0xf41388e7,
5219 + 0x37f07e21,
5220 +- 0x4021f501,
5221 ++ 0x3921f500,
5222 + 0x88e7f108,
5223 + 0x7e21f413,
5224 +- 0xf50137f0,
5225 +- 0xf1086221,
5226 +- 0xf41388e7,
5227 +- 0x00f87e21,
5228 +-/* 0x0968: i2c_bitw */
5229 +- 0x086221f5,
5230 +- 0x03e8e7f1,
5231 +- 0xbb7e21f4,
5232 +- 0x65b60076,
5233 +- 0x9450f904,
5234 +- 0x56bb0465,
5235 +- 0xfd50bd02,
5236 +- 0x50fc0475,
5237 +- 0x08b421f5,
5238 +- 0xf40464b6,
5239 +- 0xe7f11811,
5240 ++/* 0x09a0: i2c_bitw_out */
5241 ++/* 0x09a2: i2c_bitr */
5242 ++ 0x37f000f8,
5243 ++ 0x5b21f501,
5244 ++ 0xe8e7f108,
5245 ++ 0x7e21f403,
5246 ++ 0xb60076bb,
5247 ++ 0x50f90465,
5248 ++ 0xbb046594,
5249 ++ 0x50bd0256,
5250 ++ 0xfc0475fd,
5251 ++ 0xad21f550,
5252 ++ 0x0464b608,
5253 ++ 0xf51b11f4,
5254 ++ 0xf0089521,
5255 ++ 0x21f50037,
5256 ++ 0xe7f10839,
5257 + 0x21f41388,
5258 +- 0x0037f07e,
5259 +- 0x084021f5,
5260 +- 0x1388e7f1,
5261 +-/* 0x09a7: i2c_bitw_out */
5262 +- 0xf87e21f4,
5263 +-/* 0x09a9: i2c_bitr */
5264 +- 0x0137f000,
5265 +- 0x086221f5,
5266 +- 0x03e8e7f1,
5267 +- 0xbb7e21f4,
5268 +- 0x65b60076,
5269 +- 0x9450f904,
5270 +- 0x56bb0465,
5271 +- 0xfd50bd02,
5272 +- 0x50fc0475,
5273 +- 0x08b421f5,
5274 +- 0xf40464b6,
5275 +- 0x21f51b11,
5276 +- 0x37f0089c,
5277 +- 0x4021f500,
5278 +- 0x88e7f108,
5279 +- 0x7e21f413,
5280 +- 0xf4013cf0,
5281 +-/* 0x09ee: i2c_bitr_done */
5282 +- 0x00f80131,
5283 +-/* 0x09f0: i2c_get_byte */
5284 +- 0xf00057f0,
5285 +-/* 0x09f6: i2c_get_byte_next */
5286 +- 0x54b60847,
5287 ++ 0x013cf07e,
5288 ++/* 0x09e7: i2c_bitr_done */
5289 ++ 0xf80131f4,
5290 ++/* 0x09e9: i2c_get_byte */
5291 ++ 0x0057f000,
5292 ++/* 0x09ef: i2c_get_byte_next */
5293 ++ 0xb60847f0,
5294 ++ 0x76bb0154,
5295 ++ 0x0465b600,
5296 ++ 0x659450f9,
5297 ++ 0x0256bb04,
5298 ++ 0x75fd50bd,
5299 ++ 0xf550fc04,
5300 ++ 0xb609a221,
5301 ++ 0x11f40464,
5302 ++ 0x0553fd2b,
5303 ++ 0xf40142b6,
5304 ++ 0x37f0d81b,
5305 + 0x0076bb01,
5306 + 0xf90465b6,
5307 + 0x04659450,
5308 + 0xbd0256bb,
5309 + 0x0475fd50,
5310 + 0x21f550fc,
5311 +- 0x64b609a9,
5312 +- 0x2b11f404,
5313 +- 0xb60553fd,
5314 +- 0x1bf40142,
5315 +- 0x0137f0d8,
5316 +- 0xb60076bb,
5317 +- 0x50f90465,
5318 +- 0xbb046594,
5319 +- 0x50bd0256,
5320 +- 0xfc0475fd,
5321 +- 0x6821f550,
5322 +- 0x0464b609,
5323 +-/* 0x0a40: i2c_get_byte_done */
5324 +-/* 0x0a42: i2c_put_byte */
5325 +- 0x47f000f8,
5326 +-/* 0x0a45: i2c_put_byte_next */
5327 +- 0x0142b608,
5328 +- 0xbb3854ff,
5329 +- 0x65b60076,
5330 +- 0x9450f904,
5331 +- 0x56bb0465,
5332 +- 0xfd50bd02,
5333 +- 0x50fc0475,
5334 +- 0x096821f5,
5335 +- 0xf40464b6,
5336 +- 0x46b03411,
5337 +- 0xd81bf400,
5338 ++ 0x64b60961,
5339 ++/* 0x0a39: i2c_get_byte_done */
5340 ++/* 0x0a3b: i2c_put_byte */
5341 ++ 0xf000f804,
5342 ++/* 0x0a3e: i2c_put_byte_next */
5343 ++ 0x42b60847,
5344 ++ 0x3854ff01,
5345 + 0xb60076bb,
5346 + 0x50f90465,
5347 + 0xbb046594,
5348 + 0x50bd0256,
5349 + 0xfc0475fd,
5350 +- 0xa921f550,
5351 ++ 0x6121f550,
5352 + 0x0464b609,
5353 +- 0xbb0f11f4,
5354 +- 0x36b00076,
5355 +- 0x061bf401,
5356 +-/* 0x0a9b: i2c_put_byte_done */
5357 +- 0xf80132f4,
5358 +-/* 0x0a9d: i2c_addr */
5359 +- 0x0076bb00,
5360 ++ 0xb03411f4,
5361 ++ 0x1bf40046,
5362 ++ 0x0076bbd8,
5363 + 0xf90465b6,
5364 + 0x04659450,
5365 + 0xbd0256bb,
5366 + 0x0475fd50,
5367 + 0x21f550fc,
5368 +- 0x64b608d9,
5369 +- 0x2911f404,
5370 +- 0x012ec3e7,
5371 +- 0xfd0134b6,
5372 +- 0x76bb0553,
5373 ++ 0x64b609a2,
5374 ++ 0x0f11f404,
5375 ++ 0xb00076bb,
5376 ++ 0x1bf40136,
5377 ++ 0x0132f406,
5378 ++/* 0x0a94: i2c_put_byte_done */
5379 ++/* 0x0a96: i2c_addr */
5380 ++ 0x76bb00f8,
5381 + 0x0465b600,
5382 + 0x659450f9,
5383 + 0x0256bb04,
5384 + 0x75fd50bd,
5385 + 0xf550fc04,
5386 +- 0xb60a4221,
5387 +-/* 0x0ae2: i2c_addr_done */
5388 +- 0x00f80464,
5389 +-/* 0x0ae4: i2c_acquire_addr */
5390 +- 0xb6f8cec7,
5391 +- 0xe0b702e4,
5392 +- 0xee980d1c,
5393 +-/* 0x0af3: i2c_acquire */
5394 +- 0xf500f800,
5395 +- 0xf40ae421,
5396 +- 0xd9f00421,
5397 +- 0x4021f403,
5398 +-/* 0x0b02: i2c_release */
5399 +- 0x21f500f8,
5400 +- 0x21f40ae4,
5401 +- 0x03daf004,
5402 +- 0xf84021f4,
5403 +-/* 0x0b11: i2c_recv */
5404 +- 0x0132f400,
5405 +- 0xb6f8c1c7,
5406 +- 0x16b00214,
5407 +- 0x3a1ff528,
5408 +- 0xf413a001,
5409 +- 0x0032980c,
5410 +- 0x0ccc13a0,
5411 +- 0xf4003198,
5412 +- 0xd0f90231,
5413 +- 0xd0f9e0f9,
5414 +- 0x000067f1,
5415 +- 0x100063f1,
5416 +- 0xbb016792,
5417 ++ 0xb608d221,
5418 ++ 0x11f40464,
5419 ++ 0x2ec3e729,
5420 ++ 0x0134b601,
5421 ++ 0xbb0553fd,
5422 + 0x65b60076,
5423 + 0x9450f904,
5424 + 0x56bb0465,
5425 + 0xfd50bd02,
5426 + 0x50fc0475,
5427 +- 0x0af321f5,
5428 +- 0xfc0464b6,
5429 +- 0x00d6b0d0,
5430 +- 0x00b31bf5,
5431 +- 0xbb0057f0,
5432 ++ 0x0a3b21f5,
5433 ++/* 0x0adb: i2c_addr_done */
5434 ++ 0xf80464b6,
5435 ++/* 0x0add: i2c_acquire_addr */
5436 ++ 0xf8cec700,
5437 ++ 0xb702e4b6,
5438 ++ 0x980d1ce0,
5439 ++ 0x00f800ee,
5440 ++/* 0x0aec: i2c_acquire */
5441 ++ 0x0add21f5,
5442 ++ 0xf00421f4,
5443 ++ 0x21f403d9,
5444 ++/* 0x0afb: i2c_release */
5445 ++ 0xf500f840,
5446 ++ 0xf40add21,
5447 ++ 0xdaf00421,
5448 ++ 0x4021f403,
5449 ++/* 0x0b0a: i2c_recv */
5450 ++ 0x32f400f8,
5451 ++ 0xf8c1c701,
5452 ++ 0xb00214b6,
5453 ++ 0x1ff52816,
5454 ++ 0x13a0013a,
5455 ++ 0x32980cf4,
5456 ++ 0xcc13a000,
5457 ++ 0x0031980c,
5458 ++ 0xf90231f4,
5459 ++ 0xf9e0f9d0,
5460 ++ 0x0067f1d0,
5461 ++ 0x0063f100,
5462 ++ 0x01679210,
5463 ++ 0xb60076bb,
5464 ++ 0x50f90465,
5465 ++ 0xbb046594,
5466 ++ 0x50bd0256,
5467 ++ 0xfc0475fd,
5468 ++ 0xec21f550,
5469 ++ 0x0464b60a,
5470 ++ 0xd6b0d0fc,
5471 ++ 0xb31bf500,
5472 ++ 0x0057f000,
5473 ++ 0xb60076bb,
5474 ++ 0x50f90465,
5475 ++ 0xbb046594,
5476 ++ 0x50bd0256,
5477 ++ 0xfc0475fd,
5478 ++ 0x9621f550,
5479 ++ 0x0464b60a,
5480 ++ 0x00d011f5,
5481 ++ 0xbbe0c5c7,
5482 + 0x65b60076,
5483 + 0x9450f904,
5484 + 0x56bb0465,
5485 + 0xfd50bd02,
5486 + 0x50fc0475,
5487 +- 0x0a9d21f5,
5488 ++ 0x0a3b21f5,
5489 + 0xf50464b6,
5490 +- 0xc700d011,
5491 +- 0x76bbe0c5,
5492 ++ 0xf000ad11,
5493 ++ 0x76bb0157,
5494 + 0x0465b600,
5495 + 0x659450f9,
5496 + 0x0256bb04,
5497 + 0x75fd50bd,
5498 + 0xf550fc04,
5499 +- 0xb60a4221,
5500 ++ 0xb60a9621,
5501 + 0x11f50464,
5502 +- 0x57f000ad,
5503 +- 0x0076bb01,
5504 +- 0xf90465b6,
5505 +- 0x04659450,
5506 +- 0xbd0256bb,
5507 +- 0x0475fd50,
5508 +- 0x21f550fc,
5509 +- 0x64b60a9d,
5510 +- 0x8a11f504,
5511 +- 0x0076bb00,
5512 +- 0xf90465b6,
5513 +- 0x04659450,
5514 +- 0xbd0256bb,
5515 +- 0x0475fd50,
5516 +- 0x21f550fc,
5517 +- 0x64b609f0,
5518 +- 0x6a11f404,
5519 +- 0xbbe05bcb,
5520 +- 0x65b60076,
5521 +- 0x9450f904,
5522 +- 0x56bb0465,
5523 +- 0xfd50bd02,
5524 +- 0x50fc0475,
5525 +- 0x093521f5,
5526 +- 0xb90464b6,
5527 +- 0x74bd025b,
5528 +-/* 0x0c17: i2c_recv_not_rd08 */
5529 +- 0xb0430ef4,
5530 +- 0x1bf401d6,
5531 +- 0x0057f03d,
5532 +- 0x0a9d21f5,
5533 +- 0xc73311f4,
5534 +- 0x21f5e0c5,
5535 +- 0x11f40a42,
5536 +- 0x0057f029,
5537 +- 0x0a9d21f5,
5538 +- 0xc71f11f4,
5539 +- 0x21f5e0b5,
5540 +- 0x11f40a42,
5541 +- 0x3521f515,
5542 +- 0xc774bd09,
5543 +- 0x1bf408c5,
5544 +- 0x0232f409,
5545 +-/* 0x0c57: i2c_recv_not_wr08 */
5546 +-/* 0x0c57: i2c_recv_done */
5547 +- 0xc7030ef4,
5548 +- 0x21f5f8ce,
5549 +- 0xe0fc0b02,
5550 +- 0x12f4d0fc,
5551 +- 0x027cb90a,
5552 +- 0x033621f5,
5553 +-/* 0x0c6c: i2c_recv_exit */
5554 +-/* 0x0c6e: i2c_init */
5555 ++ 0x76bb008a,
5556 ++ 0x0465b600,
5557 ++ 0x659450f9,
5558 ++ 0x0256bb04,
5559 ++ 0x75fd50bd,
5560 ++ 0xf550fc04,
5561 ++ 0xb609e921,
5562 ++ 0x11f40464,
5563 ++ 0xe05bcb6a,
5564 ++ 0xb60076bb,
5565 ++ 0x50f90465,
5566 ++ 0xbb046594,
5567 ++ 0x50bd0256,
5568 ++ 0xfc0475fd,
5569 ++ 0x2e21f550,
5570 ++ 0x0464b609,
5571 ++ 0xbd025bb9,
5572 ++ 0x430ef474,
5573 ++/* 0x0c10: i2c_recv_not_rd08 */
5574 ++ 0xf401d6b0,
5575 ++ 0x57f03d1b,
5576 ++ 0x9621f500,
5577 ++ 0x3311f40a,
5578 ++ 0xf5e0c5c7,
5579 ++ 0xf40a3b21,
5580 ++ 0x57f02911,
5581 ++ 0x9621f500,
5582 ++ 0x1f11f40a,
5583 ++ 0xf5e0b5c7,
5584 ++ 0xf40a3b21,
5585 ++ 0x21f51511,
5586 ++ 0x74bd092e,
5587 ++ 0xf408c5c7,
5588 ++ 0x32f4091b,
5589 ++ 0x030ef402,
5590 ++/* 0x0c50: i2c_recv_not_wr08 */
5591 ++/* 0x0c50: i2c_recv_done */
5592 ++ 0xf5f8cec7,
5593 ++ 0xfc0afb21,
5594 ++ 0xf4d0fce0,
5595 ++ 0x7cb90a12,
5596 ++ 0x3621f502,
5597 ++/* 0x0c65: i2c_recv_exit */
5598 ++/* 0x0c67: i2c_init */
5599 ++ 0xf800f803,
5600 ++/* 0x0c69: test_recv */
5601 ++ 0xd817f100,
5602 ++ 0x0614b605,
5603 ++ 0xb60011cf,
5604 ++ 0x07f10110,
5605 ++ 0x04b605d8,
5606 ++ 0x0001d006,
5607 ++ 0xe7f104bd,
5608 ++ 0xe3f1d900,
5609 ++ 0x21f5134f,
5610 ++ 0x00f80256,
5611 ++/* 0x0c90: test_init */
5612 ++ 0x0800e7f1,
5613 ++ 0x025621f5,
5614 ++/* 0x0c9a: idle_recv */
5615 + 0x00f800f8,
5616 +-/* 0x0c70: test_recv */
5617 +- 0x05d817f1,
5618 +- 0xcf0614b6,
5619 +- 0x10b60011,
5620 +- 0xd807f101,
5621 +- 0x0604b605,
5622 +- 0xbd0001d0,
5623 +- 0x00e7f104,
5624 +- 0x4fe3f1d9,
5625 +- 0x5621f513,
5626 +-/* 0x0c97: test_init */
5627 +- 0xf100f802,
5628 +- 0xf50800e7,
5629 +- 0xf8025621,
5630 +-/* 0x0ca1: idle_recv */
5631 +-/* 0x0ca3: idle */
5632 +- 0xf400f800,
5633 +- 0x17f10031,
5634 +- 0x14b605d4,
5635 +- 0x0011cf06,
5636 +- 0xf10110b6,
5637 +- 0xb605d407,
5638 +- 0x01d00604,
5639 +-/* 0x0cbf: idle_loop */
5640 +- 0xf004bd00,
5641 +- 0x32f45817,
5642 +-/* 0x0cc5: idle_proc */
5643 +-/* 0x0cc5: idle_proc_exec */
5644 +- 0xb910f902,
5645 +- 0x21f5021e,
5646 +- 0x10fc033f,
5647 +- 0xf40911f4,
5648 +- 0x0ef40231,
5649 +-/* 0x0cd9: idle_proc_next */
5650 +- 0x5810b6ef,
5651 +- 0xf4061fb8,
5652 +- 0x02f4e61b,
5653 +- 0x0028f4dd,
5654 +- 0x00bb0ef4,
5655 ++/* 0x0c9c: idle */
5656 ++ 0xf10031f4,
5657 ++ 0xb605d417,
5658 ++ 0x11cf0614,
5659 ++ 0x0110b600,
5660 ++ 0x05d407f1,
5661 ++ 0xd00604b6,
5662 ++ 0x04bd0001,
5663 ++/* 0x0cb8: idle_loop */
5664 ++ 0xf45817f0,
5665 ++/* 0x0cbe: idle_proc */
5666 ++/* 0x0cbe: idle_proc_exec */
5667 ++ 0x10f90232,
5668 ++ 0xf5021eb9,
5669 ++ 0xfc033f21,
5670 ++ 0x0911f410,
5671 ++ 0xf40231f4,
5672 ++/* 0x0cd2: idle_proc_next */
5673 ++ 0x10b6ef0e,
5674 ++ 0x061fb858,
5675 ++ 0xf4e61bf4,
5676 ++ 0x28f4dd02,
5677 ++ 0xbb0ef400,
5678 ++ 0x00000000,
5679 ++ 0x00000000,
5680 + 0x00000000,
5681 + 0x00000000,
5682 + 0x00000000,
5683 +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
5684 +index ec03f9a4290b..1663bf943d77 100644
5685 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
5686 ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
5687 +@@ -82,15 +82,15 @@ memx_train_tail:
5688 + // $r0 - zero
5689 + memx_func_enter:
5690 + #if NVKM_PPWR_CHIPSET == GT215
5691 +- movw $r8 0x1610
5692 ++ mov $r8 0x1610
5693 + nv_rd32($r7, $r8)
5694 + imm32($r6, 0xfffffffc)
5695 + and $r7 $r6
5696 +- movw $r6 0x2
5697 ++ mov $r6 0x2
5698 + or $r7 $r6
5699 + nv_wr32($r8, $r7)
5700 + #else
5701 +- movw $r6 0x001620
5702 ++ mov $r6 0x001620
5703 + imm32($r7, ~0x00000aa2);
5704 + nv_rd32($r8, $r6)
5705 + and $r8 $r7
5706 +@@ -101,7 +101,7 @@ memx_func_enter:
5707 + and $r8 $r7
5708 + nv_wr32($r6, $r8)
5709 +
5710 +- movw $r6 0x0026f0
5711 ++ mov $r6 0x0026f0
5712 + nv_rd32($r8, $r6)
5713 + and $r8 $r7
5714 + nv_wr32($r6, $r8)
5715 +@@ -136,19 +136,19 @@ memx_func_leave:
5716 + bra nz #memx_func_leave_wait
5717 +
5718 + #if NVKM_PPWR_CHIPSET == GT215
5719 +- movw $r8 0x1610
5720 ++ mov $r8 0x1610
5721 + nv_rd32($r7, $r8)
5722 + imm32($r6, 0xffffffcc)
5723 + and $r7 $r6
5724 + nv_wr32($r8, $r7)
5725 + #else
5726 +- movw $r6 0x0026f0
5727 ++ mov $r6 0x0026f0
5728 + imm32($r7, 0x00000001)
5729 + nv_rd32($r8, $r6)
5730 + or $r8 $r7
5731 + nv_wr32($r6, $r8)
5732 +
5733 +- movw $r6 0x001620
5734 ++ mov $r6 0x001620
5735 + nv_rd32($r8, $r6)
5736 + or $r8 $r7
5737 + nv_wr32($r6, $r8)
5738 +@@ -177,11 +177,11 @@ memx_func_wait_vblank:
5739 + bra #memx_func_wait_vblank_fini
5740 +
5741 + memx_func_wait_vblank_head1:
5742 +- movw $r7 0x20
5743 ++ mov $r7 0x20
5744 + bra #memx_func_wait_vblank_0
5745 +
5746 + memx_func_wait_vblank_head0:
5747 +- movw $r7 0x8
5748 ++ mov $r7 0x8
5749 +
5750 + memx_func_wait_vblank_0:
5751 + nv_iord($r6, NV_PPWR_INPUT)
5752 +@@ -273,13 +273,13 @@ memx_func_train:
5753 + // $r5 - outer loop counter
5754 + // $r6 - inner loop counter
5755 + // $r7 - entry counter (#memx_train_head + $r7)
5756 +- movw $r5 0x3
5757 +- movw $r7 0x0
5758 ++ mov $r5 0x3
5759 ++ mov $r7 0x0
5760 +
5761 + // Read random memory to wake up... things
5762 + imm32($r9, 0x700000)
5763 + nv_rd32($r8,$r9)
5764 +- movw $r14 0x2710
5765 ++ mov $r14 0x2710
5766 + call(nsec)
5767 +
5768 + memx_func_train_loop_outer:
5769 +@@ -289,9 +289,9 @@ memx_func_train:
5770 + nv_wr32($r9, $r8)
5771 + push $r5
5772 +
5773 +- movw $r6 0x0
5774 ++ mov $r6 0x0
5775 + memx_func_train_loop_inner:
5776 +- movw $r8 0x1111
5777 ++ mov $r8 0x1111
5778 + mulu $r9 $r6 $r8
5779 + shl b32 $r8 $r9 0x10
5780 + or $r8 $r9
5781 +@@ -315,7 +315,7 @@ memx_func_train:
5782 +
5783 + // $r5 - inner inner loop counter
5784 + // $r9 - result
5785 +- movw $r5 0
5786 ++ mov $r5 0
5787 + imm32($r9, 0x8300ffff)
5788 + memx_func_train_loop_4x:
5789 + imm32($r10, 0x100080)
5790 +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
5791 +index 6f65846b1783..5b2a9f97ff04 100644
5792 +--- a/drivers/gpu/drm/panel/panel-simple.c
5793 ++++ b/drivers/gpu/drm/panel/panel-simple.c
5794 +@@ -1250,7 +1250,7 @@ static const struct panel_desc ontat_yx700wv03 = {
5795 + .width = 154,
5796 + .height = 83,
5797 + },
5798 +- .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
5799 ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X18,
5800 + };
5801 +
5802 + static const struct drm_display_mode ortustech_com43h4m85ulc_mode = {
5803 +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
5804 +index b70f9423379c..cab4d60060a0 100644
5805 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
5806 ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
5807 +@@ -64,7 +64,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
5808 + * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
5809 + */
5810 + vma->vm_flags &= ~VM_PFNMAP;
5811 +- vma->vm_pgoff = 0;
5812 +
5813 + ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
5814 + obj->size, rk_obj->dma_attrs);
5815 +@@ -96,6 +95,12 @@ int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
5816 + if (ret)
5817 + return ret;
5818 +
5819 ++ /*
5820 ++ * Set vm_pgoff (used as a fake buffer offset by DRM) to 0 and map the
5821 ++ * whole buffer from the start.
5822 ++ */
5823 ++ vma->vm_pgoff = 0;
5824 ++
5825 + obj = vma->vm_private_data;
5826 +
5827 + return rockchip_drm_gem_object_mmap(obj, vma);
5828 +diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
5829 +index d401156490f3..4460ca46a350 100644
5830 +--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c
5831 ++++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c
5832 +@@ -129,10 +129,13 @@ static int sun4i_dclk_get_phase(struct clk_hw *hw)
5833 + static int sun4i_dclk_set_phase(struct clk_hw *hw, int degrees)
5834 + {
5835 + struct sun4i_dclk *dclk = hw_to_dclk(hw);
5836 ++ u32 val = degrees / 120;
5837 ++
5838 ++ val <<= 28;
5839 +
5840 + regmap_update_bits(dclk->regmap, SUN4I_TCON0_IO_POL_REG,
5841 + GENMASK(29, 28),
5842 +- degrees / 120);
5843 ++ val);
5844 +
5845 + return 0;
5846 + }
5847 +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
5848 +index 818478b4c4f0..54639395aba0 100644
5849 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
5850 ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
5851 +@@ -194,6 +194,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
5852 + case VIRTGPU_PARAM_3D_FEATURES:
5853 + value = vgdev->has_virgl_3d == true ? 1 : 0;
5854 + break;
5855 ++ case VIRTGPU_PARAM_CAPSET_QUERY_FIX:
5856 ++ value = 1;
5857 ++ break;
5858 + default:
5859 + return -EINVAL;
5860 + }
5861 +@@ -469,7 +472,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
5862 + {
5863 + struct virtio_gpu_device *vgdev = dev->dev_private;
5864 + struct drm_virtgpu_get_caps *args = data;
5865 +- int size;
5866 ++ unsigned size, host_caps_size;
5867 + int i;
5868 + int found_valid = -1;
5869 + int ret;
5870 +@@ -478,6 +481,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
5871 + if (vgdev->num_capsets == 0)
5872 + return -ENOSYS;
5873 +
5874 ++ /* don't allow userspace to pass 0 */
5875 ++ if (args->size == 0)
5876 ++ return -EINVAL;
5877 ++
5878 + spin_lock(&vgdev->display_info_lock);
5879 + for (i = 0; i < vgdev->num_capsets; i++) {
5880 + if (vgdev->capsets[i].id == args->cap_set_id) {
5881 +@@ -493,11 +500,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev,
5882 + return -EINVAL;
5883 + }
5884 +
5885 +- size = vgdev->capsets[found_valid].max_size;
5886 +- if (args->size > size) {
5887 +- spin_unlock(&vgdev->display_info_lock);
5888 +- return -EINVAL;
5889 +- }
5890 ++ host_caps_size = vgdev->capsets[found_valid].max_size;
5891 ++ /* only copy to user the minimum of the host caps size or the guest caps size */
5892 ++ size = min(args->size, host_caps_size);
5893 +
5894 + list_for_each_entry(cache_ent, &vgdev->cap_cache, head) {
5895 + if (cache_ent->id == args->cap_set_id &&
5896 +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
5897 +index 557a033fb610..8545488aa0cf 100644
5898 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
5899 ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h
5900 +@@ -135,17 +135,24 @@
5901 +
5902 + #else
5903 +
5904 +-/* In the 32-bit version of this macro, we use "m" because there is no
5905 +- * more register left for bp
5906 ++/*
5907 ++ * In the 32-bit version of this macro, we store bp in a memory location
5908 ++ * because we've ran out of registers.
5909 ++ * Now we can't reference that memory location while we've modified
5910 ++ * %esp or %ebp, so we first push it on the stack, just before we push
5911 ++ * %ebp, and then when we need it we read it from the stack where we
5912 ++ * just pushed it.
5913 + */
5914 + #define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di, \
5915 + port_num, magic, bp, \
5916 + eax, ebx, ecx, edx, si, di) \
5917 + ({ \
5918 +- asm volatile ("push %%ebp;" \
5919 +- "mov %12, %%ebp;" \
5920 ++ asm volatile ("push %12;" \
5921 ++ "push %%ebp;" \
5922 ++ "mov 0x04(%%esp), %%ebp;" \
5923 + "rep outsb;" \
5924 +- "pop %%ebp;" : \
5925 ++ "pop %%ebp;" \
5926 ++ "add $0x04, %%esp;" : \
5927 + "=a"(eax), \
5928 + "=b"(ebx), \
5929 + "=c"(ecx), \
5930 +@@ -167,10 +174,12 @@
5931 + port_num, magic, bp, \
5932 + eax, ebx, ecx, edx, si, di) \
5933 + ({ \
5934 +- asm volatile ("push %%ebp;" \
5935 +- "mov %12, %%ebp;" \
5936 ++ asm volatile ("push %12;" \
5937 ++ "push %%ebp;" \
5938 ++ "mov 0x04(%%esp), %%ebp;" \
5939 + "rep insb;" \
5940 +- "pop %%ebp" : \
5941 ++ "pop %%ebp;" \
5942 ++ "add $0x04, %%esp;" : \
5943 + "=a"(eax), \
5944 + "=b"(ebx), \
5945 + "=c"(ecx), \
5946 +diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
5947 +index 43617fb28b87..317c9c2c0a7c 100644
5948 +--- a/drivers/hid/hid-roccat-kovaplus.c
5949 ++++ b/drivers/hid/hid-roccat-kovaplus.c
5950 +@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(uint value)
5951 + static void kovaplus_profile_activated(struct kovaplus_device *kovaplus,
5952 + uint new_profile_index)
5953 + {
5954 ++ if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings))
5955 ++ return;
5956 + kovaplus->actual_profile = new_profile_index;
5957 + kovaplus->actual_cpi = kovaplus->profile_settings[new_profile_index].cpi_startup_level;
5958 + kovaplus->actual_x_sensitivity = kovaplus->profile_settings[new_profile_index].sensitivity_x;
5959 +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
5960 +index ce75dd4db7eb..2b31b84d0a5b 100644
5961 +--- a/drivers/hwmon/nct6775.c
5962 ++++ b/drivers/hwmon/nct6775.c
5963 +@@ -1393,7 +1393,7 @@ static void nct6775_update_pwm(struct device *dev)
5964 + duty_is_dc = data->REG_PWM_MODE[i] &&
5965 + (nct6775_read_value(data, data->REG_PWM_MODE[i])
5966 + & data->PWM_MODE_MASK[i]);
5967 +- data->pwm_mode[i] = duty_is_dc;
5968 ++ data->pwm_mode[i] = !duty_is_dc;
5969 +
5970 + fanmodecfg = nct6775_read_value(data, data->REG_FAN_MODE[i]);
5971 + for (j = 0; j < ARRAY_SIZE(data->REG_PWM); j++) {
5972 +@@ -2270,7 +2270,7 @@ show_pwm_mode(struct device *dev, struct device_attribute *attr, char *buf)
5973 + struct nct6775_data *data = nct6775_update_device(dev);
5974 + struct sensor_device_attribute *sattr = to_sensor_dev_attr(attr);
5975 +
5976 +- return sprintf(buf, "%d\n", !data->pwm_mode[sattr->index]);
5977 ++ return sprintf(buf, "%d\n", data->pwm_mode[sattr->index]);
5978 + }
5979 +
5980 + static ssize_t
5981 +@@ -2291,9 +2291,9 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
5982 + if (val > 1)
5983 + return -EINVAL;
5984 +
5985 +- /* Setting DC mode is not supported for all chips/channels */
5986 ++ /* Setting DC mode (0) is not supported for all chips/channels */
5987 + if (data->REG_PWM_MODE[nr] == 0) {
5988 +- if (val)
5989 ++ if (!val)
5990 + return -EINVAL;
5991 + return count;
5992 + }
5993 +@@ -2302,7 +2302,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
5994 + data->pwm_mode[nr] = val;
5995 + reg = nct6775_read_value(data, data->REG_PWM_MODE[nr]);
5996 + reg &= ~data->PWM_MODE_MASK[nr];
5997 +- if (val)
5998 ++ if (!val)
5999 + reg |= data->PWM_MODE_MASK[nr];
6000 + nct6775_write_value(data, data->REG_PWM_MODE[nr], reg);
6001 + mutex_unlock(&data->update_lock);
6002 +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
6003 +index d659a02647d4..c3a8f682f834 100644
6004 +--- a/drivers/hwmon/pmbus/adm1275.c
6005 ++++ b/drivers/hwmon/pmbus/adm1275.c
6006 +@@ -154,7 +154,7 @@ static int adm1275_read_word_data(struct i2c_client *client, int page, int reg)
6007 + const struct adm1275_data *data = to_adm1275_data(info);
6008 + int ret = 0;
6009 +
6010 +- if (page)
6011 ++ if (page > 0)
6012 + return -ENXIO;
6013 +
6014 + switch (reg) {
6015 +@@ -240,7 +240,7 @@ static int adm1275_write_word_data(struct i2c_client *client, int page, int reg,
6016 + const struct adm1275_data *data = to_adm1275_data(info);
6017 + int ret;
6018 +
6019 +- if (page)
6020 ++ if (page > 0)
6021 + return -ENXIO;
6022 +
6023 + switch (reg) {
6024 +diff --git a/drivers/hwmon/pmbus/max8688.c b/drivers/hwmon/pmbus/max8688.c
6025 +index dd4883a19045..e951f9b87abb 100644
6026 +--- a/drivers/hwmon/pmbus/max8688.c
6027 ++++ b/drivers/hwmon/pmbus/max8688.c
6028 +@@ -45,7 +45,7 @@ static int max8688_read_word_data(struct i2c_client *client, int page, int reg)
6029 + {
6030 + int ret;
6031 +
6032 +- if (page)
6033 ++ if (page > 0)
6034 + return -ENXIO;
6035 +
6036 + switch (reg) {
6037 +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
6038 +index b4dec0841bc2..5c9dea7a40bc 100644
6039 +--- a/drivers/i2c/busses/i2c-mv64xxx.c
6040 ++++ b/drivers/i2c/busses/i2c-mv64xxx.c
6041 +@@ -848,12 +848,16 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
6042 + */
6043 + if (of_device_is_compatible(np, "marvell,mv78230-i2c")) {
6044 + drv_data->offload_enabled = true;
6045 +- drv_data->errata_delay = true;
6046 ++ /* The delay is only needed in standard mode (100kHz) */
6047 ++ if (bus_freq <= 100000)
6048 ++ drv_data->errata_delay = true;
6049 + }
6050 +
6051 + if (of_device_is_compatible(np, "marvell,mv78230-a0-i2c")) {
6052 + drv_data->offload_enabled = false;
6053 +- drv_data->errata_delay = true;
6054 ++ /* The delay is only needed in standard mode (100kHz) */
6055 ++ if (bus_freq <= 100000)
6056 ++ drv_data->errata_delay = true;
6057 + }
6058 +
6059 + if (of_device_is_compatible(np, "allwinner,sun6i-a31-i2c"))
6060 +diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
6061 +index bf9a2ad296ed..883fe2cdd42c 100644
6062 +--- a/drivers/ide/ide-cd.c
6063 ++++ b/drivers/ide/ide-cd.c
6064 +@@ -1593,6 +1593,8 @@ static int idecd_open(struct block_device *bdev, fmode_t mode)
6065 + struct cdrom_info *info;
6066 + int rc = -ENXIO;
6067 +
6068 ++ check_disk_change(bdev);
6069 ++
6070 + mutex_lock(&ide_cd_mutex);
6071 + info = ide_cd_get(bdev->bd_disk);
6072 + if (!info)
6073 +diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
6074 +index 322cb67b07a9..28d18453c950 100644
6075 +--- a/drivers/infiniband/core/multicast.c
6076 ++++ b/drivers/infiniband/core/multicast.c
6077 +@@ -724,21 +724,19 @@ int ib_init_ah_from_mcmember(struct ib_device *device, u8 port_num,
6078 + {
6079 + int ret;
6080 + u16 gid_index;
6081 +- u8 p;
6082 +-
6083 +- if (rdma_protocol_roce(device, port_num)) {
6084 +- ret = ib_find_cached_gid_by_port(device, &rec->port_gid,
6085 +- gid_type, port_num,
6086 +- ndev,
6087 +- &gid_index);
6088 +- } else if (rdma_protocol_ib(device, port_num)) {
6089 +- ret = ib_find_cached_gid(device, &rec->port_gid,
6090 +- IB_GID_TYPE_IB, NULL, &p,
6091 +- &gid_index);
6092 +- } else {
6093 +- ret = -EINVAL;
6094 +- }
6095 +
6096 ++ /* GID table is not based on the netdevice for IB link layer,
6097 ++ * so ignore ndev during search.
6098 ++ */
6099 ++ if (rdma_protocol_ib(device, port_num))
6100 ++ ndev = NULL;
6101 ++ else if (!rdma_protocol_roce(device, port_num))
6102 ++ return -EINVAL;
6103 ++
6104 ++ ret = ib_find_cached_gid_by_port(device, &rec->port_gid,
6105 ++ gid_type, port_num,
6106 ++ ndev,
6107 ++ &gid_index);
6108 + if (ret)
6109 + return ret;
6110 +
6111 +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
6112 +index 81b742ca1639..4baf3b864a57 100644
6113 +--- a/drivers/infiniband/core/sa_query.c
6114 ++++ b/drivers/infiniband/core/sa_query.c
6115 +@@ -1137,10 +1137,9 @@ int ib_init_ah_from_path(struct ib_device *device, u8 port_num,
6116 +
6117 + resolved_dev = dev_get_by_index(dev_addr.net,
6118 + dev_addr.bound_dev_if);
6119 +- if (resolved_dev->flags & IFF_LOOPBACK) {
6120 +- dev_put(resolved_dev);
6121 +- resolved_dev = idev;
6122 +- dev_hold(resolved_dev);
6123 ++ if (!resolved_dev) {
6124 ++ dev_put(idev);
6125 ++ return -ENODEV;
6126 + }
6127 + ndev = ib_get_ndev_from_path(rec);
6128 + rcu_read_lock();
6129 +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
6130 +index f2f1c9fec0b1..a036d7087ddf 100644
6131 +--- a/drivers/infiniband/core/ucma.c
6132 ++++ b/drivers/infiniband/core/ucma.c
6133 +@@ -1296,7 +1296,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
6134 + if (IS_ERR(ctx))
6135 + return PTR_ERR(ctx);
6136 +
6137 +- if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
6138 ++ if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
6139 + return -EINVAL;
6140 +
6141 + optval = memdup_user((void __user *) (unsigned long) cmd.optval,
6142 +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
6143 +index 7853b0caad32..148b313c6471 100644
6144 +--- a/drivers/infiniband/hw/hfi1/chip.c
6145 ++++ b/drivers/infiniband/hw/hfi1/chip.c
6146 +@@ -5860,6 +5860,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
6147 + u64 status;
6148 + u32 sw_index;
6149 + int i = 0;
6150 ++ unsigned long irq_flags;
6151 +
6152 + sw_index = dd->hw_to_sw[hw_context];
6153 + if (sw_index >= dd->num_send_contexts) {
6154 +@@ -5869,10 +5870,12 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
6155 + return;
6156 + }
6157 + sci = &dd->send_contexts[sw_index];
6158 ++ spin_lock_irqsave(&dd->sc_lock, irq_flags);
6159 + sc = sci->sc;
6160 + if (!sc) {
6161 + dd_dev_err(dd, "%s: context %u(%u): no sc?\n", __func__,
6162 + sw_index, hw_context);
6163 ++ spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
6164 + return;
6165 + }
6166 +
6167 +@@ -5894,6 +5897,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd,
6168 + */
6169 + if (sc->type != SC_USER)
6170 + queue_work(dd->pport->hfi1_wq, &sc->halt_work);
6171 ++ spin_unlock_irqrestore(&dd->sc_lock, irq_flags);
6172 +
6173 + /*
6174 + * Update the counters for the corresponding status bits.
6175 +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
6176 +index 4b892ca2b13a..095912fb3201 100644
6177 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
6178 ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
6179 +@@ -1515,6 +1515,7 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd,
6180 + err_code = -EOVERFLOW;
6181 + goto err;
6182 + }
6183 ++ stag &= ~I40IW_CQPSQ_STAG_KEY_MASK;
6184 + iwmr->stag = stag;
6185 + iwmr->ibmr.rkey = stag;
6186 + iwmr->ibmr.lkey = stag;
6187 +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
6188 +index 19bc1c2186ff..8d59a5905ee8 100644
6189 +--- a/drivers/infiniband/hw/mlx4/main.c
6190 ++++ b/drivers/infiniband/hw/mlx4/main.c
6191 +@@ -216,8 +216,6 @@ static int mlx4_ib_update_gids_v1_v2(struct gid_entry *gids,
6192 + gid_tbl[i].version = 2;
6193 + if (!ipv6_addr_v4mapped((struct in6_addr *)&gids[i].gid))
6194 + gid_tbl[i].type = 1;
6195 +- else
6196 +- memset(&gid_tbl[i].gid, 0, 12);
6197 + }
6198 + }
6199 +
6200 +@@ -363,8 +361,13 @@ static int mlx4_ib_del_gid(struct ib_device *device,
6201 + if (!gids) {
6202 + ret = -ENOMEM;
6203 + } else {
6204 +- for (i = 0; i < MLX4_MAX_PORT_GIDS; i++)
6205 +- memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid));
6206 ++ for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) {
6207 ++ memcpy(&gids[i].gid,
6208 ++ &port_gid_table->gids[i].gid,
6209 ++ sizeof(union ib_gid));
6210 ++ gids[i].gid_type =
6211 ++ port_gid_table->gids[i].gid_type;
6212 ++ }
6213 + }
6214 + }
6215 + spin_unlock_bh(&iboe->lock);
6216 +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
6217 +index 3cdcbfbd6a79..abb47e780070 100644
6218 +--- a/drivers/infiniband/hw/mlx5/qp.c
6219 ++++ b/drivers/infiniband/hw/mlx5/qp.c
6220 +@@ -2809,8 +2809,10 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
6221 + mlx5_ib_qp_disable_pagefaults(qp);
6222 +
6223 + if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE ||
6224 +- !optab[mlx5_cur][mlx5_new])
6225 ++ !optab[mlx5_cur][mlx5_new]) {
6226 ++ err = -EINVAL;
6227 + goto out;
6228 ++ }
6229 +
6230 + op = optab[mlx5_cur][mlx5_new];
6231 + optpar = ib_mask_to_mlx5_opt(attr_mask);
6232 +@@ -4610,13 +4612,10 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd)
6233 + int err;
6234 +
6235 + err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
6236 +- if (err) {
6237 ++ if (err)
6238 + mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
6239 +- return err;
6240 +- }
6241 +
6242 + kfree(xrcd);
6243 +-
6244 + return 0;
6245 + }
6246 +
6247 +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
6248 +index 58e92bce6825..f937873e93df 100644
6249 +--- a/drivers/infiniband/hw/qedr/main.c
6250 ++++ b/drivers/infiniband/hw/qedr/main.c
6251 +@@ -762,7 +762,8 @@ static struct qedr_dev *qedr_add(struct qed_dev *cdev, struct pci_dev *pdev,
6252 +
6253 + dev->num_cnq = dev->ops->rdma_get_min_cnq_msix(cdev);
6254 + if (!dev->num_cnq) {
6255 +- DP_ERR(dev, "not enough CNQ resources.\n");
6256 ++ DP_ERR(dev, "Failed. At least one CNQ is required.\n");
6257 ++ rc = -ENOMEM;
6258 + goto init_err;
6259 + }
6260 +
6261 +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
6262 +index 35d5b89decb4..cd0408c2b376 100644
6263 +--- a/drivers/infiniband/hw/qedr/verbs.c
6264 ++++ b/drivers/infiniband/hw/qedr/verbs.c
6265 +@@ -1888,18 +1888,23 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
6266 + SET_FIELD(qp_params.modify_flags,
6267 + QED_ROCE_MODIFY_QP_VALID_ACK_TIMEOUT, 1);
6268 +
6269 +- qp_params.ack_timeout = attr->timeout;
6270 +- if (attr->timeout) {
6271 +- u32 temp;
6272 +-
6273 +- temp = 4096 * (1UL << attr->timeout) / 1000 / 1000;
6274 +- /* FW requires [msec] */
6275 +- qp_params.ack_timeout = temp;
6276 +- } else {
6277 +- /* Infinite */
6278 ++ /* The received timeout value is an exponent used like this:
6279 ++ * "12.7.34 LOCAL ACK TIMEOUT
6280 ++ * Value representing the transport (ACK) timeout for use by
6281 ++ * the remote, expressed as: 4.096 * 2^timeout [usec]"
6282 ++ * The FW expects timeout in msec so we need to divide the usec
6283 ++ * result by 1000. We'll approximate 1000~2^10, and 4.096 ~ 2^2,
6284 ++ * so we get: 2^2 * 2^timeout / 2^10 = 2^(timeout - 8).
6285 ++ * The value of zero means infinite so we use a 'max_t' to make
6286 ++ * sure that sub 1 msec values will be configured as 1 msec.
6287 ++ */
6288 ++ if (attr->timeout)
6289 ++ qp_params.ack_timeout =
6290 ++ 1 << max_t(int, attr->timeout - 8, 0);
6291 ++ else
6292 + qp_params.ack_timeout = 0;
6293 +- }
6294 + }
6295 ++
6296 + if (attr_mask & IB_QP_RETRY_CNT) {
6297 + SET_FIELD(qp_params.modify_flags,
6298 + QED_ROCE_MODIFY_QP_VALID_RETRY_CNT, 1);
6299 +@@ -2807,6 +2812,11 @@ int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
6300 +
6301 + switch (wr->opcode) {
6302 + case IB_WR_SEND_WITH_IMM:
6303 ++ if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
6304 ++ rc = -EINVAL;
6305 ++ *bad_wr = wr;
6306 ++ break;
6307 ++ }
6308 + wqe->req_type = RDMA_SQ_REQ_TYPE_SEND_WITH_IMM;
6309 + swqe = (struct rdma_sq_send_wqe_1st *)wqe;
6310 + swqe->wqe_size = 2;
6311 +@@ -2848,6 +2858,11 @@ int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
6312 + break;
6313 +
6314 + case IB_WR_RDMA_WRITE_WITH_IMM:
6315 ++ if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) {
6316 ++ rc = -EINVAL;
6317 ++ *bad_wr = wr;
6318 ++ break;
6319 ++ }
6320 + wqe->req_type = RDMA_SQ_REQ_TYPE_RDMA_WR_WITH_IMM;
6321 + rwqe = (struct rdma_sq_rdma_wqe_1st *)wqe;
6322 +
6323 +@@ -3467,7 +3482,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
6324 + {
6325 + struct qedr_dev *dev = get_qedr_dev(ibcq->device);
6326 + struct qedr_cq *cq = get_qedr_cq(ibcq);
6327 +- union rdma_cqe *cqe = cq->latest_cqe;
6328 ++ union rdma_cqe *cqe;
6329 + u32 old_cons, new_cons;
6330 + unsigned long flags;
6331 + int update = 0;
6332 +@@ -3477,6 +3492,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
6333 + return qedr_gsi_poll_cq(ibcq, num_entries, wc);
6334 +
6335 + spin_lock_irqsave(&cq->cq_lock, flags);
6336 ++ cqe = cq->latest_cqe;
6337 + old_cons = qed_chain_get_cons_idx_u32(&cq->pbl);
6338 + while (num_entries && is_valid_cqe(cq, cqe)) {
6339 + struct qedr_qp *qp;
6340 +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
6341 +index 0df7d4504c06..17c5bc7e8957 100644
6342 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
6343 ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
6344 +@@ -2119,6 +2119,9 @@ static struct net_device *ipoib_add_port(const char *format,
6345 + goto event_failed;
6346 + }
6347 +
6348 ++ /* call event handler to ensure pkey in sync */
6349 ++ queue_work(ipoib_workqueue, &priv->flush_heavy);
6350 ++
6351 + result = register_netdev(priv->dev);
6352 + if (result) {
6353 + printk(KERN_WARNING "%s: couldn't register ipoib port %d; error %d\n",
6354 +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
6355 +index bee267424972..5cbf17aa8443 100644
6356 +--- a/drivers/input/mouse/psmouse-base.c
6357 ++++ b/drivers/input/mouse/psmouse-base.c
6358 +@@ -937,6 +937,21 @@ static void psmouse_apply_defaults(struct psmouse *psmouse)
6359 + psmouse->pt_deactivate = NULL;
6360 + }
6361 +
6362 ++static bool psmouse_do_detect(int (*detect)(struct psmouse *, bool),
6363 ++ struct psmouse *psmouse, bool allow_passthrough,
6364 ++ bool set_properties)
6365 ++{
6366 ++ if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU &&
6367 ++ !allow_passthrough) {
6368 ++ return false;
6369 ++ }
6370 ++
6371 ++ if (set_properties)
6372 ++ psmouse_apply_defaults(psmouse);
6373 ++
6374 ++ return detect(psmouse, set_properties) == 0;
6375 ++}
6376 ++
6377 + static bool psmouse_try_protocol(struct psmouse *psmouse,
6378 + enum psmouse_type type,
6379 + unsigned int *max_proto,
6380 +@@ -948,15 +963,8 @@ static bool psmouse_try_protocol(struct psmouse *psmouse,
6381 + if (!proto)
6382 + return false;
6383 +
6384 +- if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU &&
6385 +- !proto->try_passthru) {
6386 +- return false;
6387 +- }
6388 +-
6389 +- if (set_properties)
6390 +- psmouse_apply_defaults(psmouse);
6391 +-
6392 +- if (proto->detect(psmouse, set_properties) != 0)
6393 ++ if (!psmouse_do_detect(proto->detect, psmouse, proto->try_passthru,
6394 ++ set_properties))
6395 + return false;
6396 +
6397 + if (set_properties && proto->init && init_allowed) {
6398 +@@ -988,8 +996,8 @@ static int psmouse_extensions(struct psmouse *psmouse,
6399 + * Always check for focaltech, this is safe as it uses pnp-id
6400 + * matching.
6401 + */
6402 +- if (psmouse_try_protocol(psmouse, PSMOUSE_FOCALTECH,
6403 +- &max_proto, set_properties, false)) {
6404 ++ if (psmouse_do_detect(focaltech_detect,
6405 ++ psmouse, false, set_properties)) {
6406 + if (max_proto > PSMOUSE_IMEX &&
6407 + IS_ENABLED(CONFIG_MOUSE_PS2_FOCALTECH) &&
6408 + (!set_properties || focaltech_init(psmouse) == 0)) {
6409 +@@ -1035,8 +1043,8 @@ static int psmouse_extensions(struct psmouse *psmouse,
6410 + * probing for IntelliMouse.
6411 + */
6412 + if (max_proto > PSMOUSE_PS2 &&
6413 +- psmouse_try_protocol(psmouse, PSMOUSE_SYNAPTICS, &max_proto,
6414 +- set_properties, false)) {
6415 ++ psmouse_do_detect(synaptics_detect,
6416 ++ psmouse, false, set_properties)) {
6417 + synaptics_hardware = true;
6418 +
6419 + if (max_proto > PSMOUSE_IMEX) {
6420 +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
6421 +index 88bbc8ccc5e3..1612d3a22d42 100644
6422 +--- a/drivers/iommu/intel-iommu.c
6423 ++++ b/drivers/iommu/intel-iommu.c
6424 +@@ -1612,8 +1612,7 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu,
6425 + * flush. However, device IOTLB doesn't need to be flushed in this case.
6426 + */
6427 + if (!cap_caching_mode(iommu->cap) || !map)
6428 +- iommu_flush_dev_iotlb(get_iommu_domain(iommu, did),
6429 +- addr, mask);
6430 ++ iommu_flush_dev_iotlb(domain, addr, mask);
6431 + }
6432 +
6433 + static void iommu_disable_protect_mem_regions(struct intel_iommu *iommu)
6434 +diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
6435 +index aee1c60d7ab5..cc58b1b272c0 100644
6436 +--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
6437 ++++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
6438 +@@ -133,6 +133,8 @@ static int __init its_pci_of_msi_init(void)
6439 +
6440 + for (np = of_find_matching_node(NULL, its_device_id); np;
6441 + np = of_find_matching_node(np, its_device_id)) {
6442 ++ if (!of_device_is_available(np))
6443 ++ continue;
6444 + if (!of_property_read_bool(np, "msi-controller"))
6445 + continue;
6446 +
6447 +diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
6448 +index 470b4aa7d62c..e4768fcdc672 100644
6449 +--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
6450 ++++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
6451 +@@ -80,6 +80,8 @@ static int __init its_pmsi_init(void)
6452 +
6453 + for (np = of_find_matching_node(NULL, its_device_id); np;
6454 + np = of_find_matching_node(np, its_device_id)) {
6455 ++ if (!of_device_is_available(np))
6456 ++ continue;
6457 + if (!of_property_read_bool(np, "msi-controller"))
6458 + continue;
6459 +
6460 +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
6461 +index ac15e5d5d9b2..558c7589c329 100644
6462 +--- a/drivers/irqchip/irq-gic-v3-its.c
6463 ++++ b/drivers/irqchip/irq-gic-v3-its.c
6464 +@@ -1807,6 +1807,8 @@ static int __init its_of_probe(struct device_node *node)
6465 +
6466 + for (np = of_find_matching_node(node, its_device_id); np;
6467 + np = of_find_matching_node(np, its_device_id)) {
6468 ++ if (!of_device_is_available(np))
6469 ++ continue;
6470 + if (!of_property_read_bool(np, "msi-controller")) {
6471 + pr_warn("%s: no msi-controller property, ITS ignored\n",
6472 + np->full_name);
6473 +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
6474 +index 100c80e48190..0b1d5bdd0862 100644
6475 +--- a/drivers/irqchip/irq-gic-v3.c
6476 ++++ b/drivers/irqchip/irq-gic-v3.c
6477 +@@ -601,7 +601,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
6478 + MPIDR_TO_SGI_AFFINITY(cluster_id, 1) |
6479 + tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
6480 +
6481 +- pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
6482 ++ pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
6483 + gic_write_sgi1r(val);
6484 + }
6485 +
6486 +diff --git a/drivers/macintosh/rack-meter.c b/drivers/macintosh/rack-meter.c
6487 +index 775527135b93..25852e399ab2 100644
6488 +--- a/drivers/macintosh/rack-meter.c
6489 ++++ b/drivers/macintosh/rack-meter.c
6490 +@@ -154,8 +154,8 @@ static void rackmeter_do_pause(struct rackmeter *rm, int pause)
6491 + DBDMA_DO_STOP(rm->dma_regs);
6492 + return;
6493 + }
6494 +- memset(rdma->buf1, 0, ARRAY_SIZE(rdma->buf1));
6495 +- memset(rdma->buf2, 0, ARRAY_SIZE(rdma->buf2));
6496 ++ memset(rdma->buf1, 0, sizeof(rdma->buf1));
6497 ++ memset(rdma->buf2, 0, sizeof(rdma->buf2));
6498 +
6499 + rm->dma_buf_v->mark = 0;
6500 +
6501 +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
6502 +index d23337e8c4ee..dd344ee9e62b 100644
6503 +--- a/drivers/md/bcache/alloc.c
6504 ++++ b/drivers/md/bcache/alloc.c
6505 +@@ -284,8 +284,10 @@ do { \
6506 + break; \
6507 + \
6508 + mutex_unlock(&(ca)->set->bucket_lock); \
6509 +- if (kthread_should_stop()) \
6510 ++ if (kthread_should_stop()) { \
6511 ++ set_current_state(TASK_RUNNING); \
6512 + return 0; \
6513 ++ } \
6514 + \
6515 + schedule(); \
6516 + mutex_lock(&(ca)->set->bucket_lock); \
6517 +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
6518 +index 02619cabda8b..7fe7df56fa33 100644
6519 +--- a/drivers/md/bcache/bcache.h
6520 ++++ b/drivers/md/bcache/bcache.h
6521 +@@ -904,7 +904,7 @@ void bcache_write_super(struct cache_set *);
6522 +
6523 + int bch_flash_dev_create(struct cache_set *c, uint64_t size);
6524 +
6525 +-int bch_cached_dev_attach(struct cached_dev *, struct cache_set *);
6526 ++int bch_cached_dev_attach(struct cached_dev *, struct cache_set *, uint8_t *);
6527 + void bch_cached_dev_detach(struct cached_dev *);
6528 + void bch_cached_dev_run(struct cached_dev *);
6529 + void bcache_device_stop(struct bcache_device *);
6530 +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
6531 +index cac297f8170e..cf7c68920b33 100644
6532 +--- a/drivers/md/bcache/btree.c
6533 ++++ b/drivers/md/bcache/btree.c
6534 +@@ -1864,14 +1864,17 @@ void bch_initial_gc_finish(struct cache_set *c)
6535 + */
6536 + for_each_cache(ca, c, i) {
6537 + for_each_bucket(b, ca) {
6538 +- if (fifo_full(&ca->free[RESERVE_PRIO]))
6539 ++ if (fifo_full(&ca->free[RESERVE_PRIO]) &&
6540 ++ fifo_full(&ca->free[RESERVE_BTREE]))
6541 + break;
6542 +
6543 + if (bch_can_invalidate_bucket(ca, b) &&
6544 + !GC_MARK(b)) {
6545 + __bch_invalidate_one_bucket(ca, b);
6546 +- fifo_push(&ca->free[RESERVE_PRIO],
6547 +- b - ca->buckets);
6548 ++ if (!fifo_push(&ca->free[RESERVE_PRIO],
6549 ++ b - ca->buckets))
6550 ++ fifo_push(&ca->free[RESERVE_BTREE],
6551 ++ b - ca->buckets);
6552 + }
6553 + }
6554 + }
6555 +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
6556 +index edb8d1a1a69f..bd6f6f4b4256 100644
6557 +--- a/drivers/md/bcache/request.c
6558 ++++ b/drivers/md/bcache/request.c
6559 +@@ -633,11 +633,11 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio)
6560 + static void search_free(struct closure *cl)
6561 + {
6562 + struct search *s = container_of(cl, struct search, cl);
6563 +- bio_complete(s);
6564 +
6565 + if (s->iop.bio)
6566 + bio_put(s->iop.bio);
6567 +
6568 ++ bio_complete(s);
6569 + closure_debug_destroy(cl);
6570 + mempool_free(s, s->d->c->search);
6571 + }
6572 +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
6573 +index 4af7cd423c71..894992ae9be0 100644
6574 +--- a/drivers/md/bcache/super.c
6575 ++++ b/drivers/md/bcache/super.c
6576 +@@ -938,7 +938,8 @@ void bch_cached_dev_detach(struct cached_dev *dc)
6577 + cached_dev_put(dc);
6578 + }
6579 +
6580 +-int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
6581 ++int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
6582 ++ uint8_t *set_uuid)
6583 + {
6584 + uint32_t rtime = cpu_to_le32(get_seconds());
6585 + struct uuid_entry *u;
6586 +@@ -947,7 +948,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
6587 +
6588 + bdevname(dc->bdev, buf);
6589 +
6590 +- if (memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16))
6591 ++ if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
6592 ++ (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
6593 + return -ENOENT;
6594 +
6595 + if (dc->disk.c) {
6596 +@@ -1191,7 +1193,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
6597 +
6598 + list_add(&dc->list, &uncached_devices);
6599 + list_for_each_entry(c, &bch_cache_sets, list)
6600 +- bch_cached_dev_attach(dc, c);
6601 ++ bch_cached_dev_attach(dc, c, NULL);
6602 +
6603 + if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE ||
6604 + BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
6605 +@@ -1714,7 +1716,7 @@ static void run_cache_set(struct cache_set *c)
6606 + bcache_write_super(c);
6607 +
6608 + list_for_each_entry_safe(dc, t, &uncached_devices, list)
6609 +- bch_cached_dev_attach(dc, c);
6610 ++ bch_cached_dev_attach(dc, c, NULL);
6611 +
6612 + flash_devs_run(c);
6613 +
6614 +@@ -1831,6 +1833,7 @@ void bch_cache_release(struct kobject *kobj)
6615 + static int cache_alloc(struct cache *ca)
6616 + {
6617 + size_t free;
6618 ++ size_t btree_buckets;
6619 + struct bucket *b;
6620 +
6621 + __module_get(THIS_MODULE);
6622 +@@ -1840,9 +1843,19 @@ static int cache_alloc(struct cache *ca)
6623 + ca->journal.bio.bi_max_vecs = 8;
6624 + ca->journal.bio.bi_io_vec = ca->journal.bio.bi_inline_vecs;
6625 +
6626 ++ /*
6627 ++ * when ca->sb.njournal_buckets is not zero, journal exists,
6628 ++ * and in bch_journal_replay(), tree node may split,
6629 ++ * so bucket of RESERVE_BTREE type is needed,
6630 ++ * the worst situation is all journal buckets are valid journal,
6631 ++ * and all the keys need to replay,
6632 ++ * so the number of RESERVE_BTREE type buckets should be as much
6633 ++ * as journal buckets
6634 ++ */
6635 ++ btree_buckets = ca->sb.njournal_buckets ?: 8;
6636 + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
6637 +
6638 +- if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
6639 ++ if (!init_fifo(&ca->free[RESERVE_BTREE], btree_buckets, GFP_KERNEL) ||
6640 + !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
6641 + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
6642 + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
6643 +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
6644 +index 4fbb5532f24c..5a5c1f1bd8a5 100644
6645 +--- a/drivers/md/bcache/sysfs.c
6646 ++++ b/drivers/md/bcache/sysfs.c
6647 +@@ -191,7 +191,7 @@ STORE(__cached_dev)
6648 + {
6649 + struct cached_dev *dc = container_of(kobj, struct cached_dev,
6650 + disk.kobj);
6651 +- ssize_t v = size;
6652 ++ ssize_t v;
6653 + struct cache_set *c;
6654 + struct kobj_uevent_env *env;
6655 +
6656 +@@ -263,17 +263,20 @@ STORE(__cached_dev)
6657 + }
6658 +
6659 + if (attr == &sysfs_attach) {
6660 +- if (bch_parse_uuid(buf, dc->sb.set_uuid) < 16)
6661 ++ uint8_t set_uuid[16];
6662 ++
6663 ++ if (bch_parse_uuid(buf, set_uuid) < 16)
6664 + return -EINVAL;
6665 +
6666 ++ v = -ENOENT;
6667 + list_for_each_entry(c, &bch_cache_sets, list) {
6668 +- v = bch_cached_dev_attach(dc, c);
6669 ++ v = bch_cached_dev_attach(dc, c, set_uuid);
6670 + if (!v)
6671 + return size;
6672 + }
6673 +
6674 + pr_err("Can't attach %s: cache set not found", buf);
6675 +- size = v;
6676 ++ return v;
6677 + }
6678 +
6679 + if (attr == &sysfs_detach && dc->disk.c)
6680 +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
6681 +index 4ce2b19fe120..bb7aa31c2a08 100644
6682 +--- a/drivers/md/bcache/writeback.c
6683 ++++ b/drivers/md/bcache/writeback.c
6684 +@@ -420,18 +420,27 @@ static int bch_writeback_thread(void *arg)
6685 +
6686 + while (!kthread_should_stop()) {
6687 + down_write(&dc->writeback_lock);
6688 +- if (!atomic_read(&dc->has_dirty) ||
6689 +- (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) &&
6690 +- !dc->writeback_running)) {
6691 ++ set_current_state(TASK_INTERRUPTIBLE);
6692 ++ /*
6693 ++ * If the bache device is detaching, skip here and continue
6694 ++ * to perform writeback. Otherwise, if no dirty data on cache,
6695 ++ * or there is dirty data on cache but writeback is disabled,
6696 ++ * the writeback thread should sleep here and wait for others
6697 ++ * to wake up it.
6698 ++ */
6699 ++ if (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) &&
6700 ++ (!atomic_read(&dc->has_dirty) || !dc->writeback_running)) {
6701 + up_write(&dc->writeback_lock);
6702 +- set_current_state(TASK_INTERRUPTIBLE);
6703 +
6704 +- if (kthread_should_stop())
6705 ++ if (kthread_should_stop()) {
6706 ++ set_current_state(TASK_RUNNING);
6707 + return 0;
6708 ++ }
6709 +
6710 + schedule();
6711 + continue;
6712 + }
6713 ++ set_current_state(TASK_RUNNING);
6714 +
6715 + searched_full_index = refill_dirty(dc);
6716 +
6717 +@@ -441,6 +450,14 @@ static int bch_writeback_thread(void *arg)
6718 + cached_dev_put(dc);
6719 + SET_BDEV_STATE(&dc->sb, BDEV_STATE_CLEAN);
6720 + bch_write_bdev_super(dc, NULL);
6721 ++ /*
6722 ++ * If bcache device is detaching via sysfs interface,
6723 ++ * writeback thread should stop after there is no dirty
6724 ++ * data on cache. BCACHE_DEV_DETACHING flag is set in
6725 ++ * bch_cached_dev_detach().
6726 ++ */
6727 ++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
6728 ++ break;
6729 + }
6730 +
6731 + up_write(&dc->writeback_lock);
6732 +diff --git a/drivers/md/md.c b/drivers/md/md.c
6733 +index a7bc70334f0e..cae8f3c12e32 100644
6734 +--- a/drivers/md/md.c
6735 ++++ b/drivers/md/md.c
6736 +@@ -8200,6 +8200,19 @@ void md_do_sync(struct md_thread *thread)
6737 + set_mask_bits(&mddev->flags, 0,
6738 + BIT(MD_CHANGE_PENDING) | BIT(MD_CHANGE_DEVS));
6739 +
6740 ++ if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
6741 ++ !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
6742 ++ mddev->delta_disks > 0 &&
6743 ++ mddev->pers->finish_reshape &&
6744 ++ mddev->pers->size &&
6745 ++ mddev->queue) {
6746 ++ mddev_lock_nointr(mddev);
6747 ++ md_set_array_sectors(mddev, mddev->pers->size(mddev, 0, 0));
6748 ++ mddev_unlock(mddev);
6749 ++ set_capacity(mddev->gendisk, mddev->array_sectors);
6750 ++ revalidate_disk(mddev->gendisk);
6751 ++ }
6752 ++
6753 + spin_lock(&mddev->lock);
6754 + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
6755 + /* We completed so min/max setting can be forgotten if used. */
6756 +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
6757 +index 81a78757bc78..998102697619 100644
6758 +--- a/drivers/md/raid1.c
6759 ++++ b/drivers/md/raid1.c
6760 +@@ -1673,6 +1673,17 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
6761 + struct md_rdev *repl =
6762 + conf->mirrors[conf->raid_disks + number].rdev;
6763 + freeze_array(conf, 0);
6764 ++ if (atomic_read(&repl->nr_pending)) {
6765 ++ /* It means that some queued IO of retry_list
6766 ++ * hold repl. Thus, we cannot set replacement
6767 ++ * as NULL, avoiding rdev NULL pointer
6768 ++ * dereference in sync_request_write and
6769 ++ * handle_write_finished.
6770 ++ */
6771 ++ err = -EBUSY;
6772 ++ unfreeze_array(conf);
6773 ++ goto abort;
6774 ++ }
6775 + clear_bit(Replacement, &repl->flags);
6776 + p->rdev = repl;
6777 + conf->mirrors[conf->raid_disks + number].rdev = NULL;
6778 +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
6779 +index 6a7b9b1dcfe3..b138b5cba286 100644
6780 +--- a/drivers/md/raid10.c
6781 ++++ b/drivers/md/raid10.c
6782 +@@ -2636,7 +2636,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
6783 + for (m = 0; m < conf->copies; m++) {
6784 + int dev = r10_bio->devs[m].devnum;
6785 + rdev = conf->mirrors[dev].rdev;
6786 +- if (r10_bio->devs[m].bio == NULL)
6787 ++ if (r10_bio->devs[m].bio == NULL ||
6788 ++ r10_bio->devs[m].bio->bi_end_io == NULL)
6789 + continue;
6790 + if (!r10_bio->devs[m].bio->bi_error) {
6791 + rdev_clear_badblocks(
6792 +@@ -2651,7 +2652,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
6793 + md_error(conf->mddev, rdev);
6794 + }
6795 + rdev = conf->mirrors[dev].replacement;
6796 +- if (r10_bio->devs[m].repl_bio == NULL)
6797 ++ if (r10_bio->devs[m].repl_bio == NULL ||
6798 ++ r10_bio->devs[m].repl_bio->bi_end_io == NULL)
6799 + continue;
6800 +
6801 + if (!r10_bio->devs[m].repl_bio->bi_error) {
6802 +@@ -4682,17 +4684,11 @@ static void raid10_finish_reshape(struct mddev *mddev)
6803 + return;
6804 +
6805 + if (mddev->delta_disks > 0) {
6806 +- sector_t size = raid10_size(mddev, 0, 0);
6807 +- md_set_array_sectors(mddev, size);
6808 + if (mddev->recovery_cp > mddev->resync_max_sectors) {
6809 + mddev->recovery_cp = mddev->resync_max_sectors;
6810 + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
6811 + }
6812 +- mddev->resync_max_sectors = size;
6813 +- if (mddev->queue) {
6814 +- set_capacity(mddev->gendisk, mddev->array_sectors);
6815 +- revalidate_disk(mddev->gendisk);
6816 +- }
6817 ++ mddev->resync_max_sectors = mddev->array_sectors;
6818 + } else {
6819 + int d;
6820 + rcu_read_lock();
6821 +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
6822 +index 86ba7851e881..e43b9f80bb1d 100644
6823 +--- a/drivers/md/raid5.c
6824 ++++ b/drivers/md/raid5.c
6825 +@@ -2049,15 +2049,16 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
6826 + static int grow_stripes(struct r5conf *conf, int num)
6827 + {
6828 + struct kmem_cache *sc;
6829 ++ size_t namelen = sizeof(conf->cache_name[0]);
6830 + int devs = max(conf->raid_disks, conf->previous_raid_disks);
6831 +
6832 + if (conf->mddev->gendisk)
6833 +- sprintf(conf->cache_name[0],
6834 ++ snprintf(conf->cache_name[0], namelen,
6835 + "raid%d-%s", conf->level, mdname(conf->mddev));
6836 + else
6837 +- sprintf(conf->cache_name[0],
6838 ++ snprintf(conf->cache_name[0], namelen,
6839 + "raid%d-%p", conf->level, conf->mddev);
6840 +- sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
6841 ++ snprintf(conf->cache_name[1], namelen, "%.27s-alt", conf->cache_name[0]);
6842 +
6843 + conf->active_name = 0;
6844 + sc = kmem_cache_create(conf->cache_name[conf->active_name],
6845 +@@ -7614,13 +7615,7 @@ static void raid5_finish_reshape(struct mddev *mddev)
6846 +
6847 + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
6848 +
6849 +- if (mddev->delta_disks > 0) {
6850 +- md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
6851 +- if (mddev->queue) {
6852 +- set_capacity(mddev->gendisk, mddev->array_sectors);
6853 +- revalidate_disk(mddev->gendisk);
6854 +- }
6855 +- } else {
6856 ++ if (mddev->delta_disks <= 0) {
6857 + int d;
6858 + spin_lock_irq(&conf->device_lock);
6859 + mddev->degraded = calc_degraded(conf);
6860 +diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
6861 +index 50dd6bd02951..524c8e0b72fd 100644
6862 +--- a/drivers/mmc/host/sdhci-iproc.c
6863 ++++ b/drivers/mmc/host/sdhci-iproc.c
6864 +@@ -33,6 +33,8 @@ struct sdhci_iproc_host {
6865 + const struct sdhci_iproc_data *data;
6866 + u32 shadow_cmd;
6867 + u32 shadow_blk;
6868 ++ bool is_cmd_shadowed;
6869 ++ bool is_blk_shadowed;
6870 + };
6871 +
6872 + #define REG_OFFSET_IN_BITS(reg) ((reg) << 3 & 0x18)
6873 +@@ -48,8 +50,22 @@ static inline u32 sdhci_iproc_readl(struct sdhci_host *host, int reg)
6874 +
6875 + static u16 sdhci_iproc_readw(struct sdhci_host *host, int reg)
6876 + {
6877 +- u32 val = sdhci_iproc_readl(host, (reg & ~3));
6878 +- u16 word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff;
6879 ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
6880 ++ struct sdhci_iproc_host *iproc_host = sdhci_pltfm_priv(pltfm_host);
6881 ++ u32 val;
6882 ++ u16 word;
6883 ++
6884 ++ if ((reg == SDHCI_TRANSFER_MODE) && iproc_host->is_cmd_shadowed) {
6885 ++ /* Get the saved transfer mode */
6886 ++ val = iproc_host->shadow_cmd;
6887 ++ } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) &&
6888 ++ iproc_host->is_blk_shadowed) {
6889 ++ /* Get the saved block info */
6890 ++ val = iproc_host->shadow_blk;
6891 ++ } else {
6892 ++ val = sdhci_iproc_readl(host, (reg & ~3));
6893 ++ }
6894 ++ word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff;
6895 + return word;
6896 + }
6897 +
6898 +@@ -105,13 +121,15 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg)
6899 +
6900 + if (reg == SDHCI_COMMAND) {
6901 + /* Write the block now as we are issuing a command */
6902 +- if (iproc_host->shadow_blk != 0) {
6903 ++ if (iproc_host->is_blk_shadowed) {
6904 + sdhci_iproc_writel(host, iproc_host->shadow_blk,
6905 + SDHCI_BLOCK_SIZE);
6906 +- iproc_host->shadow_blk = 0;
6907 ++ iproc_host->is_blk_shadowed = false;
6908 + }
6909 + oldval = iproc_host->shadow_cmd;
6910 +- } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) {
6911 ++ iproc_host->is_cmd_shadowed = false;
6912 ++ } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) &&
6913 ++ iproc_host->is_blk_shadowed) {
6914 + /* Block size and count are stored in shadow reg */
6915 + oldval = iproc_host->shadow_blk;
6916 + } else {
6917 +@@ -123,9 +141,11 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg)
6918 + if (reg == SDHCI_TRANSFER_MODE) {
6919 + /* Save the transfer mode until the command is issued */
6920 + iproc_host->shadow_cmd = newval;
6921 ++ iproc_host->is_cmd_shadowed = true;
6922 + } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) {
6923 + /* Save the block info until the command is issued */
6924 + iproc_host->shadow_blk = newval;
6925 ++ iproc_host->is_blk_shadowed = true;
6926 + } else {
6927 + /* Command or other regular 32-bit write */
6928 + sdhci_iproc_writel(host, newval, reg & ~3);
6929 +@@ -176,7 +196,6 @@ static const struct sdhci_iproc_data iproc_data = {
6930 + .caps1 = SDHCI_DRIVER_TYPE_C |
6931 + SDHCI_DRIVER_TYPE_D |
6932 + SDHCI_SUPPORT_DDR50,
6933 +- .mmc_caps = MMC_CAP_1_8V_DDR,
6934 + };
6935 +
6936 + static const struct sdhci_pltfm_data sdhci_bcm2835_pltfm_data = {
6937 +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
6938 +index 49f4cafe5438..86a32fe58468 100644
6939 +--- a/drivers/net/ethernet/broadcom/bgmac.c
6940 ++++ b/drivers/net/ethernet/broadcom/bgmac.c
6941 +@@ -529,7 +529,8 @@ static void bgmac_dma_tx_ring_free(struct bgmac *bgmac,
6942 + int i;
6943 +
6944 + for (i = 0; i < BGMAC_TX_RING_SLOTS; i++) {
6945 +- int len = dma_desc[i].ctl1 & BGMAC_DESC_CTL1_LEN;
6946 ++ u32 ctl1 = le32_to_cpu(dma_desc[i].ctl1);
6947 ++ unsigned int len = ctl1 & BGMAC_DESC_CTL1_LEN;
6948 +
6949 + slot = &ring->slots[i];
6950 + dev_kfree_skb(slot->skb);
6951 +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
6952 +index 3aa993bbafd9..ca57eb56c717 100644
6953 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
6954 ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
6955 +@@ -3401,6 +3401,9 @@ static int bnxt_hwrm_vnic_set_tpa(struct bnxt *bp, u16 vnic_id, u32 tpa_flags)
6956 + struct bnxt_vnic_info *vnic = &bp->vnic_info[vnic_id];
6957 + struct hwrm_vnic_tpa_cfg_input req = {0};
6958 +
6959 ++ if (vnic->fw_vnic_id == INVALID_HW_RING_ID)
6960 ++ return 0;
6961 ++
6962 + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_VNIC_TPA_CFG, -1, -1);
6963 +
6964 + if (tpa_flags) {
6965 +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
6966 +index 3ec32d7c5866..c395b21cb57b 100644
6967 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
6968 ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
6969 +@@ -836,8 +836,6 @@ static int setup_fw_sge_queues(struct adapter *adap)
6970 +
6971 + err = t4_sge_alloc_rxq(adap, &s->fw_evtq, true, adap->port[0],
6972 + adap->msi_idx, NULL, fwevtq_handler, NULL, -1);
6973 +- if (err)
6974 +- t4_free_sge_resources(adap);
6975 + return err;
6976 + }
6977 +
6978 +@@ -4940,6 +4938,13 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
6979 + if (err)
6980 + goto out_free_dev;
6981 +
6982 ++ err = setup_fw_sge_queues(adapter);
6983 ++ if (err) {
6984 ++ dev_err(adapter->pdev_dev,
6985 ++ "FW sge queue allocation failed, err %d", err);
6986 ++ goto out_free_dev;
6987 ++ }
6988 ++
6989 + /*
6990 + * The card is now ready to go. If any errors occur during device
6991 + * registration we do not fail the whole card but rather proceed only
6992 +@@ -4983,7 +4988,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
6993 + }
6994 +
6995 + print_adapter_info(adapter);
6996 +- setup_fw_sge_queues(adapter);
6997 + return 0;
6998 +
6999 + sriov:
7000 +@@ -5035,6 +5039,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
7001 + #endif
7002 +
7003 + out_free_dev:
7004 ++ t4_free_sge_resources(adapter);
7005 + free_some_resources(adapter);
7006 + if (adapter->flags & USING_MSIX)
7007 + free_msix_info(adapter);
7008 +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
7009 +index 2471ff465d5c..23d6c44dc459 100644
7010 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
7011 ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c
7012 +@@ -342,6 +342,7 @@ static void free_queues_uld(struct adapter *adap, unsigned int uld_type)
7013 + {
7014 + struct sge_uld_rxq_info *rxq_info = adap->sge.uld_rxq_info[uld_type];
7015 +
7016 ++ adap->sge.uld_rxq_info[uld_type] = NULL;
7017 + kfree(rxq_info->rspq_id);
7018 + kfree(rxq_info->uldrxq);
7019 + kfree(rxq_info);
7020 +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
7021 +index 48f82ab6c25b..dda63b26e370 100644
7022 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c
7023 ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
7024 +@@ -1726,6 +1726,8 @@ static int enic_open(struct net_device *netdev)
7025 + }
7026 +
7027 + for (i = 0; i < enic->rq_count; i++) {
7028 ++ /* enable rq before updating rq desc */
7029 ++ vnic_rq_enable(&enic->rq[i]);
7030 + vnic_rq_fill(&enic->rq[i], enic_rq_alloc_buf);
7031 + /* Need at least one buffer on ring to get going */
7032 + if (vnic_rq_desc_used(&enic->rq[i]) == 0) {
7033 +@@ -1737,8 +1739,6 @@ static int enic_open(struct net_device *netdev)
7034 +
7035 + for (i = 0; i < enic->wq_count; i++)
7036 + vnic_wq_enable(&enic->wq[i]);
7037 +- for (i = 0; i < enic->rq_count; i++)
7038 +- vnic_rq_enable(&enic->rq[i]);
7039 +
7040 + if (!enic_is_dynamic(enic) && !enic_is_sriov_vf(enic))
7041 + enic_dev_add_station_addr(enic);
7042 +@@ -1765,8 +1765,12 @@ static int enic_open(struct net_device *netdev)
7043 + return 0;
7044 +
7045 + err_out_free_rq:
7046 +- for (i = 0; i < enic->rq_count; i++)
7047 ++ for (i = 0; i < enic->rq_count; i++) {
7048 ++ err = vnic_rq_disable(&enic->rq[i]);
7049 ++ if (err)
7050 ++ return err;
7051 + vnic_rq_clean(&enic->rq[i], enic_free_rq_buf);
7052 ++ }
7053 + enic_dev_notify_unset(enic);
7054 + err_out_free_intr:
7055 + enic_unset_affinity_hint(enic);
7056 +diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
7057 +index c88918c4c5f3..641b916f122b 100644
7058 +--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
7059 ++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
7060 +@@ -1036,7 +1036,7 @@ int dtsec_add_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr)
7061 + set_bucket(dtsec->regs, bucket, true);
7062 +
7063 + /* Create element to be added to the driver hash table */
7064 +- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
7065 ++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
7066 + if (!hash_entry)
7067 + return -ENOMEM;
7068 + hash_entry->addr = addr;
7069 +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
7070 +index e3b41ba95168..60bd1b36df60 100644
7071 +--- a/drivers/net/ethernet/freescale/gianfar.c
7072 ++++ b/drivers/net/ethernet/freescale/gianfar.c
7073 +@@ -2935,7 +2935,7 @@ static irqreturn_t gfar_transmit(int irq, void *grp_id)
7074 + static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
7075 + struct sk_buff *skb, bool first)
7076 + {
7077 +- unsigned int size = lstatus & BD_LENGTH_MASK;
7078 ++ int size = lstatus & BD_LENGTH_MASK;
7079 + struct page *page = rxb->page;
7080 + bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
7081 +
7082 +@@ -2950,11 +2950,16 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
7083 + if (last)
7084 + size -= skb->len;
7085 +
7086 +- /* in case the last fragment consisted only of the FCS */
7087 ++ /* Add the last fragment if it contains something other than
7088 ++ * the FCS, otherwise drop it and trim off any part of the FCS
7089 ++ * that was already received.
7090 ++ */
7091 + if (size > 0)
7092 + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
7093 + rxb->page_offset + RXBUF_ALIGNMENT,
7094 + size, GFAR_RXB_TRUESIZE);
7095 ++ else if (size < 0)
7096 ++ pskb_trim(skb, skb->len + size);
7097 + }
7098 +
7099 + /* try reuse page */
7100 +@@ -3070,9 +3075,6 @@ static void gfar_process_frame(struct net_device *ndev, struct sk_buff *skb)
7101 + if (ndev->features & NETIF_F_RXCSUM)
7102 + gfar_rx_checksum(skb, fcb);
7103 +
7104 +- /* Tell the skb what kind of packet this is */
7105 +- skb->protocol = eth_type_trans(skb, ndev);
7106 +-
7107 + /* There's need to check for NETIF_F_HW_VLAN_CTAG_RX here.
7108 + * Even if vlan rx accel is disabled, on some chips
7109 + * RXFCB_VLN is pseudo randomly set.
7110 +@@ -3143,13 +3145,15 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
7111 + continue;
7112 + }
7113 +
7114 ++ gfar_process_frame(ndev, skb);
7115 ++
7116 + /* Increment the number of packets */
7117 + total_pkts++;
7118 + total_bytes += skb->len;
7119 +
7120 + skb_record_rx_queue(skb, rx_queue->qindex);
7121 +
7122 +- gfar_process_frame(ndev, skb);
7123 ++ skb->protocol = eth_type_trans(skb, ndev);
7124 +
7125 + /* Send the packet up the stack */
7126 + napi_gro_receive(&rx_queue->grp->napi_rx, skb);
7127 +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
7128 +index 49094c965697..897a87ae8655 100644
7129 +--- a/drivers/net/ethernet/ibm/ibmvnic.c
7130 ++++ b/drivers/net/ethernet/ibm/ibmvnic.c
7131 +@@ -994,6 +994,7 @@ static int ibmvnic_poll(struct napi_struct *napi, int budget)
7132 + netdev_err(netdev, "rx error %x\n", next->rx_comp.rc);
7133 + /* free the entry */
7134 + next->rx_comp.first = 0;
7135 ++ dev_kfree_skb_any(rx_buff->skb);
7136 + remove_buff_from_pool(adapter, rx_buff);
7137 + break;
7138 + }
7139 +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
7140 +index 8a48656a376b..7ddac956ffb5 100644
7141 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
7142 ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
7143 +@@ -1600,7 +1600,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
7144 + * we have already determined whether we have link or not.
7145 + */
7146 + if (!mac->autoneg)
7147 +- return -E1000_ERR_CONFIG;
7148 ++ return 1;
7149 +
7150 + /* Auto-Neg is enabled. Auto Speed Detection takes care
7151 + * of MAC speed/duplex configuration. So we only need to
7152 +diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
7153 +index f457c5703d0c..db735644b312 100644
7154 +--- a/drivers/net/ethernet/intel/e1000e/mac.c
7155 ++++ b/drivers/net/ethernet/intel/e1000e/mac.c
7156 +@@ -450,7 +450,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw)
7157 + * we have already determined whether we have link or not.
7158 + */
7159 + if (!mac->autoneg)
7160 +- return -E1000_ERR_CONFIG;
7161 ++ return 1;
7162 +
7163 + /* Auto-Neg is enabled. Auto Speed Detection takes care
7164 + * of MAC speed/duplex configuration. So we only need to
7165 +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
7166 +index 825ec8f710e7..9c95222e6536 100644
7167 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c
7168 ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
7169 +@@ -2331,8 +2331,8 @@ static int e1000_alloc_ring_dma(struct e1000_adapter *adapter,
7170 + {
7171 + struct pci_dev *pdev = adapter->pdev;
7172 +
7173 +- ring->desc = dma_alloc_coherent(&pdev->dev, ring->size, &ring->dma,
7174 +- GFP_KERNEL);
7175 ++ ring->desc = dma_zalloc_coherent(&pdev->dev, ring->size, &ring->dma,
7176 ++ GFP_KERNEL);
7177 + if (!ring->desc)
7178 + return -ENOMEM;
7179 +
7180 +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
7181 +index 05629381be6b..ea5ea653e1db 100644
7182 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
7183 ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
7184 +@@ -803,8 +803,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set)
7185 + if (vid >= VLAN_N_VID)
7186 + return -EINVAL;
7187 +
7188 +- /* Verify we have permission to add VLANs */
7189 +- if (hw->mac.vlan_override)
7190 ++ /* Verify that we have permission to add VLANs. If this is a request
7191 ++ * to remove a VLAN, we still want to allow the user to remove the
7192 ++ * VLAN device. In that case, we need to clear the bit in the
7193 ++ * active_vlans bitmask.
7194 ++ */
7195 ++ if (set && hw->mac.vlan_override)
7196 + return -EACCES;
7197 +
7198 + /* update active_vlans bitmask */
7199 +@@ -823,6 +827,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set)
7200 + rx_ring->vid &= ~FM10K_VLAN_CLEAR;
7201 + }
7202 +
7203 ++ /* If our VLAN has been overridden, there is no reason to send VLAN
7204 ++ * removal requests as they will be silently ignored.
7205 ++ */
7206 ++ if (hw->mac.vlan_override)
7207 ++ return 0;
7208 ++
7209 + /* Do not remove default VLAN ID related entries from VLAN and MAC
7210 + * tables
7211 + */
7212 +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
7213 +index fa463268d019..17b81780d12f 100644
7214 +--- a/drivers/net/ethernet/marvell/mvneta.c
7215 ++++ b/drivers/net/ethernet/marvell/mvneta.c
7216 +@@ -1080,6 +1080,7 @@ static void mvneta_port_up(struct mvneta_port *pp)
7217 + }
7218 + mvreg_write(pp, MVNETA_TXQ_CMD, q_map);
7219 +
7220 ++ q_map = 0;
7221 + /* Enable all initialized RXQs. */
7222 + for (queue = 0; queue < rxq_number; queue++) {
7223 + struct mvneta_rx_queue *rxq = &pp->rxqs[queue];
7224 +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
7225 +index 4c3f1cb7e2c9..6631fb0782d7 100644
7226 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
7227 ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
7228 +@@ -1765,7 +1765,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev)
7229 +
7230 + cmd->checksum_disabled = 1;
7231 + cmd->max_reg_cmds = (1 << cmd->log_sz) - 1;
7232 +- cmd->bitmask = (1 << cmd->max_reg_cmds) - 1;
7233 ++ cmd->bitmask = (1UL << cmd->max_reg_cmds) - 1;
7234 +
7235 + cmd->cmdif_rev = ioread32be(&dev->iseg->cmdif_rev_fw_sub) >> 16;
7236 + if (cmd->cmdif_rev > CMD_IF_REV) {
7237 +diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
7238 +index f683bfbd9986..9d223ff65071 100644
7239 +--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c
7240 ++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c
7241 +@@ -1250,9 +1250,9 @@ void emac_mac_tx_process(struct emac_adapter *adpt, struct emac_tx_queue *tx_q)
7242 + while (tx_q->tpd.consume_idx != hw_consume_idx) {
7243 + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.consume_idx);
7244 + if (tpbuf->dma_addr) {
7245 +- dma_unmap_single(adpt->netdev->dev.parent,
7246 +- tpbuf->dma_addr, tpbuf->length,
7247 +- DMA_TO_DEVICE);
7248 ++ dma_unmap_page(adpt->netdev->dev.parent,
7249 ++ tpbuf->dma_addr, tpbuf->length,
7250 ++ DMA_TO_DEVICE);
7251 + tpbuf->dma_addr = 0;
7252 + }
7253 +
7254 +@@ -1409,9 +1409,11 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
7255 +
7256 + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
7257 + tpbuf->length = mapped_len;
7258 +- tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
7259 +- skb->data, tpbuf->length,
7260 +- DMA_TO_DEVICE);
7261 ++ tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
7262 ++ virt_to_page(skb->data),
7263 ++ offset_in_page(skb->data),
7264 ++ tpbuf->length,
7265 ++ DMA_TO_DEVICE);
7266 + ret = dma_mapping_error(adpt->netdev->dev.parent,
7267 + tpbuf->dma_addr);
7268 + if (ret)
7269 +@@ -1427,9 +1429,12 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt,
7270 + if (mapped_len < len) {
7271 + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx);
7272 + tpbuf->length = len - mapped_len;
7273 +- tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent,
7274 +- skb->data + mapped_len,
7275 +- tpbuf->length, DMA_TO_DEVICE);
7276 ++ tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent,
7277 ++ virt_to_page(skb->data +
7278 ++ mapped_len),
7279 ++ offset_in_page(skb->data +
7280 ++ mapped_len),
7281 ++ tpbuf->length, DMA_TO_DEVICE);
7282 + ret = dma_mapping_error(adpt->netdev->dev.parent,
7283 + tpbuf->dma_addr);
7284 + if (ret)
7285 +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
7286 +index 8b0016a785c0..734caa7a557b 100644
7287 +--- a/drivers/net/ethernet/smsc/smsc911x.c
7288 ++++ b/drivers/net/ethernet/smsc/smsc911x.c
7289 +@@ -2330,14 +2330,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
7290 + pdata = netdev_priv(dev);
7291 + BUG_ON(!pdata);
7292 + BUG_ON(!pdata->ioaddr);
7293 +- WARN_ON(dev->phydev);
7294 +
7295 + SMSC_TRACE(pdata, ifdown, "Stopping driver");
7296 +
7297 ++ unregister_netdev(dev);
7298 ++
7299 + mdiobus_unregister(pdata->mii_bus);
7300 + mdiobus_free(pdata->mii_bus);
7301 +
7302 +- unregister_netdev(dev);
7303 + res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
7304 + "smsc911x-memory");
7305 + if (!res)
7306 +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
7307 +index ffaed1f35efe..f356a44bcb81 100644
7308 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
7309 ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
7310 +@@ -118,7 +118,7 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac)
7311 + snprintf(clk_name, sizeof(clk_name), "%s#m250_sel", dev_name(dev));
7312 + init.name = clk_name;
7313 + init.ops = &clk_mux_ops;
7314 +- init.flags = 0;
7315 ++ init.flags = CLK_SET_RATE_PARENT;
7316 + init.parent_names = mux_parent_names;
7317 + init.num_parents = MUX_CLK_NUM_PARENTS;
7318 +
7319 +@@ -146,7 +146,9 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac)
7320 + dwmac->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
7321 + dwmac->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
7322 + dwmac->m250_div.hw.init = &init;
7323 +- dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO;
7324 ++ dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED |
7325 ++ CLK_DIVIDER_ALLOW_ZERO |
7326 ++ CLK_DIVIDER_ROUND_CLOSEST;
7327 +
7328 + dwmac->m250_div_clk = devm_clk_register(dev, &dwmac->m250_div.hw);
7329 + if (WARN_ON(IS_ERR(dwmac->m250_div_clk)))
7330 +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
7331 +index c212d1dd8bfd..b3bc1287b2a7 100644
7332 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
7333 ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
7334 +@@ -1343,6 +1343,11 @@ static void stmmac_tx_clean(struct stmmac_priv *priv)
7335 + if (unlikely(status & tx_dma_own))
7336 + break;
7337 +
7338 ++ /* Make sure descriptor fields are read after reading
7339 ++ * the own bit.
7340 ++ */
7341 ++ dma_rmb();
7342 ++
7343 + /* Just consider the last segment and ...*/
7344 + if (likely(!(status & tx_not_ls))) {
7345 + /* ... verify the status error condition */
7346 +@@ -2136,8 +2141,15 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
7347 + tcp_hdrlen(skb) / 4, (skb->len - proto_hdr_len));
7348 +
7349 + /* If context desc is used to change MSS */
7350 +- if (mss_desc)
7351 ++ if (mss_desc) {
7352 ++ /* Make sure that first descriptor has been completely
7353 ++ * written, including its own bit. This is because MSS is
7354 ++ * actually before first descriptor, so we need to make
7355 ++ * sure that MSS's own bit is the last thing written.
7356 ++ */
7357 ++ dma_wmb();
7358 + priv->hw->desc->set_tx_owner(mss_desc);
7359 ++ }
7360 +
7361 + /* The own bit must be the latest setting done when prepare the
7362 + * descriptor and then barrier is needed to make sure that
7363 +diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
7364 +index a2f9b47de187..e36c700c78d4 100644
7365 +--- a/drivers/net/ethernet/sun/sunvnet.c
7366 ++++ b/drivers/net/ethernet/sun/sunvnet.c
7367 +@@ -198,7 +198,7 @@ static struct vnet *vnet_new(const u64 *local_mac,
7368 + dev->ethtool_ops = &vnet_ethtool_ops;
7369 + dev->watchdog_timeo = VNET_TX_TIMEOUT;
7370 +
7371 +- dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_GSO_SOFTWARE |
7372 ++ dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_ALL_TSO |
7373 + NETIF_F_HW_CSUM | NETIF_F_SG;
7374 + dev->features = dev->hw_features;
7375 +
7376 +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
7377 +index e8ad4d060da7..6237236b7c4c 100644
7378 +--- a/drivers/net/macvlan.c
7379 ++++ b/drivers/net/macvlan.c
7380 +@@ -1384,7 +1384,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
7381 + /* the macvlan port may be freed by macvlan_uninit when fail to register.
7382 + * so we destroy the macvlan port only when it's valid.
7383 + */
7384 +- if (create && macvlan_port_get_rtnl(dev))
7385 ++ if (create && macvlan_port_get_rtnl(lowerdev))
7386 + macvlan_port_destroy(port->dev);
7387 + return err;
7388 + }
7389 +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
7390 +index b88f7d65953d..482ea404a2d4 100644
7391 +--- a/drivers/net/phy/dp83640.c
7392 ++++ b/drivers/net/phy/dp83640.c
7393 +@@ -1205,6 +1205,23 @@ static void dp83640_remove(struct phy_device *phydev)
7394 + kfree(dp83640);
7395 + }
7396 +
7397 ++static int dp83640_soft_reset(struct phy_device *phydev)
7398 ++{
7399 ++ int ret;
7400 ++
7401 ++ ret = genphy_soft_reset(phydev);
7402 ++ if (ret < 0)
7403 ++ return ret;
7404 ++
7405 ++ /* From DP83640 datasheet: "Software driver code must wait 3 us
7406 ++ * following a software reset before allowing further serial MII
7407 ++ * operations with the DP83640."
7408 ++ */
7409 ++ udelay(10); /* Taking udelay inaccuracy into account */
7410 ++
7411 ++ return 0;
7412 ++}
7413 ++
7414 + static int dp83640_config_init(struct phy_device *phydev)
7415 + {
7416 + struct dp83640_private *dp83640 = phydev->priv;
7417 +@@ -1498,6 +1515,7 @@ static struct phy_driver dp83640_driver = {
7418 + .flags = PHY_HAS_INTERRUPT,
7419 + .probe = dp83640_probe,
7420 + .remove = dp83640_remove,
7421 ++ .soft_reset = dp83640_soft_reset,
7422 + .config_init = dp83640_config_init,
7423 + .config_aneg = genphy_config_aneg,
7424 + .read_status = genphy_read_status,
7425 +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
7426 +index 8daf5db3d922..1d56c73574e8 100644
7427 +--- a/drivers/net/usb/qmi_wwan.c
7428 ++++ b/drivers/net/usb/qmi_wwan.c
7429 +@@ -889,6 +889,7 @@ static const struct usb_device_id products[] = {
7430 + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */
7431 + {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */
7432 + {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
7433 ++ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
7434 + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
7435 + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
7436 + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
7437 +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
7438 +index 3cdfa2465e3f..d3d89b05f66e 100644
7439 +--- a/drivers/net/usb/r8152.c
7440 ++++ b/drivers/net/usb/r8152.c
7441 +@@ -1693,7 +1693,7 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg)
7442 +
7443 + tx_data += len;
7444 + agg->skb_len += len;
7445 +- agg->skb_num++;
7446 ++ agg->skb_num += skb_shinfo(skb)->gso_segs ?: 1;
7447 +
7448 + dev_kfree_skb_any(skb);
7449 +
7450 +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
7451 +index 4cb9b11a545a..2cc0f28f4fd2 100644
7452 +--- a/drivers/net/usb/smsc75xx.c
7453 ++++ b/drivers/net/usb/smsc75xx.c
7454 +@@ -957,10 +957,11 @@ static int smsc75xx_set_features(struct net_device *netdev,
7455 + /* it's racing here! */
7456 +
7457 + ret = smsc75xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
7458 +- if (ret < 0)
7459 ++ if (ret < 0) {
7460 + netdev_warn(dev->net, "Error writing RFE_CTL\n");
7461 +-
7462 +- return ret;
7463 ++ return ret;
7464 ++ }
7465 ++ return 0;
7466 + }
7467 +
7468 + static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm)
7469 +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
7470 +index 472ed6df2221..7118b8263760 100644
7471 +--- a/drivers/net/virtio_net.c
7472 ++++ b/drivers/net/virtio_net.c
7473 +@@ -1949,8 +1949,8 @@ static int virtnet_probe(struct virtio_device *vdev)
7474 +
7475 + /* Assume link up if device can't report link status,
7476 + otherwise get link status from config. */
7477 ++ netif_carrier_off(dev);
7478 + if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
7479 +- netif_carrier_off(dev);
7480 + schedule_work(&vi->config_work);
7481 + } else {
7482 + vi->status = VIRTIO_NET_S_LINK_UP;
7483 +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
7484 +index 5aa5df24f4dc..d68f4f2965e0 100644
7485 +--- a/drivers/net/wireless/ath/ath10k/mac.c
7486 ++++ b/drivers/net/wireless/ath/ath10k/mac.c
7487 +@@ -6928,10 +6928,20 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw,
7488 + {
7489 + struct ath10k *ar = hw->priv;
7490 + struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
7491 ++ struct ath10k_vif *arvif = (void *)vif->drv_priv;
7492 ++ struct ath10k_peer *peer;
7493 + u32 bw, smps;
7494 +
7495 + spin_lock_bh(&ar->data_lock);
7496 +
7497 ++ peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr);
7498 ++ if (!peer) {
7499 ++ spin_unlock_bh(&ar->data_lock);
7500 ++ ath10k_warn(ar, "mac sta rc update failed to find peer %pM on vdev %i\n",
7501 ++ sta->addr, arvif->vdev_id);
7502 ++ return;
7503 ++ }
7504 ++
7505 + ath10k_dbg(ar, ATH10K_DBG_MAC,
7506 + "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n",
7507 + sta->addr, changed, sta->bandwidth, sta->rx_nss,
7508 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
7509 +index f507d821aba8..c221597e2519 100644
7510 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
7511 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
7512 +@@ -6789,7 +6789,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
7513 + int i;
7514 +
7515 + /* ignore non-ISO3166 country codes */
7516 +- for (i = 0; i < sizeof(req->alpha2); i++)
7517 ++ for (i = 0; i < 2; i++)
7518 + if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
7519 + brcmf_err("not a ISO3166 code (0x%02x 0x%02x)\n",
7520 + req->alpha2[0], req->alpha2[1]);
7521 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
7522 +index f1231c0ea336..0bffade1ea5b 100644
7523 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
7524 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
7525 +@@ -2585,6 +2585,10 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
7526 +
7527 + /* enable beacon filtering */
7528 + WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0));
7529 ++
7530 ++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
7531 ++ false);
7532 ++
7533 + ret = 0;
7534 + } else if (old_state == IEEE80211_STA_AUTHORIZED &&
7535 + new_state == IEEE80211_STA_ASSOC) {
7536 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
7537 +index 0aea476ebf50..f251c2afebfc 100644
7538 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
7539 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
7540 +@@ -2709,7 +2709,8 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
7541 + struct ieee80211_sta *sta,
7542 + struct iwl_lq_sta *lq_sta,
7543 + enum nl80211_band band,
7544 +- struct rs_rate *rate)
7545 ++ struct rs_rate *rate,
7546 ++ bool init)
7547 + {
7548 + int i, nentries;
7549 + unsigned long active_rate;
7550 +@@ -2763,14 +2764,25 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
7551 + */
7552 + if (sta->vht_cap.vht_supported &&
7553 + best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
7554 +- switch (sta->bandwidth) {
7555 +- case IEEE80211_STA_RX_BW_160:
7556 +- case IEEE80211_STA_RX_BW_80:
7557 +- case IEEE80211_STA_RX_BW_40:
7558 ++ /*
7559 ++ * In AP mode, when a new station associates, rs is initialized
7560 ++ * immediately upon association completion, before the phy
7561 ++ * context is updated with the association parameters, so the
7562 ++ * sta bandwidth might be wider than the phy context allows.
7563 ++ * To avoid this issue, always initialize rs with 20mhz
7564 ++ * bandwidth rate, and after authorization, when the phy context
7565 ++ * is already up-to-date, re-init rs with the correct bw.
7566 ++ */
7567 ++ u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta);
7568 ++
7569 ++ switch (bw) {
7570 ++ case RATE_MCS_CHAN_WIDTH_40:
7571 ++ case RATE_MCS_CHAN_WIDTH_80:
7572 ++ case RATE_MCS_CHAN_WIDTH_160:
7573 + initial_rates = rs_optimal_rates_vht;
7574 + nentries = ARRAY_SIZE(rs_optimal_rates_vht);
7575 + break;
7576 +- case IEEE80211_STA_RX_BW_20:
7577 ++ case RATE_MCS_CHAN_WIDTH_20:
7578 + initial_rates = rs_optimal_rates_vht_20mhz;
7579 + nentries = ARRAY_SIZE(rs_optimal_rates_vht_20mhz);
7580 + break;
7581 +@@ -2781,7 +2793,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
7582 +
7583 + active_rate = lq_sta->active_siso_rate;
7584 + rate->type = LQ_VHT_SISO;
7585 +- rate->bw = rs_bw_from_sta_bw(sta);
7586 ++ rate->bw = bw;
7587 + } else if (sta->ht_cap.ht_supported &&
7588 + best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) {
7589 + initial_rates = rs_optimal_rates_ht;
7590 +@@ -2863,7 +2875,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
7591 + tbl = &(lq_sta->lq_info[active_tbl]);
7592 + rate = &tbl->rate;
7593 +
7594 +- rs_get_initial_rate(mvm, sta, lq_sta, band, rate);
7595 ++ rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init);
7596 + rs_init_optimal_rate(mvm, sta, lq_sta);
7597 +
7598 + WARN_ON_ONCE(rate->ant != ANT_A && rate->ant != ANT_B);
7599 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
7600 +index a481eb41f693..c2bbc8c17beb 100644
7601 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
7602 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
7603 +@@ -72,6 +72,7 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
7604 + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
7605 + struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb);
7606 + struct iwl_mvm_key_pn *ptk_pn;
7607 ++ int res;
7608 + u8 tid, keyidx;
7609 + u8 pn[IEEE80211_CCMP_PN_LEN];
7610 + u8 *extiv;
7611 +@@ -128,12 +129,13 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb,
7612 + pn[4] = extiv[1];
7613 + pn[5] = extiv[0];
7614 +
7615 +- if (memcmp(pn, ptk_pn->q[queue].pn[tid],
7616 +- IEEE80211_CCMP_PN_LEN) <= 0)
7617 ++ res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN);
7618 ++ if (res < 0)
7619 ++ return -1;
7620 ++ if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN))
7621 + return -1;
7622 +
7623 +- if (!(stats->flag & RX_FLAG_AMSDU_MORE))
7624 +- memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
7625 ++ memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN);
7626 + stats->flag |= RX_FLAG_PN_VALIDATED;
7627 +
7628 + return 0;
7629 +@@ -295,28 +297,21 @@ static void iwl_mvm_rx_csum(struct ieee80211_sta *sta,
7630 + }
7631 +
7632 + /*
7633 +- * returns true if a packet outside BA session is a duplicate and
7634 +- * should be dropped
7635 ++ * returns true if a packet is a duplicate and should be dropped.
7636 ++ * Updates AMSDU PN tracking info
7637 + */
7638 +-static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
7639 +- struct ieee80211_rx_status *rx_status,
7640 +- struct ieee80211_hdr *hdr,
7641 +- struct iwl_rx_mpdu_desc *desc)
7642 ++static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue,
7643 ++ struct ieee80211_rx_status *rx_status,
7644 ++ struct ieee80211_hdr *hdr,
7645 ++ struct iwl_rx_mpdu_desc *desc)
7646 + {
7647 + struct iwl_mvm_sta *mvm_sta;
7648 + struct iwl_mvm_rxq_dup_data *dup_data;
7649 +- u8 baid, tid, sub_frame_idx;
7650 ++ u8 tid, sub_frame_idx;
7651 +
7652 + if (WARN_ON(IS_ERR_OR_NULL(sta)))
7653 + return false;
7654 +
7655 +- baid = (le32_to_cpu(desc->reorder_data) &
7656 +- IWL_RX_MPDU_REORDER_BAID_MASK) >>
7657 +- IWL_RX_MPDU_REORDER_BAID_SHIFT;
7658 +-
7659 +- if (baid != IWL_RX_REORDER_DATA_INVALID_BAID)
7660 +- return false;
7661 +-
7662 + mvm_sta = iwl_mvm_sta_from_mac80211(sta);
7663 + dup_data = &mvm_sta->dup_data[queue];
7664 +
7665 +@@ -346,6 +341,12 @@ static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue,
7666 + dup_data->last_sub_frame[tid] >= sub_frame_idx))
7667 + return true;
7668 +
7669 ++ /* Allow same PN as the first subframe for following sub frames */
7670 ++ if (dup_data->last_seq[tid] == hdr->seq_ctrl &&
7671 ++ sub_frame_idx > dup_data->last_sub_frame[tid] &&
7672 ++ desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU)
7673 ++ rx_status->flag |= RX_FLAG_ALLOW_SAME_PN;
7674 ++
7675 + dup_data->last_seq[tid] = hdr->seq_ctrl;
7676 + dup_data->last_sub_frame[tid] = sub_frame_idx;
7677 +
7678 +@@ -882,7 +883,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
7679 + if (ieee80211_is_data(hdr->frame_control))
7680 + iwl_mvm_rx_csum(sta, skb, desc);
7681 +
7682 +- if (iwl_mvm_is_nonagg_dup(sta, queue, rx_status, hdr, desc)) {
7683 ++ if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) {
7684 + kfree_skb(skb);
7685 + rcu_read_unlock();
7686 + return;
7687 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
7688 +index 7465d4db136f..bd7ff562d82d 100644
7689 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
7690 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
7691 +@@ -406,11 +406,11 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
7692 + {
7693 + struct ieee80211_key_conf *keyconf = info->control.hw_key;
7694 + u8 *crypto_hdr = skb_frag->data + hdrlen;
7695 ++ enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM;
7696 + u64 pn;
7697 +
7698 + switch (keyconf->cipher) {
7699 + case WLAN_CIPHER_SUITE_CCMP:
7700 +- case WLAN_CIPHER_SUITE_CCMP_256:
7701 + iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd);
7702 + iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
7703 + break;
7704 +@@ -434,13 +434,16 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
7705 + break;
7706 + case WLAN_CIPHER_SUITE_GCMP:
7707 + case WLAN_CIPHER_SUITE_GCMP_256:
7708 ++ type = TX_CMD_SEC_GCMP;
7709 ++ /* Fall through */
7710 ++ case WLAN_CIPHER_SUITE_CCMP_256:
7711 + /* TODO: Taking the key from the table might introduce a race
7712 + * when PTK rekeying is done, having an old packets with a PN
7713 + * based on the old key but the message encrypted with a new
7714 + * one.
7715 + * Need to handle this.
7716 + */
7717 +- tx_cmd->sec_ctl |= TX_CMD_SEC_GCMP | TX_CMD_SEC_KEY_FROM_TABLE;
7718 ++ tx_cmd->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE;
7719 + tx_cmd->key[0] = keyconf->hw_key_idx;
7720 + iwl_mvm_set_tx_cmd_pn(info, crypto_hdr);
7721 + break;
7722 +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
7723 +index 2681b5339810..95e96419b4cf 100644
7724 +--- a/drivers/net/wireless/mac80211_hwsim.c
7725 ++++ b/drivers/net/wireless/mac80211_hwsim.c
7726 +@@ -3084,8 +3084,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
7727 + if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
7728 + u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
7729 +
7730 +- if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
7731 ++ if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) {
7732 ++ kfree(hwname);
7733 + return -EINVAL;
7734 ++ }
7735 + param.regd = hwsim_world_regdom_custom[idx];
7736 + }
7737 +
7738 +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
7739 +index 1b287861e34f..520050eae836 100644
7740 +--- a/drivers/net/xen-netfront.c
7741 ++++ b/drivers/net/xen-netfront.c
7742 +@@ -350,6 +350,9 @@ static int xennet_open(struct net_device *dev)
7743 + unsigned int i = 0;
7744 + struct netfront_queue *queue = NULL;
7745 +
7746 ++ if (!np->queues)
7747 ++ return -ENODEV;
7748 ++
7749 + for (i = 0; i < num_queues; ++i) {
7750 + queue = &np->queues[i];
7751 + napi_enable(&queue->napi);
7752 +@@ -1377,18 +1380,8 @@ static int netfront_probe(struct xenbus_device *dev,
7753 + #ifdef CONFIG_SYSFS
7754 + info->netdev->sysfs_groups[0] = &xennet_dev_group;
7755 + #endif
7756 +- err = register_netdev(info->netdev);
7757 +- if (err) {
7758 +- pr_warn("%s: register_netdev err=%d\n", __func__, err);
7759 +- goto fail;
7760 +- }
7761 +
7762 + return 0;
7763 +-
7764 +- fail:
7765 +- xennet_free_netdev(netdev);
7766 +- dev_set_drvdata(&dev->dev, NULL);
7767 +- return err;
7768 + }
7769 +
7770 + static void xennet_end_access(int ref, void *page)
7771 +@@ -1757,8 +1750,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
7772 + {
7773 + unsigned int i;
7774 +
7775 +- rtnl_lock();
7776 +-
7777 + for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
7778 + struct netfront_queue *queue = &info->queues[i];
7779 +
7780 +@@ -1767,8 +1758,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
7781 + netif_napi_del(&queue->napi);
7782 + }
7783 +
7784 +- rtnl_unlock();
7785 +-
7786 + kfree(info->queues);
7787 + info->queues = NULL;
7788 + }
7789 +@@ -1784,8 +1773,6 @@ static int xennet_create_queues(struct netfront_info *info,
7790 + if (!info->queues)
7791 + return -ENOMEM;
7792 +
7793 +- rtnl_lock();
7794 +-
7795 + for (i = 0; i < *num_queues; i++) {
7796 + struct netfront_queue *queue = &info->queues[i];
7797 +
7798 +@@ -1794,7 +1781,7 @@ static int xennet_create_queues(struct netfront_info *info,
7799 +
7800 + ret = xennet_init_queue(queue);
7801 + if (ret < 0) {
7802 +- dev_warn(&info->netdev->dev,
7803 ++ dev_warn(&info->xbdev->dev,
7804 + "only created %d queues\n", i);
7805 + *num_queues = i;
7806 + break;
7807 +@@ -1808,10 +1795,8 @@ static int xennet_create_queues(struct netfront_info *info,
7808 +
7809 + netif_set_real_num_tx_queues(info->netdev, *num_queues);
7810 +
7811 +- rtnl_unlock();
7812 +-
7813 + if (*num_queues == 0) {
7814 +- dev_err(&info->netdev->dev, "no queues\n");
7815 ++ dev_err(&info->xbdev->dev, "no queues\n");
7816 + return -EINVAL;
7817 + }
7818 + return 0;
7819 +@@ -1853,6 +1838,7 @@ static int talk_to_netback(struct xenbus_device *dev,
7820 + goto out;
7821 + }
7822 +
7823 ++ rtnl_lock();
7824 + if (info->queues)
7825 + xennet_destroy_queues(info);
7826 +
7827 +@@ -1863,6 +1849,7 @@ static int talk_to_netback(struct xenbus_device *dev,
7828 + info->queues = NULL;
7829 + goto out;
7830 + }
7831 ++ rtnl_unlock();
7832 +
7833 + /* Create shared ring, alloc event channel -- for each queue */
7834 + for (i = 0; i < num_queues; ++i) {
7835 +@@ -1959,8 +1946,10 @@ static int talk_to_netback(struct xenbus_device *dev,
7836 + xenbus_transaction_end(xbt, 1);
7837 + destroy_ring:
7838 + xennet_disconnect_backend(info);
7839 ++ rtnl_lock();
7840 + xennet_destroy_queues(info);
7841 + out:
7842 ++ rtnl_unlock();
7843 + device_unregister(&dev->dev);
7844 + return err;
7845 + }
7846 +@@ -1996,6 +1985,15 @@ static int xennet_connect(struct net_device *dev)
7847 + netdev_update_features(dev);
7848 + rtnl_unlock();
7849 +
7850 ++ if (dev->reg_state == NETREG_UNINITIALIZED) {
7851 ++ err = register_netdev(dev);
7852 ++ if (err) {
7853 ++ pr_warn("%s: register_netdev err=%d\n", __func__, err);
7854 ++ device_unregister(&np->xbdev->dev);
7855 ++ return err;
7856 ++ }
7857 ++ }
7858 ++
7859 + /*
7860 + * All public and private state should now be sane. Get
7861 + * ready to start sending and receiving packets and give the driver
7862 +@@ -2186,10 +2184,14 @@ static int xennet_remove(struct xenbus_device *dev)
7863 +
7864 + xennet_disconnect_backend(info);
7865 +
7866 +- unregister_netdev(info->netdev);
7867 ++ if (info->netdev->reg_state == NETREG_REGISTERED)
7868 ++ unregister_netdev(info->netdev);
7869 +
7870 +- if (info->queues)
7871 ++ if (info->queues) {
7872 ++ rtnl_lock();
7873 + xennet_destroy_queues(info);
7874 ++ rtnl_unlock();
7875 ++ }
7876 + xennet_free_netdev(info->netdev);
7877 +
7878 + return 0;
7879 +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
7880 +index 24222a5d8df2..da95bd8f0f72 100644
7881 +--- a/drivers/ntb/ntb_transport.c
7882 ++++ b/drivers/ntb/ntb_transport.c
7883 +@@ -996,6 +996,9 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
7884 + mw_base = nt->mw_vec[mw_num].phys_addr;
7885 + mw_size = nt->mw_vec[mw_num].phys_size;
7886 +
7887 ++ if (max_mw_size && mw_size > max_mw_size)
7888 ++ mw_size = max_mw_size;
7889 ++
7890 + tx_size = (unsigned int)mw_size / num_qps_mw;
7891 + qp_offset = tx_size * (qp_num / mw_count);
7892 +
7893 +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
7894 +index eef1a68e5d95..b634b89b4540 100644
7895 +--- a/drivers/nvme/host/fabrics.c
7896 ++++ b/drivers/nvme/host/fabrics.c
7897 +@@ -583,8 +583,10 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
7898 + opts->discovery_nqn =
7899 + !(strcmp(opts->subsysnqn,
7900 + NVME_DISC_SUBSYS_NAME));
7901 +- if (opts->discovery_nqn)
7902 ++ if (opts->discovery_nqn) {
7903 ++ opts->kato = 0;
7904 + opts->nr_io_queues = 0;
7905 ++ }
7906 + break;
7907 + case NVMF_OPT_TRADDR:
7908 + p = match_strdup(args);
7909 +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
7910 +index 8cc856ecec95..642ee00e9143 100644
7911 +--- a/drivers/nvme/host/pci.c
7912 ++++ b/drivers/nvme/host/pci.c
7913 +@@ -1120,7 +1120,7 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
7914 + nvmeq->cq_vector = qid - 1;
7915 + result = adapter_alloc_cq(dev, qid, nvmeq);
7916 + if (result < 0)
7917 +- return result;
7918 ++ goto release_vector;
7919 +
7920 + result = adapter_alloc_sq(dev, qid, nvmeq);
7921 + if (result < 0)
7922 +@@ -1134,9 +1134,12 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid)
7923 + return result;
7924 +
7925 + release_sq:
7926 ++ dev->online_queues--;
7927 + adapter_delete_sq(dev, qid);
7928 + release_cq:
7929 + adapter_delete_cq(dev, qid);
7930 ++ release_vector:
7931 ++ nvmeq->cq_vector = -1;
7932 + return result;
7933 + }
7934 +
7935 +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
7936 +index c89d68a76f3d..3a044922b048 100644
7937 +--- a/drivers/nvme/target/core.c
7938 ++++ b/drivers/nvme/target/core.c
7939 +@@ -491,9 +491,12 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
7940 + goto fail;
7941 + }
7942 +
7943 +- /* either variant of SGLs is fine, as we don't support metadata */
7944 +- if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF &&
7945 +- (flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METASEG)) {
7946 ++ /*
7947 ++ * For fabrics, PSDT field shall describe metadata pointer (MPTR) that
7948 ++ * contains an address of a single contiguous physical buffer that is
7949 ++ * byte aligned.
7950 ++ */
7951 ++ if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF)) {
7952 + status = NVME_SC_INVALID_FIELD | NVME_SC_DNR;
7953 + goto fail;
7954 + }
7955 +diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
7956 +index 1cced1d039d7..7e9385812bda 100644
7957 +--- a/drivers/parisc/lba_pci.c
7958 ++++ b/drivers/parisc/lba_pci.c
7959 +@@ -1367,9 +1367,27 @@ lba_hw_init(struct lba_device *d)
7960 + WRITE_REG32(stat, d->hba.base_addr + LBA_ERROR_CONFIG);
7961 + }
7962 +
7963 +- /* Set HF mode as the default (vs. -1 mode). */
7964 ++
7965 ++ /*
7966 ++ * Hard Fail vs. Soft Fail on PCI "Master Abort".
7967 ++ *
7968 ++ * "Master Abort" means the MMIO transaction timed out - usually due to
7969 ++ * the device not responding to an MMIO read. We would like HF to be
7970 ++ * enabled to find driver problems, though it means the system will
7971 ++ * crash with a HPMC.
7972 ++ *
7973 ++ * In SoftFail mode "~0L" is returned as a result of a timeout on the
7974 ++ * pci bus. This is like how PCI busses on x86 and most other
7975 ++ * architectures behave. In order to increase compatibility with
7976 ++ * existing (x86) PCI hardware and existing Linux drivers we enable
7977 ++ * Soft Faul mode on PA-RISC now too.
7978 ++ */
7979 + stat = READ_REG32(d->hba.base_addr + LBA_STAT_CTL);
7980 ++#if defined(ENABLE_HARDFAIL)
7981 + WRITE_REG32(stat | HF_ENABLE, d->hba.base_addr + LBA_STAT_CTL);
7982 ++#else
7983 ++ WRITE_REG32(stat & ~HF_ENABLE, d->hba.base_addr + LBA_STAT_CTL);
7984 ++#endif
7985 +
7986 + /*
7987 + ** Writing a zero to STAT_CTL.rf (bit 0) will clear reset signal
7988 +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
7989 +index d81ad841dc0c..f11c38244088 100644
7990 +--- a/drivers/pci/pci-driver.c
7991 ++++ b/drivers/pci/pci-driver.c
7992 +@@ -1147,11 +1147,14 @@ static int pci_pm_runtime_suspend(struct device *dev)
7993 + int error;
7994 +
7995 + /*
7996 +- * If pci_dev->driver is not set (unbound), the device should
7997 +- * always remain in D0 regardless of the runtime PM status
7998 ++ * If pci_dev->driver is not set (unbound), we leave the device in D0,
7999 ++ * but it may go to D3cold when the bridge above it runtime suspends.
8000 ++ * Save its config space in case that happens.
8001 + */
8002 +- if (!pci_dev->driver)
8003 ++ if (!pci_dev->driver) {
8004 ++ pci_save_state(pci_dev);
8005 + return 0;
8006 ++ }
8007 +
8008 + if (!pm || !pm->runtime_suspend)
8009 + return -ENOSYS;
8010 +@@ -1199,16 +1202,18 @@ static int pci_pm_runtime_resume(struct device *dev)
8011 + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
8012 +
8013 + /*
8014 +- * If pci_dev->driver is not set (unbound), the device should
8015 +- * always remain in D0 regardless of the runtime PM status
8016 ++ * Restoring config space is necessary even if the device is not bound
8017 ++ * to a driver because although we left it in D0, it may have gone to
8018 ++ * D3cold when the bridge above it runtime suspended.
8019 + */
8020 ++ pci_restore_standard_config(pci_dev);
8021 ++
8022 + if (!pci_dev->driver)
8023 + return 0;
8024 +
8025 + if (!pm || !pm->runtime_resume)
8026 + return -ENOSYS;
8027 +
8028 +- pci_restore_standard_config(pci_dev);
8029 + pci_fixup_device(pci_fixup_resume_early, pci_dev);
8030 + __pci_enable_wake(pci_dev, PCI_D0, true, false);
8031 + pci_fixup_device(pci_fixup_resume, pci_dev);
8032 +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
8033 +index fb177dc576d6..b55f9179c94e 100644
8034 +--- a/drivers/pci/quirks.c
8035 ++++ b/drivers/pci/quirks.c
8036 +@@ -3857,6 +3857,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120,
8037 + quirk_dma_func1_alias);
8038 + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
8039 + quirk_dma_func1_alias);
8040 ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
8041 ++ quirk_dma_func1_alias);
8042 + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
8043 + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
8044 + quirk_dma_func1_alias);
8045 +@@ -3872,6 +3874,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9182,
8046 + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */
8047 + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0,
8048 + quirk_dma_func1_alias);
8049 ++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */
8050 ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220,
8051 ++ quirk_dma_func1_alias);
8052 + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c49 */
8053 + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230,
8054 + quirk_dma_func1_alias);
8055 +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
8056 +index bedce3453dd3..056845bdf67b 100644
8057 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c
8058 ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
8059 +@@ -790,7 +790,7 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl)
8060 + return -EINVAL;
8061 +
8062 + chip = &pctrl->chip;
8063 +- chip->base = 0;
8064 ++ chip->base = -1;
8065 + chip->ngpio = ngpio;
8066 + chip->label = dev_name(pctrl->dev);
8067 + chip->parent = pctrl->dev;
8068 +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7796.c b/drivers/pinctrl/sh-pfc/pfc-r8a7796.c
8069 +index dc9b671ccf2e..29718886989a 100644
8070 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7796.c
8071 ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7796.c
8072 +@@ -1,7 +1,7 @@
8073 + /*
8074 + * R8A7796 processor support - PFC hardware block.
8075 + *
8076 +- * Copyright (C) 2016 Renesas Electronics Corp.
8077 ++ * Copyright (C) 2016-2017 Renesas Electronics Corp.
8078 + *
8079 + * This file is based on the drivers/pinctrl/sh-pfc/pfc-r8a7795.c
8080 + *
8081 +@@ -476,7 +476,7 @@ FM(IP16_31_28) IP16_31_28 FM(IP17_31_28) IP17_31_28
8082 + #define MOD_SEL1_26 FM(SEL_TIMER_TMU_0) FM(SEL_TIMER_TMU_1)
8083 + #define MOD_SEL1_25_24 FM(SEL_SSP1_1_0) FM(SEL_SSP1_1_1) FM(SEL_SSP1_1_2) FM(SEL_SSP1_1_3)
8084 + #define MOD_SEL1_23_22_21 FM(SEL_SSP1_0_0) FM(SEL_SSP1_0_1) FM(SEL_SSP1_0_2) FM(SEL_SSP1_0_3) FM(SEL_SSP1_0_4) F_(0, 0) F_(0, 0) F_(0, 0)
8085 +-#define MOD_SEL1_20 FM(SEL_SSI_0) FM(SEL_SSI_1)
8086 ++#define MOD_SEL1_20 FM(SEL_SSI1_0) FM(SEL_SSI1_1)
8087 + #define MOD_SEL1_19 FM(SEL_SPEED_PULSE_0) FM(SEL_SPEED_PULSE_1)
8088 + #define MOD_SEL1_18_17 FM(SEL_SIMCARD_0) FM(SEL_SIMCARD_1) FM(SEL_SIMCARD_2) FM(SEL_SIMCARD_3)
8089 + #define MOD_SEL1_16 FM(SEL_SDHI2_0) FM(SEL_SDHI2_1)
8090 +@@ -1208,7 +1208,7 @@ static const u16 pinmux_data[] = {
8091 + PINMUX_IPSR_GPSR(IP13_11_8, HSCK0),
8092 + PINMUX_IPSR_MSEL(IP13_11_8, MSIOF1_SCK_D, SEL_MSIOF1_3),
8093 + PINMUX_IPSR_MSEL(IP13_11_8, AUDIO_CLKB_A, SEL_ADG_B_0),
8094 +- PINMUX_IPSR_MSEL(IP13_11_8, SSI_SDATA1_B, SEL_SSI_1),
8095 ++ PINMUX_IPSR_MSEL(IP13_11_8, SSI_SDATA1_B, SEL_SSI1_1),
8096 + PINMUX_IPSR_MSEL(IP13_11_8, TS_SCK0_D, SEL_TSIF0_3),
8097 + PINMUX_IPSR_MSEL(IP13_11_8, STP_ISCLK_0_D, SEL_SSP1_0_3),
8098 + PINMUX_IPSR_MSEL(IP13_11_8, RIF0_CLK_C, SEL_DRIF0_2),
8099 +@@ -1216,14 +1216,14 @@ static const u16 pinmux_data[] = {
8100 +
8101 + PINMUX_IPSR_GPSR(IP13_15_12, HRX0),
8102 + PINMUX_IPSR_MSEL(IP13_15_12, MSIOF1_RXD_D, SEL_MSIOF1_3),
8103 +- PINMUX_IPSR_MSEL(IP13_15_12, SSI_SDATA2_B, SEL_SSI_1),
8104 ++ PINMUX_IPSR_MSEL(IP13_15_12, SSI_SDATA2_B, SEL_SSI2_1),
8105 + PINMUX_IPSR_MSEL(IP13_15_12, TS_SDEN0_D, SEL_TSIF0_3),
8106 + PINMUX_IPSR_MSEL(IP13_15_12, STP_ISEN_0_D, SEL_SSP1_0_3),
8107 + PINMUX_IPSR_MSEL(IP13_15_12, RIF0_D0_C, SEL_DRIF0_2),
8108 +
8109 + PINMUX_IPSR_GPSR(IP13_19_16, HTX0),
8110 + PINMUX_IPSR_MSEL(IP13_19_16, MSIOF1_TXD_D, SEL_MSIOF1_3),
8111 +- PINMUX_IPSR_MSEL(IP13_19_16, SSI_SDATA9_B, SEL_SSI_1),
8112 ++ PINMUX_IPSR_MSEL(IP13_19_16, SSI_SDATA9_B, SEL_SSI9_1),
8113 + PINMUX_IPSR_MSEL(IP13_19_16, TS_SDAT0_D, SEL_TSIF0_3),
8114 + PINMUX_IPSR_MSEL(IP13_19_16, STP_ISD_0_D, SEL_SSP1_0_3),
8115 + PINMUX_IPSR_MSEL(IP13_19_16, RIF0_D1_C, SEL_DRIF0_2),
8116 +@@ -1231,7 +1231,7 @@ static const u16 pinmux_data[] = {
8117 + PINMUX_IPSR_GPSR(IP13_23_20, HCTS0_N),
8118 + PINMUX_IPSR_MSEL(IP13_23_20, RX2_B, SEL_SCIF2_1),
8119 + PINMUX_IPSR_MSEL(IP13_23_20, MSIOF1_SYNC_D, SEL_MSIOF1_3),
8120 +- PINMUX_IPSR_MSEL(IP13_23_20, SSI_SCK9_A, SEL_SSI_0),
8121 ++ PINMUX_IPSR_MSEL(IP13_23_20, SSI_SCK9_A, SEL_SSI9_0),
8122 + PINMUX_IPSR_MSEL(IP13_23_20, TS_SPSYNC0_D, SEL_TSIF0_3),
8123 + PINMUX_IPSR_MSEL(IP13_23_20, STP_ISSYNC_0_D, SEL_SSP1_0_3),
8124 + PINMUX_IPSR_MSEL(IP13_23_20, RIF0_SYNC_C, SEL_DRIF0_2),
8125 +@@ -1240,7 +1240,7 @@ static const u16 pinmux_data[] = {
8126 + PINMUX_IPSR_GPSR(IP13_27_24, HRTS0_N),
8127 + PINMUX_IPSR_MSEL(IP13_27_24, TX2_B, SEL_SCIF2_1),
8128 + PINMUX_IPSR_MSEL(IP13_27_24, MSIOF1_SS1_D, SEL_MSIOF1_3),
8129 +- PINMUX_IPSR_MSEL(IP13_27_24, SSI_WS9_A, SEL_SSI_0),
8130 ++ PINMUX_IPSR_MSEL(IP13_27_24, SSI_WS9_A, SEL_SSI9_0),
8131 + PINMUX_IPSR_MSEL(IP13_27_24, STP_IVCXO27_0_D, SEL_SSP1_0_3),
8132 + PINMUX_IPSR_MSEL(IP13_27_24, BPFCLK_A, SEL_FM_0),
8133 + PINMUX_IPSR_GPSR(IP13_27_24, AUDIO_CLKOUT2_A),
8134 +@@ -1255,7 +1255,7 @@ static const u16 pinmux_data[] = {
8135 + PINMUX_IPSR_MSEL(IP14_3_0, RX5_A, SEL_SCIF5_0),
8136 + PINMUX_IPSR_MSEL(IP14_3_0, NFWP_N_A, SEL_NDF_0),
8137 + PINMUX_IPSR_MSEL(IP14_3_0, AUDIO_CLKA_C, SEL_ADG_A_2),
8138 +- PINMUX_IPSR_MSEL(IP14_3_0, SSI_SCK2_A, SEL_SSI_0),
8139 ++ PINMUX_IPSR_MSEL(IP14_3_0, SSI_SCK2_A, SEL_SSI2_0),
8140 + PINMUX_IPSR_MSEL(IP14_3_0, STP_IVCXO27_0_C, SEL_SSP1_0_2),
8141 + PINMUX_IPSR_GPSR(IP14_3_0, AUDIO_CLKOUT3_A),
8142 + PINMUX_IPSR_MSEL(IP14_3_0, TCLK1_B, SEL_TIMER_TMU_1),
8143 +@@ -1264,7 +1264,7 @@ static const u16 pinmux_data[] = {
8144 + PINMUX_IPSR_MSEL(IP14_7_4, TX5_A, SEL_SCIF5_0),
8145 + PINMUX_IPSR_MSEL(IP14_7_4, MSIOF1_SS2_D, SEL_MSIOF1_3),
8146 + PINMUX_IPSR_MSEL(IP14_7_4, AUDIO_CLKC_A, SEL_ADG_C_0),
8147 +- PINMUX_IPSR_MSEL(IP14_7_4, SSI_WS2_A, SEL_SSI_0),
8148 ++ PINMUX_IPSR_MSEL(IP14_7_4, SSI_WS2_A, SEL_SSI2_0),
8149 + PINMUX_IPSR_MSEL(IP14_7_4, STP_OPWM_0_D, SEL_SSP1_0_3),
8150 + PINMUX_IPSR_GPSR(IP14_7_4, AUDIO_CLKOUT_D),
8151 + PINMUX_IPSR_MSEL(IP14_7_4, SPEEDIN_B, SEL_SPEED_PULSE_1),
8152 +@@ -1292,10 +1292,10 @@ static const u16 pinmux_data[] = {
8153 + PINMUX_IPSR_MSEL(IP14_31_28, MSIOF1_SS2_F, SEL_MSIOF1_5),
8154 +
8155 + /* IPSR15 */
8156 +- PINMUX_IPSR_MSEL(IP15_3_0, SSI_SDATA1_A, SEL_SSI_0),
8157 ++ PINMUX_IPSR_MSEL(IP15_3_0, SSI_SDATA1_A, SEL_SSI1_0),
8158 +
8159 +- PINMUX_IPSR_MSEL(IP15_7_4, SSI_SDATA2_A, SEL_SSI_0),
8160 +- PINMUX_IPSR_MSEL(IP15_7_4, SSI_SCK1_B, SEL_SSI_1),
8161 ++ PINMUX_IPSR_MSEL(IP15_7_4, SSI_SDATA2_A, SEL_SSI2_0),
8162 ++ PINMUX_IPSR_MSEL(IP15_7_4, SSI_SCK1_B, SEL_SSI1_1),
8163 +
8164 + PINMUX_IPSR_GPSR(IP15_11_8, SSI_SCK34),
8165 + PINMUX_IPSR_MSEL(IP15_11_8, MSIOF1_SS1_A, SEL_MSIOF1_0),
8166 +@@ -1381,11 +1381,11 @@ static const u16 pinmux_data[] = {
8167 + PINMUX_IPSR_MSEL(IP16_27_24, RIF1_D1_A, SEL_DRIF1_0),
8168 + PINMUX_IPSR_MSEL(IP16_27_24, RIF3_D1_A, SEL_DRIF3_0),
8169 +
8170 +- PINMUX_IPSR_MSEL(IP16_31_28, SSI_SDATA9_A, SEL_SSI_0),
8171 ++ PINMUX_IPSR_MSEL(IP16_31_28, SSI_SDATA9_A, SEL_SSI9_0),
8172 + PINMUX_IPSR_MSEL(IP16_31_28, HSCK2_B, SEL_HSCIF2_1),
8173 + PINMUX_IPSR_MSEL(IP16_31_28, MSIOF1_SS1_C, SEL_MSIOF1_2),
8174 + PINMUX_IPSR_MSEL(IP16_31_28, HSCK1_A, SEL_HSCIF1_0),
8175 +- PINMUX_IPSR_MSEL(IP16_31_28, SSI_WS1_B, SEL_SSI_1),
8176 ++ PINMUX_IPSR_MSEL(IP16_31_28, SSI_WS1_B, SEL_SSI1_1),
8177 + PINMUX_IPSR_GPSR(IP16_31_28, SCK1),
8178 + PINMUX_IPSR_MSEL(IP16_31_28, STP_IVCXO27_1_A, SEL_SSP1_1_0),
8179 + PINMUX_IPSR_GPSR(IP16_31_28, SCK5_A),
8180 +@@ -1417,7 +1417,7 @@ static const u16 pinmux_data[] = {
8181 +
8182 + PINMUX_IPSR_GPSR(IP17_19_16, USB1_PWEN),
8183 + PINMUX_IPSR_MSEL(IP17_19_16, SIM0_CLK_C, SEL_SIMCARD_2),
8184 +- PINMUX_IPSR_MSEL(IP17_19_16, SSI_SCK1_A, SEL_SSI_0),
8185 ++ PINMUX_IPSR_MSEL(IP17_19_16, SSI_SCK1_A, SEL_SSI1_0),
8186 + PINMUX_IPSR_MSEL(IP17_19_16, TS_SCK0_E, SEL_TSIF0_4),
8187 + PINMUX_IPSR_MSEL(IP17_19_16, STP_ISCLK_0_E, SEL_SSP1_0_4),
8188 + PINMUX_IPSR_MSEL(IP17_19_16, FMCLK_B, SEL_FM_1),
8189 +@@ -1427,7 +1427,7 @@ static const u16 pinmux_data[] = {
8190 +
8191 + PINMUX_IPSR_GPSR(IP17_23_20, USB1_OVC),
8192 + PINMUX_IPSR_MSEL(IP17_23_20, MSIOF1_SS2_C, SEL_MSIOF1_2),
8193 +- PINMUX_IPSR_MSEL(IP17_23_20, SSI_WS1_A, SEL_SSI_0),
8194 ++ PINMUX_IPSR_MSEL(IP17_23_20, SSI_WS1_A, SEL_SSI1_0),
8195 + PINMUX_IPSR_MSEL(IP17_23_20, TS_SDAT0_E, SEL_TSIF0_4),
8196 + PINMUX_IPSR_MSEL(IP17_23_20, STP_ISD_0_E, SEL_SSP1_0_4),
8197 + PINMUX_IPSR_MSEL(IP17_23_20, FMIN_B, SEL_FM_1),
8198 +@@ -1437,7 +1437,7 @@ static const u16 pinmux_data[] = {
8199 +
8200 + PINMUX_IPSR_GPSR(IP17_27_24, USB30_PWEN),
8201 + PINMUX_IPSR_GPSR(IP17_27_24, AUDIO_CLKOUT_B),
8202 +- PINMUX_IPSR_MSEL(IP17_27_24, SSI_SCK2_B, SEL_SSI_1),
8203 ++ PINMUX_IPSR_MSEL(IP17_27_24, SSI_SCK2_B, SEL_SSI2_1),
8204 + PINMUX_IPSR_MSEL(IP17_27_24, TS_SDEN1_D, SEL_TSIF1_3),
8205 + PINMUX_IPSR_MSEL(IP17_27_24, STP_ISEN_1_D, SEL_SSP1_1_2),
8206 + PINMUX_IPSR_MSEL(IP17_27_24, STP_OPWM_0_E, SEL_SSP1_0_4),
8207 +@@ -1449,7 +1449,7 @@ static const u16 pinmux_data[] = {
8208 +
8209 + PINMUX_IPSR_GPSR(IP17_31_28, USB30_OVC),
8210 + PINMUX_IPSR_GPSR(IP17_31_28, AUDIO_CLKOUT1_B),
8211 +- PINMUX_IPSR_MSEL(IP17_31_28, SSI_WS2_B, SEL_SSI_1),
8212 ++ PINMUX_IPSR_MSEL(IP17_31_28, SSI_WS2_B, SEL_SSI2_1),
8213 + PINMUX_IPSR_MSEL(IP17_31_28, TS_SPSYNC1_D, SEL_TSIF1_3),
8214 + PINMUX_IPSR_MSEL(IP17_31_28, STP_ISSYNC_1_D, SEL_SSP1_1_3),
8215 + PINMUX_IPSR_MSEL(IP17_31_28, STP_IVCXO27_0_E, SEL_SSP1_0_4),
8216 +@@ -1460,7 +1460,7 @@ static const u16 pinmux_data[] = {
8217 + /* IPSR18 */
8218 + PINMUX_IPSR_GPSR(IP18_3_0, GP6_30),
8219 + PINMUX_IPSR_GPSR(IP18_3_0, AUDIO_CLKOUT2_B),
8220 +- PINMUX_IPSR_MSEL(IP18_3_0, SSI_SCK9_B, SEL_SSI_1),
8221 ++ PINMUX_IPSR_MSEL(IP18_3_0, SSI_SCK9_B, SEL_SSI9_1),
8222 + PINMUX_IPSR_MSEL(IP18_3_0, TS_SDEN0_E, SEL_TSIF0_4),
8223 + PINMUX_IPSR_MSEL(IP18_3_0, STP_ISEN_0_E, SEL_SSP1_0_4),
8224 + PINMUX_IPSR_MSEL(IP18_3_0, RIF2_D0_B, SEL_DRIF2_1),
8225 +@@ -1471,7 +1471,7 @@ static const u16 pinmux_data[] = {
8226 +
8227 + PINMUX_IPSR_GPSR(IP18_7_4, GP6_31),
8228 + PINMUX_IPSR_GPSR(IP18_7_4, AUDIO_CLKOUT3_B),
8229 +- PINMUX_IPSR_MSEL(IP18_7_4, SSI_WS9_B, SEL_SSI_1),
8230 ++ PINMUX_IPSR_MSEL(IP18_7_4, SSI_WS9_B, SEL_SSI9_1),
8231 + PINMUX_IPSR_MSEL(IP18_7_4, TS_SPSYNC0_E, SEL_TSIF0_4),
8232 + PINMUX_IPSR_MSEL(IP18_7_4, STP_ISSYNC_0_E, SEL_SSP1_0_4),
8233 + PINMUX_IPSR_MSEL(IP18_7_4, RIF2_D1_B, SEL_DRIF2_1),
8234 +diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
8235 +index 83e89e5d4752..b73a2376d913 100644
8236 +--- a/drivers/regulator/gpio-regulator.c
8237 ++++ b/drivers/regulator/gpio-regulator.c
8238 +@@ -268,8 +268,7 @@ static int gpio_regulator_probe(struct platform_device *pdev)
8239 + drvdata->desc.name = kstrdup(config->supply_name, GFP_KERNEL);
8240 + if (drvdata->desc.name == NULL) {
8241 + dev_err(&pdev->dev, "Failed to allocate supply name\n");
8242 +- ret = -ENOMEM;
8243 +- goto err;
8244 ++ return -ENOMEM;
8245 + }
8246 +
8247 + if (config->nr_gpios != 0) {
8248 +@@ -289,7 +288,7 @@ static int gpio_regulator_probe(struct platform_device *pdev)
8249 + dev_err(&pdev->dev,
8250 + "Could not obtain regulator setting GPIOs: %d\n",
8251 + ret);
8252 +- goto err_memstate;
8253 ++ goto err_memgpio;
8254 + }
8255 + }
8256 +
8257 +@@ -300,7 +299,7 @@ static int gpio_regulator_probe(struct platform_device *pdev)
8258 + if (drvdata->states == NULL) {
8259 + dev_err(&pdev->dev, "Failed to allocate state data\n");
8260 + ret = -ENOMEM;
8261 +- goto err_memgpio;
8262 ++ goto err_stategpio;
8263 + }
8264 + drvdata->nr_states = config->nr_states;
8265 +
8266 +@@ -321,7 +320,7 @@ static int gpio_regulator_probe(struct platform_device *pdev)
8267 + default:
8268 + dev_err(&pdev->dev, "No regulator type set\n");
8269 + ret = -EINVAL;
8270 +- goto err_memgpio;
8271 ++ goto err_memstate;
8272 + }
8273 +
8274 + /* build initial state from gpio init data. */
8275 +@@ -358,22 +357,21 @@ static int gpio_regulator_probe(struct platform_device *pdev)
8276 + if (IS_ERR(drvdata->dev)) {
8277 + ret = PTR_ERR(drvdata->dev);
8278 + dev_err(&pdev->dev, "Failed to register regulator: %d\n", ret);
8279 +- goto err_stategpio;
8280 ++ goto err_memstate;
8281 + }
8282 +
8283 + platform_set_drvdata(pdev, drvdata);
8284 +
8285 + return 0;
8286 +
8287 +-err_stategpio:
8288 +- gpio_free_array(drvdata->gpios, drvdata->nr_gpios);
8289 + err_memstate:
8290 + kfree(drvdata->states);
8291 ++err_stategpio:
8292 ++ gpio_free_array(drvdata->gpios, drvdata->nr_gpios);
8293 + err_memgpio:
8294 + kfree(drvdata->gpios);
8295 + err_name:
8296 + kfree(drvdata->desc.name);
8297 +-err:
8298 + return ret;
8299 + }
8300 +
8301 +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
8302 +index 4f613ec99500..037675bb36b6 100644
8303 +--- a/drivers/regulator/of_regulator.c
8304 ++++ b/drivers/regulator/of_regulator.c
8305 +@@ -282,6 +282,7 @@ int of_regulator_match(struct device *dev, struct device_node *node,
8306 + dev_err(dev,
8307 + "failed to parse DT for regulator %s\n",
8308 + child->name);
8309 ++ of_node_put(child);
8310 + return -EINVAL;
8311 + }
8312 + match->of_node = of_node_get(child);
8313 +diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
8314 +index 8327d47e08b6..c46e31e0a6d9 100644
8315 +--- a/drivers/s390/cio/device_fsm.c
8316 ++++ b/drivers/s390/cio/device_fsm.c
8317 +@@ -822,6 +822,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event)
8318 +
8319 + ccw_device_set_timeout(cdev, 0);
8320 + cdev->private->iretry = 255;
8321 ++ cdev->private->async_kill_io_rc = -ETIMEDOUT;
8322 + ret = ccw_device_cancel_halt_clear(cdev);
8323 + if (ret == -EBUSY) {
8324 + ccw_device_set_timeout(cdev, 3*HZ);
8325 +@@ -898,7 +899,7 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
8326 + /* OK, i/o is dead now. Call interrupt handler. */
8327 + if (cdev->handler)
8328 + cdev->handler(cdev, cdev->private->intparm,
8329 +- ERR_PTR(-EIO));
8330 ++ ERR_PTR(cdev->private->async_kill_io_rc));
8331 + }
8332 +
8333 + static void
8334 +@@ -915,14 +916,16 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
8335 + ccw_device_online_verify(cdev, 0);
8336 + if (cdev->handler)
8337 + cdev->handler(cdev, cdev->private->intparm,
8338 +- ERR_PTR(-EIO));
8339 ++ ERR_PTR(cdev->private->async_kill_io_rc));
8340 + }
8341 +
8342 + void ccw_device_kill_io(struct ccw_device *cdev)
8343 + {
8344 + int ret;
8345 +
8346 ++ ccw_device_set_timeout(cdev, 0);
8347 + cdev->private->iretry = 255;
8348 ++ cdev->private->async_kill_io_rc = -EIO;
8349 + ret = ccw_device_cancel_halt_clear(cdev);
8350 + if (ret == -EBUSY) {
8351 + ccw_device_set_timeout(cdev, 3*HZ);
8352 +diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
8353 +index 877d9f601e63..85b289638133 100644
8354 +--- a/drivers/s390/cio/device_ops.c
8355 ++++ b/drivers/s390/cio/device_ops.c
8356 +@@ -158,7 +158,7 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
8357 + }
8358 +
8359 + /**
8360 +- * ccw_device_start_key() - start a s390 channel program with key
8361 ++ * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
8362 + * @cdev: target ccw device
8363 + * @cpa: logical start address of channel program
8364 + * @intparm: user specific interruption parameter; will be presented back to
8365 +@@ -169,10 +169,15 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
8366 + * @key: storage key to be used for the I/O
8367 + * @flags: additional flags; defines the action to be performed for I/O
8368 + * processing.
8369 ++ * @expires: timeout value in jiffies
8370 + *
8371 + * Start a S/390 channel program. When the interrupt arrives, the
8372 + * IRQ handler is called, either immediately, delayed (dev-end missing,
8373 + * or sense required) or never (no IRQ handler registered).
8374 ++ * This function notifies the device driver if the channel program has not
8375 ++ * completed during the time specified by @expires. If a timeout occurs, the
8376 ++ * channel program is terminated via xsch, hsch or csch, and the device's
8377 ++ * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
8378 + * Returns:
8379 + * %0, if the operation was successful;
8380 + * -%EBUSY, if the device is busy, or status pending;
8381 +@@ -181,9 +186,9 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
8382 + * Context:
8383 + * Interrupts disabled, ccw device lock held
8384 + */
8385 +-int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8386 +- unsigned long intparm, __u8 lpm, __u8 key,
8387 +- unsigned long flags)
8388 ++int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
8389 ++ unsigned long intparm, __u8 lpm, __u8 key,
8390 ++ unsigned long flags, int expires)
8391 + {
8392 + struct subchannel *sch;
8393 + int ret;
8394 +@@ -223,6 +228,8 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8395 + switch (ret) {
8396 + case 0:
8397 + cdev->private->intparm = intparm;
8398 ++ if (expires)
8399 ++ ccw_device_set_timeout(cdev, expires);
8400 + break;
8401 + case -EACCES:
8402 + case -ENODEV:
8403 +@@ -233,7 +240,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8404 + }
8405 +
8406 + /**
8407 +- * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key
8408 ++ * ccw_device_start_key() - start a s390 channel program with key
8409 + * @cdev: target ccw device
8410 + * @cpa: logical start address of channel program
8411 + * @intparm: user specific interruption parameter; will be presented back to
8412 +@@ -244,15 +251,10 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8413 + * @key: storage key to be used for the I/O
8414 + * @flags: additional flags; defines the action to be performed for I/O
8415 + * processing.
8416 +- * @expires: timeout value in jiffies
8417 + *
8418 + * Start a S/390 channel program. When the interrupt arrives, the
8419 + * IRQ handler is called, either immediately, delayed (dev-end missing,
8420 + * or sense required) or never (no IRQ handler registered).
8421 +- * This function notifies the device driver if the channel program has not
8422 +- * completed during the time specified by @expires. If a timeout occurs, the
8423 +- * channel program is terminated via xsch, hsch or csch, and the device's
8424 +- * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT).
8425 + * Returns:
8426 + * %0, if the operation was successful;
8427 + * -%EBUSY, if the device is busy, or status pending;
8428 +@@ -261,19 +263,12 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8429 + * Context:
8430 + * Interrupts disabled, ccw device lock held
8431 + */
8432 +-int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa,
8433 +- unsigned long intparm, __u8 lpm, __u8 key,
8434 +- unsigned long flags, int expires)
8435 ++int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa,
8436 ++ unsigned long intparm, __u8 lpm, __u8 key,
8437 ++ unsigned long flags)
8438 + {
8439 +- int ret;
8440 +-
8441 +- if (!cdev)
8442 +- return -ENODEV;
8443 +- ccw_device_set_timeout(cdev, expires);
8444 +- ret = ccw_device_start_key(cdev, cpa, intparm, lpm, key, flags);
8445 +- if (ret != 0)
8446 +- ccw_device_set_timeout(cdev, 0);
8447 +- return ret;
8448 ++ return ccw_device_start_timeout_key(cdev, cpa, intparm, lpm, key,
8449 ++ flags, 0);
8450 + }
8451 +
8452 + /**
8453 +@@ -488,18 +483,20 @@ void ccw_device_get_id(struct ccw_device *cdev, struct ccw_dev_id *dev_id)
8454 + EXPORT_SYMBOL(ccw_device_get_id);
8455 +
8456 + /**
8457 +- * ccw_device_tm_start_key() - perform start function
8458 ++ * ccw_device_tm_start_timeout_key() - perform start function
8459 + * @cdev: ccw device on which to perform the start function
8460 + * @tcw: transport-command word to be started
8461 + * @intparm: user defined parameter to be passed to the interrupt handler
8462 + * @lpm: mask of paths to use
8463 + * @key: storage key to use for storage access
8464 ++ * @expires: time span in jiffies after which to abort request
8465 + *
8466 + * Start the tcw on the given ccw device. Return zero on success, non-zero
8467 + * otherwise.
8468 + */
8469 +-int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
8470 +- unsigned long intparm, u8 lpm, u8 key)
8471 ++int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
8472 ++ unsigned long intparm, u8 lpm, u8 key,
8473 ++ int expires)
8474 + {
8475 + struct subchannel *sch;
8476 + int rc;
8477 +@@ -526,37 +523,32 @@ int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
8478 + return -EACCES;
8479 + }
8480 + rc = cio_tm_start_key(sch, tcw, lpm, key);
8481 +- if (rc == 0)
8482 ++ if (rc == 0) {
8483 + cdev->private->intparm = intparm;
8484 ++ if (expires)
8485 ++ ccw_device_set_timeout(cdev, expires);
8486 ++ }
8487 + return rc;
8488 + }
8489 +-EXPORT_SYMBOL(ccw_device_tm_start_key);
8490 ++EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
8491 +
8492 + /**
8493 +- * ccw_device_tm_start_timeout_key() - perform start function
8494 ++ * ccw_device_tm_start_key() - perform start function
8495 + * @cdev: ccw device on which to perform the start function
8496 + * @tcw: transport-command word to be started
8497 + * @intparm: user defined parameter to be passed to the interrupt handler
8498 + * @lpm: mask of paths to use
8499 + * @key: storage key to use for storage access
8500 +- * @expires: time span in jiffies after which to abort request
8501 + *
8502 + * Start the tcw on the given ccw device. Return zero on success, non-zero
8503 + * otherwise.
8504 + */
8505 +-int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw,
8506 +- unsigned long intparm, u8 lpm, u8 key,
8507 +- int expires)
8508 ++int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw,
8509 ++ unsigned long intparm, u8 lpm, u8 key)
8510 + {
8511 +- int ret;
8512 +-
8513 +- ccw_device_set_timeout(cdev, expires);
8514 +- ret = ccw_device_tm_start_key(cdev, tcw, intparm, lpm, key);
8515 +- if (ret != 0)
8516 +- ccw_device_set_timeout(cdev, 0);
8517 +- return ret;
8518 ++ return ccw_device_tm_start_timeout_key(cdev, tcw, intparm, lpm, key, 0);
8519 + }
8520 +-EXPORT_SYMBOL(ccw_device_tm_start_timeout_key);
8521 ++EXPORT_SYMBOL(ccw_device_tm_start_key);
8522 +
8523 + /**
8524 + * ccw_device_tm_start() - perform start function
8525 +diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
8526 +index 220f49145b2f..1d984342eb53 100644
8527 +--- a/drivers/s390/cio/io_sch.h
8528 ++++ b/drivers/s390/cio/io_sch.h
8529 +@@ -154,6 +154,7 @@ struct ccw_device_private {
8530 + unsigned long intparm; /* user interruption parameter */
8531 + struct qdio_irq *qdio_data;
8532 + struct irb irb; /* device status */
8533 ++ int async_kill_io_rc;
8534 + struct senseid senseid; /* SenseID info */
8535 + struct pgid pgid[8]; /* path group IDs per chpid*/
8536 + struct ccw1 iccws[2]; /* ccws for SNID/SID/SPGID commands */
8537 +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
8538 +index e63597342c96..01699845c42c 100644
8539 +--- a/drivers/scsi/sr.c
8540 ++++ b/drivers/scsi/sr.c
8541 +@@ -522,6 +522,8 @@ static int sr_block_open(struct block_device *bdev, fmode_t mode)
8542 + struct scsi_cd *cd;
8543 + int ret = -ENXIO;
8544 +
8545 ++ check_disk_change(bdev);
8546 ++
8547 + mutex_lock(&sr_mutex);
8548 + cd = scsi_cd_get(bdev->bd_disk);
8549 + if (cd) {
8550 +@@ -582,18 +584,28 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd,
8551 + static unsigned int sr_block_check_events(struct gendisk *disk,
8552 + unsigned int clearing)
8553 + {
8554 +- struct scsi_cd *cd = scsi_cd(disk);
8555 ++ unsigned int ret = 0;
8556 ++ struct scsi_cd *cd;
8557 +
8558 +- if (atomic_read(&cd->device->disk_events_disable_depth))
8559 ++ cd = scsi_cd_get(disk);
8560 ++ if (!cd)
8561 + return 0;
8562 +
8563 +- return cdrom_check_events(&cd->cdi, clearing);
8564 ++ if (!atomic_read(&cd->device->disk_events_disable_depth))
8565 ++ ret = cdrom_check_events(&cd->cdi, clearing);
8566 ++
8567 ++ scsi_cd_put(cd);
8568 ++ return ret;
8569 + }
8570 +
8571 + static int sr_block_revalidate_disk(struct gendisk *disk)
8572 + {
8573 +- struct scsi_cd *cd = scsi_cd(disk);
8574 + struct scsi_sense_hdr sshdr;
8575 ++ struct scsi_cd *cd;
8576 ++
8577 ++ cd = scsi_cd_get(disk);
8578 ++ if (!cd)
8579 ++ return -ENXIO;
8580 +
8581 + /* if the unit is not ready, nothing more to do */
8582 + if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr))
8583 +@@ -602,6 +614,7 @@ static int sr_block_revalidate_disk(struct gendisk *disk)
8584 + sr_cd_check(&cd->cdi);
8585 + get_sectorsize(cd);
8586 + out:
8587 ++ scsi_cd_put(cd);
8588 + return 0;
8589 + }
8590 +
8591 +diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c
8592 +index 520aedd29965..78d3dbac872a 100644
8593 +--- a/drivers/soc/qcom/wcnss_ctrl.c
8594 ++++ b/drivers/soc/qcom/wcnss_ctrl.c
8595 +@@ -247,7 +247,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc)
8596 + /* Increment for next fragment */
8597 + req->seq++;
8598 +
8599 +- data += req->hdr.len;
8600 ++ data += NV_FRAGMENT_SIZE;
8601 + left -= NV_FRAGMENT_SIZE;
8602 + } while (left > 0);
8603 +
8604 +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
8605 +index adc3f56d4773..63231760facc 100644
8606 +--- a/drivers/spi/spi-bcm-qspi.c
8607 ++++ b/drivers/spi/spi-bcm-qspi.c
8608 +@@ -1220,7 +1220,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
8609 + qspi->base[MSPI] = devm_ioremap_resource(dev, res);
8610 + if (IS_ERR(qspi->base[MSPI])) {
8611 + ret = PTR_ERR(qspi->base[MSPI]);
8612 +- goto qspi_probe_err;
8613 ++ goto qspi_resource_err;
8614 + }
8615 + } else {
8616 + goto qspi_resource_err;
8617 +@@ -1231,7 +1231,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
8618 + qspi->base[BSPI] = devm_ioremap_resource(dev, res);
8619 + if (IS_ERR(qspi->base[BSPI])) {
8620 + ret = PTR_ERR(qspi->base[BSPI]);
8621 +- goto qspi_probe_err;
8622 ++ goto qspi_resource_err;
8623 + }
8624 + qspi->bspi_mode = true;
8625 + } else {
8626 +diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
8627 +index eaeb3c51e14b..cb95c3e940f1 100644
8628 +--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
8629 ++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
8630 +@@ -75,6 +75,8 @@ int __init its_fsl_mc_msi_init(void)
8631 +
8632 + for (np = of_find_matching_node(NULL, its_device_id); np;
8633 + np = of_find_matching_node(np, its_device_id)) {
8634 ++ if (!of_device_is_available(np))
8635 ++ continue;
8636 + if (!of_property_read_bool(np, "msi-controller"))
8637 + continue;
8638 +
8639 +diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c
8640 +index a350209ffbd3..31c301d6be62 100644
8641 +--- a/drivers/video/fbdev/sbuslib.c
8642 ++++ b/drivers/video/fbdev/sbuslib.c
8643 +@@ -121,7 +121,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
8644 + unsigned char __user *ured;
8645 + unsigned char __user *ugreen;
8646 + unsigned char __user *ublue;
8647 +- int index, count, i;
8648 ++ unsigned int index, count, i;
8649 +
8650 + if (get_user(index, &c->index) ||
8651 + __get_user(count, &c->count) ||
8652 +@@ -160,7 +160,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg,
8653 + unsigned char __user *ugreen;
8654 + unsigned char __user *ublue;
8655 + struct fb_cmap *cmap = &info->cmap;
8656 +- int index, count, i;
8657 ++ unsigned int index, count, i;
8658 + u8 red, green, blue;
8659 +
8660 + if (get_user(index, &c->index) ||
8661 +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
8662 +index e682bf046e50..88cd2a52d8d3 100644
8663 +--- a/drivers/watchdog/f71808e_wdt.c
8664 ++++ b/drivers/watchdog/f71808e_wdt.c
8665 +@@ -566,7 +566,8 @@ static ssize_t watchdog_write(struct file *file, const char __user *buf,
8666 + char c;
8667 + if (get_user(c, buf + i))
8668 + return -EFAULT;
8669 +- expect_close = (c == 'V');
8670 ++ if (c == 'V')
8671 ++ expect_close = true;
8672 + }
8673 +
8674 + /* Properly order writes across fork()ed processes */
8675 +diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c
8676 +index ce0c38bd0f00..37523f139ccd 100644
8677 +--- a/drivers/watchdog/sbsa_gwdt.c
8678 ++++ b/drivers/watchdog/sbsa_gwdt.c
8679 +@@ -50,6 +50,7 @@
8680 + */
8681 +
8682 + #include <linux/io.h>
8683 ++#include <linux/io-64-nonatomic-lo-hi.h>
8684 + #include <linux/interrupt.h>
8685 + #include <linux/module.h>
8686 + #include <linux/moduleparam.h>
8687 +@@ -159,7 +160,7 @@ static unsigned int sbsa_gwdt_get_timeleft(struct watchdog_device *wdd)
8688 + !(readl(gwdt->control_base + SBSA_GWDT_WCS) & SBSA_GWDT_WCS_WS0))
8689 + timeleft += readl(gwdt->control_base + SBSA_GWDT_WOR);
8690 +
8691 +- timeleft += readq(gwdt->control_base + SBSA_GWDT_WCV) -
8692 ++ timeleft += lo_hi_readq(gwdt->control_base + SBSA_GWDT_WCV) -
8693 + arch_counter_get_cntvct();
8694 +
8695 + do_div(timeleft, gwdt->clk);
8696 +diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
8697 +index 2b28c00da0df..dfe20b81ced5 100644
8698 +--- a/drivers/watchdog/sp5100_tco.h
8699 ++++ b/drivers/watchdog/sp5100_tco.h
8700 +@@ -54,7 +54,7 @@
8701 + #define SB800_PM_WATCHDOG_CONFIG 0x4C
8702 +
8703 + #define SB800_PCI_WATCHDOG_DECODE_EN (1 << 0)
8704 +-#define SB800_PM_WATCHDOG_DISABLE (1 << 2)
8705 ++#define SB800_PM_WATCHDOG_DISABLE (1 << 1)
8706 + #define SB800_PM_WATCHDOG_SECOND_RES (3 << 0)
8707 + #define SB800_ACPI_MMIO_DECODE_EN (1 << 0)
8708 + #define SB800_ACPI_MMIO_SEL (1 << 1)
8709 +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
8710 +index d5dbdb9d24d8..6d3b32ccc2c4 100644
8711 +--- a/drivers/xen/events/events_base.c
8712 ++++ b/drivers/xen/events/events_base.c
8713 +@@ -764,8 +764,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
8714 + mutex_unlock(&irq_mapping_update_lock);
8715 + return irq;
8716 + error_irq:
8717 +- for (; i >= 0; i--)
8718 +- __unbind_from_irq(irq + i);
8719 ++ while (nvec--)
8720 ++ __unbind_from_irq(irq + nvec);
8721 + mutex_unlock(&irq_mapping_update_lock);
8722 + return ret;
8723 + }
8724 +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
8725 +index bb36b1e1dbcc..775d4195966c 100644
8726 +--- a/drivers/xen/grant-table.c
8727 ++++ b/drivers/xen/grant-table.c
8728 +@@ -327,7 +327,7 @@ static void gnttab_handle_deferred(unsigned long unused)
8729 + if (entry->page) {
8730 + pr_debug("freeing g.e. %#x (pfn %#lx)\n",
8731 + entry->ref, page_to_pfn(entry->page));
8732 +- __free_page(entry->page);
8733 ++ put_page(entry->page);
8734 + } else
8735 + pr_info("freeing g.e. %#x\n", entry->ref);
8736 + kfree(entry);
8737 +@@ -383,7 +383,7 @@ void gnttab_end_foreign_access(grant_ref_t ref, int readonly,
8738 + if (gnttab_end_foreign_access_ref(ref, readonly)) {
8739 + put_free_entry(ref);
8740 + if (page != 0)
8741 +- free_page(page);
8742 ++ put_page(virt_to_page(page));
8743 + } else
8744 + gnttab_add_deferred(ref, readonly,
8745 + page ? virt_to_page(page) : NULL);
8746 +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
8747 +index b68ced5a6331..2fe7353ab720 100644
8748 +--- a/drivers/xen/swiotlb-xen.c
8749 ++++ b/drivers/xen/swiotlb-xen.c
8750 +@@ -359,7 +359,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
8751 + * physical address */
8752 + phys = xen_bus_to_phys(dev_addr);
8753 +
8754 +- if (((dev_addr + size - 1 > dma_mask)) ||
8755 ++ if (((dev_addr + size - 1 <= dma_mask)) ||
8756 + range_straddles_page_boundary(phys, size))
8757 + xen_destroy_contiguous_region(phys, order);
8758 +
8759 +diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c
8760 +index 4b857463a2b4..7ff9d25f714e 100644
8761 +--- a/drivers/xen/xen-acpi-processor.c
8762 ++++ b/drivers/xen/xen-acpi-processor.c
8763 +@@ -362,9 +362,9 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv)
8764 + }
8765 + /* There are more ACPI Processor objects than in x2APIC or MADT.
8766 + * This can happen with incorrect ACPI SSDT declerations. */
8767 +- if (acpi_id > nr_acpi_bits) {
8768 +- pr_debug("We only have %u, trying to set %u\n",
8769 +- nr_acpi_bits, acpi_id);
8770 ++ if (acpi_id >= nr_acpi_bits) {
8771 ++ pr_debug("max acpi id %u, trying to set %u\n",
8772 ++ nr_acpi_bits - 1, acpi_id);
8773 + return AE_OK;
8774 + }
8775 + /* OK, There is a ACPI Processor object */
8776 +diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
8777 +index 33a31cfef55d..c2d447687e33 100644
8778 +--- a/drivers/xen/xenbus/xenbus_probe.c
8779 ++++ b/drivers/xen/xenbus/xenbus_probe.c
8780 +@@ -470,8 +470,11 @@ int xenbus_probe_node(struct xen_bus_type *bus,
8781 +
8782 + /* Register with generic device framework. */
8783 + err = device_register(&xendev->dev);
8784 +- if (err)
8785 ++ if (err) {
8786 ++ put_device(&xendev->dev);
8787 ++ xendev = NULL;
8788 + goto fail;
8789 ++ }
8790 +
8791 + return 0;
8792 + fail:
8793 +diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
8794 +index d295d9878dff..8ec79385d3cc 100644
8795 +--- a/drivers/zorro/zorro.c
8796 ++++ b/drivers/zorro/zorro.c
8797 +@@ -16,6 +16,7 @@
8798 + #include <linux/bitops.h>
8799 + #include <linux/string.h>
8800 + #include <linux/platform_device.h>
8801 ++#include <linux/dma-mapping.h>
8802 + #include <linux/slab.h>
8803 +
8804 + #include <asm/byteorder.h>
8805 +@@ -185,6 +186,17 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
8806 + z->dev.parent = &bus->dev;
8807 + z->dev.bus = &zorro_bus_type;
8808 + z->dev.id = i;
8809 ++ switch (z->rom.er_Type & ERT_TYPEMASK) {
8810 ++ case ERT_ZORROIII:
8811 ++ z->dev.coherent_dma_mask = DMA_BIT_MASK(32);
8812 ++ break;
8813 ++
8814 ++ case ERT_ZORROII:
8815 ++ default:
8816 ++ z->dev.coherent_dma_mask = DMA_BIT_MASK(24);
8817 ++ break;
8818 ++ }
8819 ++ z->dev.dma_mask = &z->dev.coherent_dma_mask;
8820 + }
8821 +
8822 + /* ... then register them */
8823 +diff --git a/fs/affs/namei.c b/fs/affs/namei.c
8824 +index 29186d29a3b6..2d4d4952e951 100644
8825 +--- a/fs/affs/namei.c
8826 ++++ b/fs/affs/namei.c
8827 +@@ -224,9 +224,10 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
8828 +
8829 + affs_lock_dir(dir);
8830 + bh = affs_find_entry(dir, dentry);
8831 +- affs_unlock_dir(dir);
8832 +- if (IS_ERR(bh))
8833 ++ if (IS_ERR(bh)) {
8834 ++ affs_unlock_dir(dir);
8835 + return ERR_CAST(bh);
8836 ++ }
8837 + if (bh) {
8838 + u32 ino = bh->b_blocknr;
8839 +
8840 +@@ -240,10 +241,13 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags)
8841 + }
8842 + affs_brelse(bh);
8843 + inode = affs_iget(sb, ino);
8844 +- if (IS_ERR(inode))
8845 ++ if (IS_ERR(inode)) {
8846 ++ affs_unlock_dir(dir);
8847 + return ERR_CAST(inode);
8848 ++ }
8849 + }
8850 + d_add(dentry, inode);
8851 ++ affs_unlock_dir(dir);
8852 + return NULL;
8853 + }
8854 +
8855 +diff --git a/fs/aio.c b/fs/aio.c
8856 +index 0606f033cd9b..42d8c09311d1 100644
8857 +--- a/fs/aio.c
8858 ++++ b/fs/aio.c
8859 +@@ -1074,8 +1074,8 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
8860 +
8861 + ctx = rcu_dereference(table->table[id]);
8862 + if (ctx && ctx->user_id == ctx_id) {
8863 +- percpu_ref_get(&ctx->users);
8864 +- ret = ctx;
8865 ++ if (percpu_ref_tryget_live(&ctx->users))
8866 ++ ret = ctx;
8867 + }
8868 + out:
8869 + rcu_read_unlock();
8870 +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
8871 +index 409b12392474..c94d3390cbfc 100644
8872 +--- a/fs/btrfs/ctree.c
8873 ++++ b/fs/btrfs/ctree.c
8874 +@@ -2760,6 +2760,8 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root
8875 + * contention with the cow code
8876 + */
8877 + if (cow) {
8878 ++ bool last_level = (level == (BTRFS_MAX_LEVEL - 1));
8879 ++
8880 + /*
8881 + * if we don't really need to cow this block
8882 + * then we don't want to set the path blocking,
8883 +@@ -2784,9 +2786,13 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root
8884 + }
8885 +
8886 + btrfs_set_path_blocking(p);
8887 +- err = btrfs_cow_block(trans, root, b,
8888 +- p->nodes[level + 1],
8889 +- p->slots[level + 1], &b);
8890 ++ if (last_level)
8891 ++ err = btrfs_cow_block(trans, root, b, NULL, 0,
8892 ++ &b);
8893 ++ else
8894 ++ err = btrfs_cow_block(trans, root, b,
8895 ++ p->nodes[level + 1],
8896 ++ p->slots[level + 1], &b);
8897 + if (err) {
8898 + ret = err;
8899 + goto done;
8900 +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
8901 +index 1cd325765aaa..c5eafcdb3664 100644
8902 +--- a/fs/btrfs/disk-io.c
8903 ++++ b/fs/btrfs/disk-io.c
8904 +@@ -1281,7 +1281,7 @@ static struct btrfs_subvolume_writers *btrfs_alloc_subvolume_writers(void)
8905 + if (!writers)
8906 + return ERR_PTR(-ENOMEM);
8907 +
8908 +- ret = percpu_counter_init(&writers->counter, 0, GFP_KERNEL);
8909 ++ ret = percpu_counter_init(&writers->counter, 0, GFP_NOFS);
8910 + if (ret < 0) {
8911 + kfree(writers);
8912 + return ERR_PTR(ret);
8913 +@@ -4142,9 +4142,11 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
8914 + btrfs_err(fs_info, "no valid FS found");
8915 + ret = -EINVAL;
8916 + }
8917 +- if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP)
8918 +- btrfs_warn(fs_info, "unrecognized super flag: %llu",
8919 ++ if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) {
8920 ++ btrfs_err(fs_info, "unrecognized or unsupported super flag: %llu",
8921 + btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP);
8922 ++ ret = -EINVAL;
8923 ++ }
8924 + if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) {
8925 + btrfs_err(fs_info, "tree_root level too big: %d >= %d",
8926 + btrfs_super_root_level(sb), BTRFS_MAX_LEVEL);
8927 +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
8928 +index a29730c44850..44a43851404a 100644
8929 +--- a/fs/btrfs/extent-tree.c
8930 ++++ b/fs/btrfs/extent-tree.c
8931 +@@ -4527,6 +4527,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans,
8932 + if (wait_for_alloc) {
8933 + mutex_unlock(&fs_info->chunk_mutex);
8934 + wait_for_alloc = 0;
8935 ++ cond_resched();
8936 + goto again;
8937 + }
8938 +
8939 +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
8940 +index c95ff096cd24..437544846e4e 100644
8941 +--- a/fs/btrfs/file.c
8942 ++++ b/fs/btrfs/file.c
8943 +@@ -1912,10 +1912,19 @@ int btrfs_release_file(struct inode *inode, struct file *filp)
8944 + static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end)
8945 + {
8946 + int ret;
8947 ++ struct blk_plug plug;
8948 +
8949 ++ /*
8950 ++ * This is only called in fsync, which would do synchronous writes, so
8951 ++ * a plug can merge adjacent IOs as much as possible. Esp. in case of
8952 ++ * multiple disks using raid profile, a large IO can be split to
8953 ++ * several segments of stripe length (currently 64K).
8954 ++ */
8955 ++ blk_start_plug(&plug);
8956 + atomic_inc(&BTRFS_I(inode)->sync_writers);
8957 + ret = btrfs_fdatawrite_range(inode, start, end);
8958 + atomic_dec(&BTRFS_I(inode)->sync_writers);
8959 ++ blk_finish_plug(&plug);
8960 +
8961 + return ret;
8962 + }
8963 +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
8964 +index ffd5831ca15c..f073de65e818 100644
8965 +--- a/fs/btrfs/inode.c
8966 ++++ b/fs/btrfs/inode.c
8967 +@@ -6491,8 +6491,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
8968 + goto out_unlock_inode;
8969 + } else {
8970 + btrfs_update_inode(trans, root, inode);
8971 +- unlock_new_inode(inode);
8972 +- d_instantiate(dentry, inode);
8973 ++ d_instantiate_new(dentry, inode);
8974 + }
8975 +
8976 + out_unlock:
8977 +@@ -6567,8 +6566,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
8978 + goto out_unlock_inode;
8979 +
8980 + BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;
8981 +- unlock_new_inode(inode);
8982 +- d_instantiate(dentry, inode);
8983 ++ d_instantiate_new(dentry, inode);
8984 +
8985 + out_unlock:
8986 + btrfs_end_transaction(trans, root);
8987 +@@ -6711,12 +6709,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
8988 + if (err)
8989 + goto out_fail_inode;
8990 +
8991 +- d_instantiate(dentry, inode);
8992 +- /*
8993 +- * mkdir is special. We're unlocking after we call d_instantiate
8994 +- * to avoid a race with nfsd calling d_instantiate.
8995 +- */
8996 +- unlock_new_inode(inode);
8997 ++ d_instantiate_new(dentry, inode);
8998 + drop_on_err = 0;
8999 +
9000 + out_fail:
9001 +@@ -10354,8 +10347,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
9002 + goto out_unlock_inode;
9003 + }
9004 +
9005 +- unlock_new_inode(inode);
9006 +- d_instantiate(dentry, inode);
9007 ++ d_instantiate_new(dentry, inode);
9008 +
9009 + out_unlock:
9010 + btrfs_end_transaction(trans, root);
9011 +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
9012 +index d016d4a79864..af6a776fa18c 100644
9013 +--- a/fs/btrfs/raid56.c
9014 ++++ b/fs/btrfs/raid56.c
9015 +@@ -2161,11 +2161,21 @@ int raid56_parity_recover(struct btrfs_root *root, struct bio *bio,
9016 + }
9017 +
9018 + /*
9019 +- * reconstruct from the q stripe if they are
9020 +- * asking for mirror 3
9021 ++ * Loop retry:
9022 ++ * for 'mirror == 2', reconstruct from all other stripes.
9023 ++ * for 'mirror_num > 2', select a stripe to fail on every retry.
9024 + */
9025 +- if (mirror_num == 3)
9026 +- rbio->failb = rbio->real_stripes - 2;
9027 ++ if (mirror_num > 2) {
9028 ++ /*
9029 ++ * 'mirror == 3' is to fail the p stripe and
9030 ++ * reconstruct from the q stripe. 'mirror > 3' is to
9031 ++ * fail a data stripe and reconstruct from p+q stripe.
9032 ++ */
9033 ++ rbio->failb = rbio->real_stripes - (mirror_num - 1);
9034 ++ ASSERT(rbio->failb > 0);
9035 ++ if (rbio->failb <= rbio->faila)
9036 ++ rbio->failb--;
9037 ++ }
9038 +
9039 + ret = lock_stripe_add(rbio);
9040 +
9041 +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
9042 +index d040afc966fe..c8d2eec6596b 100644
9043 +--- a/fs/btrfs/send.c
9044 ++++ b/fs/btrfs/send.c
9045 +@@ -4822,6 +4822,9 @@ static int send_hole(struct send_ctx *sctx, u64 end)
9046 + u64 len;
9047 + int ret = 0;
9048 +
9049 ++ if (sctx->flags & BTRFS_SEND_FLAG_NO_FILE_DATA)
9050 ++ return send_update_extent(sctx, offset, end - offset);
9051 ++
9052 + p = fs_path_alloc();
9053 + if (!p)
9054 + return -ENOMEM;
9055 +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c
9056 +index ca7cb5e6d385..9c6666692341 100644
9057 +--- a/fs/btrfs/tests/qgroup-tests.c
9058 ++++ b/fs/btrfs/tests/qgroup-tests.c
9059 +@@ -63,7 +63,7 @@ static int insert_normal_tree_ref(struct btrfs_root *root, u64 bytenr,
9060 + btrfs_set_extent_generation(leaf, item, 1);
9061 + btrfs_set_extent_flags(leaf, item, BTRFS_EXTENT_FLAG_TREE_BLOCK);
9062 + block_info = (struct btrfs_tree_block_info *)(item + 1);
9063 +- btrfs_set_tree_block_level(leaf, block_info, 1);
9064 ++ btrfs_set_tree_block_level(leaf, block_info, 0);
9065 + iref = (struct btrfs_extent_inline_ref *)(block_info + 1);
9066 + if (parent > 0) {
9067 + btrfs_set_extent_inline_ref_type(leaf, iref,
9068 +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
9069 +index c65350e5119c..44d34923de9c 100644
9070 +--- a/fs/btrfs/tree-log.c
9071 ++++ b/fs/btrfs/tree-log.c
9072 +@@ -2241,8 +2241,10 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans,
9073 + nritems = btrfs_header_nritems(path->nodes[0]);
9074 + if (path->slots[0] >= nritems) {
9075 + ret = btrfs_next_leaf(root, path);
9076 +- if (ret)
9077 ++ if (ret == 1)
9078 + break;
9079 ++ else if (ret < 0)
9080 ++ goto out;
9081 + }
9082 + btrfs_item_key_to_cpu(path->nodes[0], &found_key,
9083 + path->slots[0]);
9084 +@@ -3397,8 +3399,11 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans,
9085 + * from this directory and from this transaction
9086 + */
9087 + ret = btrfs_next_leaf(root, path);
9088 +- if (ret == 1) {
9089 +- last_offset = (u64)-1;
9090 ++ if (ret) {
9091 ++ if (ret == 1)
9092 ++ last_offset = (u64)-1;
9093 ++ else
9094 ++ err = ret;
9095 + goto done;
9096 + }
9097 + btrfs_item_key_to_cpu(path->nodes[0], &tmp, path->slots[0]);
9098 +@@ -3849,6 +3854,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
9099 + ASSERT(ret == 0);
9100 + src = src_path->nodes[0];
9101 + i = 0;
9102 ++ need_find_last_extent = true;
9103 + }
9104 +
9105 + btrfs_item_key_to_cpu(src, &key, i);
9106 +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
9107 +index c2495cde26f6..76017e1b3c0f 100644
9108 +--- a/fs/btrfs/volumes.c
9109 ++++ b/fs/btrfs/volumes.c
9110 +@@ -5186,7 +5186,14 @@ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len)
9111 + else if (map->type & BTRFS_BLOCK_GROUP_RAID5)
9112 + ret = 2;
9113 + else if (map->type & BTRFS_BLOCK_GROUP_RAID6)
9114 +- ret = 3;
9115 ++ /*
9116 ++ * There could be two corrupted data stripes, we need
9117 ++ * to loop retry in order to rebuild the correct data.
9118 ++ *
9119 ++ * Fail a stripe at a time on every retry except the
9120 ++ * stripe under reconstruction.
9121 ++ */
9122 ++ ret = map->num_stripes;
9123 + else
9124 + ret = 1;
9125 + free_extent_map(em);
9126 +diff --git a/fs/ceph/super.c b/fs/ceph/super.c
9127 +index b382e5910eea..2a8903025853 100644
9128 +--- a/fs/ceph/super.c
9129 ++++ b/fs/ceph/super.c
9130 +@@ -816,7 +816,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
9131 + int err;
9132 + unsigned long started = jiffies; /* note the start time */
9133 + struct dentry *root;
9134 +- int first = 0; /* first vfsmount for this super_block */
9135 +
9136 + dout("mount start %p\n", fsc);
9137 + mutex_lock(&fsc->client->mount_mutex);
9138 +@@ -834,17 +833,17 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
9139 + path = fsc->mount_options->server_path + 1;
9140 + dout("mount opening path %s\n", path);
9141 + }
9142 ++
9143 ++ err = ceph_fs_debugfs_init(fsc);
9144 ++ if (err < 0)
9145 ++ goto out;
9146 ++
9147 + root = open_root_dentry(fsc, path, started);
9148 + if (IS_ERR(root)) {
9149 + err = PTR_ERR(root);
9150 + goto out;
9151 + }
9152 + fsc->sb->s_root = dget(root);
9153 +- first = 1;
9154 +-
9155 +- err = ceph_fs_debugfs_init(fsc);
9156 +- if (err < 0)
9157 +- goto fail;
9158 + } else {
9159 + root = dget(fsc->sb->s_root);
9160 + }
9161 +@@ -854,11 +853,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc)
9162 + mutex_unlock(&fsc->client->mount_mutex);
9163 + return root;
9164 +
9165 +-fail:
9166 +- if (first) {
9167 +- dput(fsc->sb->s_root);
9168 +- fsc->sb->s_root = NULL;
9169 +- }
9170 + out:
9171 + mutex_unlock(&fsc->client->mount_mutex);
9172 + return ERR_PTR(err);
9173 +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
9174 +index cc420d6b71f7..d57222894892 100644
9175 +--- a/fs/cifs/cifssmb.c
9176 ++++ b/fs/cifs/cifssmb.c
9177 +@@ -6413,9 +6413,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
9178 + pSMB->InformationLevel =
9179 + cpu_to_le16(SMB_SET_FILE_EA);
9180 +
9181 +- parm_data =
9182 +- (struct fealist *) (((char *) &pSMB->hdr.Protocol) +
9183 +- offset);
9184 ++ parm_data = (void *)pSMB + offsetof(struct smb_hdr, Protocol) + offset;
9185 + pSMB->ParameterOffset = cpu_to_le16(param_offset);
9186 + pSMB->DataOffset = cpu_to_le16(offset);
9187 + pSMB->SetupCount = 1;
9188 +diff --git a/fs/dcache.c b/fs/dcache.c
9189 +index 2225b9855c5f..7a5e6f9717f5 100644
9190 +--- a/fs/dcache.c
9191 ++++ b/fs/dcache.c
9192 +@@ -1859,6 +1859,28 @@ void d_instantiate(struct dentry *entry, struct inode * inode)
9193 + }
9194 + EXPORT_SYMBOL(d_instantiate);
9195 +
9196 ++/*
9197 ++ * This should be equivalent to d_instantiate() + unlock_new_inode(),
9198 ++ * with lockdep-related part of unlock_new_inode() done before
9199 ++ * anything else. Use that instead of open-coding d_instantiate()/
9200 ++ * unlock_new_inode() combinations.
9201 ++ */
9202 ++void d_instantiate_new(struct dentry *entry, struct inode *inode)
9203 ++{
9204 ++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
9205 ++ BUG_ON(!inode);
9206 ++ lockdep_annotate_inode_mutex_key(inode);
9207 ++ security_d_instantiate(entry, inode);
9208 ++ spin_lock(&inode->i_lock);
9209 ++ __d_instantiate(entry, inode);
9210 ++ WARN_ON(!(inode->i_state & I_NEW));
9211 ++ inode->i_state &= ~I_NEW;
9212 ++ smp_mb();
9213 ++ wake_up_bit(&inode->i_state, __I_NEW);
9214 ++ spin_unlock(&inode->i_lock);
9215 ++}
9216 ++EXPORT_SYMBOL(d_instantiate_new);
9217 ++
9218 + /**
9219 + * d_instantiate_no_diralias - instantiate a non-aliased dentry
9220 + * @entry: dentry to complete
9221 +@@ -2452,7 +2474,7 @@ struct dentry *d_alloc_parallel(struct dentry *parent,
9222 +
9223 + retry:
9224 + rcu_read_lock();
9225 +- seq = smp_load_acquire(&parent->d_inode->i_dir_seq) & ~1;
9226 ++ seq = smp_load_acquire(&parent->d_inode->i_dir_seq);
9227 + r_seq = read_seqbegin(&rename_lock);
9228 + dentry = __d_lookup_rcu(parent, name, &d_seq);
9229 + if (unlikely(dentry)) {
9230 +@@ -2473,8 +2495,14 @@ struct dentry *d_alloc_parallel(struct dentry *parent,
9231 + rcu_read_unlock();
9232 + goto retry;
9233 + }
9234 ++
9235 ++ if (unlikely(seq & 1)) {
9236 ++ rcu_read_unlock();
9237 ++ goto retry;
9238 ++ }
9239 ++
9240 + hlist_bl_lock(b);
9241 +- if (unlikely(parent->d_inode->i_dir_seq != seq)) {
9242 ++ if (unlikely(READ_ONCE(parent->d_inode->i_dir_seq) != seq)) {
9243 + hlist_bl_unlock(b);
9244 + rcu_read_unlock();
9245 + goto retry;
9246 +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
9247 +index cf390dceddd2..5c5ff9f6fe07 100644
9248 +--- a/fs/ecryptfs/inode.c
9249 ++++ b/fs/ecryptfs/inode.c
9250 +@@ -284,8 +284,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
9251 + iget_failed(ecryptfs_inode);
9252 + goto out;
9253 + }
9254 +- unlock_new_inode(ecryptfs_inode);
9255 +- d_instantiate(ecryptfs_dentry, ecryptfs_inode);
9256 ++ d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
9257 + out:
9258 + return rc;
9259 + }
9260 +diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c
9261 +index 814e405a2da6..c8efc5ea1b9f 100644
9262 +--- a/fs/ext2/namei.c
9263 ++++ b/fs/ext2/namei.c
9264 +@@ -40,8 +40,7 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode)
9265 + {
9266 + int err = ext2_add_link(dentry, inode);
9267 + if (!err) {
9268 +- unlock_new_inode(inode);
9269 +- d_instantiate(dentry, inode);
9270 ++ d_instantiate_new(dentry, inode);
9271 + return 0;
9272 + }
9273 + inode_dec_link_count(inode);
9274 +@@ -268,8 +267,7 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
9275 + if (err)
9276 + goto out_fail;
9277 +
9278 +- unlock_new_inode(inode);
9279 +- d_instantiate(dentry, inode);
9280 ++ d_instantiate_new(dentry, inode);
9281 + out:
9282 + return err;
9283 +
9284 +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
9285 +index b1766a67d2eb..248c43b63f13 100644
9286 +--- a/fs/ext4/namei.c
9287 ++++ b/fs/ext4/namei.c
9288 +@@ -2442,8 +2442,7 @@ static int ext4_add_nondir(handle_t *handle,
9289 + int err = ext4_add_entry(handle, dentry, inode);
9290 + if (!err) {
9291 + ext4_mark_inode_dirty(handle, inode);
9292 +- unlock_new_inode(inode);
9293 +- d_instantiate(dentry, inode);
9294 ++ d_instantiate_new(dentry, inode);
9295 + return 0;
9296 + }
9297 + drop_nlink(inode);
9298 +@@ -2682,8 +2681,7 @@ static int ext4_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
9299 + err = ext4_mark_inode_dirty(handle, dir);
9300 + if (err)
9301 + goto out_clear_inode;
9302 +- unlock_new_inode(inode);
9303 +- d_instantiate(dentry, inode);
9304 ++ d_instantiate_new(dentry, inode);
9305 + if (IS_DIRSYNC(dir))
9306 + ext4_handle_sync(handle);
9307 +
9308 +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
9309 +index 63e519658d73..d7b8c8b5fc39 100644
9310 +--- a/fs/f2fs/extent_cache.c
9311 ++++ b/fs/f2fs/extent_cache.c
9312 +@@ -647,6 +647,9 @@ void f2fs_drop_extent_tree(struct inode *inode)
9313 + struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
9314 + struct extent_tree *et = F2FS_I(inode)->extent_tree;
9315 +
9316 ++ if (!f2fs_may_extent_tree(inode))
9317 ++ return;
9318 ++
9319 + set_inode_flag(inode, FI_NO_EXTENT);
9320 +
9321 + write_lock(&et->lock);
9322 +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
9323 +index 8556fe1ccb8a..ccb99d5cfd8b 100644
9324 +--- a/fs/f2fs/namei.c
9325 ++++ b/fs/f2fs/namei.c
9326 +@@ -158,8 +158,7 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode,
9327 +
9328 + alloc_nid_done(sbi, ino);
9329 +
9330 +- d_instantiate(dentry, inode);
9331 +- unlock_new_inode(inode);
9332 ++ d_instantiate_new(dentry, inode);
9333 +
9334 + if (IS_DIRSYNC(dir))
9335 + f2fs_sync_fs(sbi->sb, 1);
9336 +@@ -464,8 +463,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry,
9337 + err = page_symlink(inode, disk_link.name, disk_link.len);
9338 +
9339 + err_out:
9340 +- d_instantiate(dentry, inode);
9341 +- unlock_new_inode(inode);
9342 ++ d_instantiate_new(dentry, inode);
9343 +
9344 + /*
9345 + * Let's flush symlink data in order to avoid broken symlink as much as
9346 +@@ -519,8 +517,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
9347 +
9348 + alloc_nid_done(sbi, inode->i_ino);
9349 +
9350 +- d_instantiate(dentry, inode);
9351 +- unlock_new_inode(inode);
9352 ++ d_instantiate_new(dentry, inode);
9353 +
9354 + if (IS_DIRSYNC(dir))
9355 + f2fs_sync_fs(sbi->sb, 1);
9356 +@@ -564,8 +561,7 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry,
9357 +
9358 + alloc_nid_done(sbi, inode->i_ino);
9359 +
9360 +- d_instantiate(dentry, inode);
9361 +- unlock_new_inode(inode);
9362 ++ d_instantiate_new(dentry, inode);
9363 +
9364 + if (IS_DIRSYNC(dir))
9365 + f2fs_sync_fs(sbi->sb, 1);
9366 +diff --git a/fs/fscache/page.c b/fs/fscache/page.c
9367 +index c8c4f79c7ce1..8a7923a4f93c 100644
9368 +--- a/fs/fscache/page.c
9369 ++++ b/fs/fscache/page.c
9370 +@@ -776,6 +776,7 @@ static void fscache_write_op(struct fscache_operation *_op)
9371 +
9372 + _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage));
9373 +
9374 ++again:
9375 + spin_lock(&object->lock);
9376 + cookie = object->cookie;
9377 +
9378 +@@ -816,10 +817,6 @@ static void fscache_write_op(struct fscache_operation *_op)
9379 + goto superseded;
9380 + page = results[0];
9381 + _debug("gang %d [%lx]", n, page->index);
9382 +- if (page->index >= op->store_limit) {
9383 +- fscache_stat(&fscache_n_store_pages_over_limit);
9384 +- goto superseded;
9385 +- }
9386 +
9387 + radix_tree_tag_set(&cookie->stores, page->index,
9388 + FSCACHE_COOKIE_STORING_TAG);
9389 +@@ -829,6 +826,9 @@ static void fscache_write_op(struct fscache_operation *_op)
9390 + spin_unlock(&cookie->stores_lock);
9391 + spin_unlock(&object->lock);
9392 +
9393 ++ if (page->index >= op->store_limit)
9394 ++ goto discard_page;
9395 ++
9396 + fscache_stat(&fscache_n_store_pages);
9397 + fscache_stat(&fscache_n_cop_write_page);
9398 + ret = object->cache->ops->write_page(op, page);
9399 +@@ -844,6 +844,11 @@ static void fscache_write_op(struct fscache_operation *_op)
9400 + _leave("");
9401 + return;
9402 +
9403 ++discard_page:
9404 ++ fscache_stat(&fscache_n_store_pages_over_limit);
9405 ++ fscache_end_page_write(object, page);
9406 ++ goto again;
9407 ++
9408 + superseded:
9409 + /* this writer is going away and there aren't any more things to
9410 + * write */
9411 +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
9412 +index 39c382f16272..ff93e96099d8 100644
9413 +--- a/fs/gfs2/file.c
9414 ++++ b/fs/gfs2/file.c
9415 +@@ -801,7 +801,7 @@ static long __gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t
9416 + struct gfs2_inode *ip = GFS2_I(inode);
9417 + struct gfs2_alloc_parms ap = { .aflags = 0, };
9418 + unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
9419 +- loff_t bytes, max_bytes, max_blks = UINT_MAX;
9420 ++ loff_t bytes, max_bytes, max_blks;
9421 + int error;
9422 + const loff_t pos = offset;
9423 + const loff_t count = len;
9424 +@@ -853,7 +853,8 @@ static long __gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t
9425 + return error;
9426 + /* ap.allowed tells us how many blocks quota will allow
9427 + * us to write. Check if this reduces max_blks */
9428 +- if (ap.allowed && ap.allowed < max_blks)
9429 ++ max_blks = UINT_MAX;
9430 ++ if (ap.allowed)
9431 + max_blks = ap.allowed;
9432 +
9433 + error = gfs2_inplace_reserve(ip, &ap);
9434 +diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
9435 +index 5e47c935a515..836f29480be6 100644
9436 +--- a/fs/gfs2/quota.h
9437 ++++ b/fs/gfs2/quota.h
9438 +@@ -45,6 +45,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
9439 + {
9440 + struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode);
9441 + int ret;
9442 ++
9443 ++ ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
9444 + if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
9445 + return 0;
9446 + ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
9447 +diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
9448 +index 0a754f38462e..e5a6deb38e1e 100644
9449 +--- a/fs/jffs2/dir.c
9450 ++++ b/fs/jffs2/dir.c
9451 +@@ -209,8 +209,7 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry,
9452 + __func__, inode->i_ino, inode->i_mode, inode->i_nlink,
9453 + f->inocache->pino_nlink, inode->i_mapping->nrpages);
9454 +
9455 +- unlock_new_inode(inode);
9456 +- d_instantiate(dentry, inode);
9457 ++ d_instantiate_new(dentry, inode);
9458 + return 0;
9459 +
9460 + fail:
9461 +@@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
9462 + mutex_unlock(&dir_f->sem);
9463 + jffs2_complete_reservation(c);
9464 +
9465 +- unlock_new_inode(inode);
9466 +- d_instantiate(dentry, inode);
9467 ++ d_instantiate_new(dentry, inode);
9468 + return 0;
9469 +
9470 + fail:
9471 +@@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, umode_t mode
9472 + mutex_unlock(&dir_f->sem);
9473 + jffs2_complete_reservation(c);
9474 +
9475 +- unlock_new_inode(inode);
9476 +- d_instantiate(dentry, inode);
9477 ++ d_instantiate_new(dentry, inode);
9478 + return 0;
9479 +
9480 + fail:
9481 +@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, umode_t mode
9482 + mutex_unlock(&dir_f->sem);
9483 + jffs2_complete_reservation(c);
9484 +
9485 +- unlock_new_inode(inode);
9486 +- d_instantiate(dentry, inode);
9487 ++ d_instantiate_new(dentry, inode);
9488 + return 0;
9489 +
9490 + fail:
9491 +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
9492 +index 567653f7c0ce..c9c47d03a690 100644
9493 +--- a/fs/jffs2/fs.c
9494 ++++ b/fs/jffs2/fs.c
9495 +@@ -361,7 +361,6 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
9496 + ret = -EIO;
9497 + error:
9498 + mutex_unlock(&f->sem);
9499 +- jffs2_do_clear_inode(c, f);
9500 + iget_failed(inode);
9501 + return ERR_PTR(ret);
9502 + }
9503 +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c
9504 +index b41596d71858..56c3fcbfe80e 100644
9505 +--- a/fs/jfs/namei.c
9506 ++++ b/fs/jfs/namei.c
9507 +@@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, umode_t mode,
9508 + unlock_new_inode(ip);
9509 + iput(ip);
9510 + } else {
9511 +- unlock_new_inode(ip);
9512 +- d_instantiate(dentry, ip);
9513 ++ d_instantiate_new(dentry, ip);
9514 + }
9515 +
9516 + out2:
9517 +@@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, umode_t mode)
9518 + unlock_new_inode(ip);
9519 + iput(ip);
9520 + } else {
9521 +- unlock_new_inode(ip);
9522 +- d_instantiate(dentry, ip);
9523 ++ d_instantiate_new(dentry, ip);
9524 + }
9525 +
9526 + out2:
9527 +@@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry,
9528 + unlock_new_inode(ip);
9529 + iput(ip);
9530 + } else {
9531 +- unlock_new_inode(ip);
9532 +- d_instantiate(dentry, ip);
9533 ++ d_instantiate_new(dentry, ip);
9534 + }
9535 +
9536 + out2:
9537 +@@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry,
9538 + unlock_new_inode(ip);
9539 + iput(ip);
9540 + } else {
9541 +- unlock_new_inode(ip);
9542 +- d_instantiate(dentry, ip);
9543 ++ d_instantiate_new(dentry, ip);
9544 + }
9545 +
9546 + out1:
9547 +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
9548 +index 1b1b616a6171..91e017ca7072 100644
9549 +--- a/fs/nfs/nfs4proc.c
9550 ++++ b/fs/nfs/nfs4proc.c
9551 +@@ -1934,7 +1934,7 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta
9552 + return ret;
9553 + }
9554 +
9555 +-static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, int err)
9556 ++static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, struct file_lock *fl, int err)
9557 + {
9558 + switch (err) {
9559 + default:
9560 +@@ -1981,7 +1981,11 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
9561 + return -EAGAIN;
9562 + case -ENOMEM:
9563 + case -NFS4ERR_DENIED:
9564 +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */
9565 ++ if (fl) {
9566 ++ struct nfs4_lock_state *lsp = fl->fl_u.nfs4_fl.owner;
9567 ++ if (lsp)
9568 ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags);
9569 ++ }
9570 + return 0;
9571 + }
9572 + return err;
9573 +@@ -2017,7 +2021,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
9574 + err = nfs4_open_recover_helper(opendata, FMODE_READ);
9575 + }
9576 + nfs4_opendata_put(opendata);
9577 +- return nfs4_handle_delegation_recall_error(server, state, stateid, err);
9578 ++ return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err);
9579 + }
9580 +
9581 + static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata)
9582 +@@ -6499,7 +6503,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
9583 + if (err != 0)
9584 + return err;
9585 + err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
9586 +- return nfs4_handle_delegation_recall_error(server, state, stateid, err);
9587 ++ return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
9588 + }
9589 +
9590 + struct nfs_release_lockowner_data {
9591 +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
9592 +index 0bb0e620cf42..353691366fca 100644
9593 +--- a/fs/nfs/nfs4state.c
9594 ++++ b/fs/nfs/nfs4state.c
9595 +@@ -1429,6 +1429,7 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_
9596 + struct inode *inode = state->inode;
9597 + struct nfs_inode *nfsi = NFS_I(inode);
9598 + struct file_lock *fl;
9599 ++ struct nfs4_lock_state *lsp;
9600 + int status = 0;
9601 + struct file_lock_context *flctx = inode->i_flctx;
9602 + struct list_head *list;
9603 +@@ -1469,7 +1470,9 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_
9604 + case -NFS4ERR_DENIED:
9605 + case -NFS4ERR_RECLAIM_BAD:
9606 + case -NFS4ERR_RECLAIM_CONFLICT:
9607 +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */
9608 ++ lsp = fl->fl_u.nfs4_fl.owner;
9609 ++ if (lsp)
9610 ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags);
9611 + status = 0;
9612 + }
9613 + spin_lock(&flctx->flc_lock);
9614 +diff --git a/fs/nfs/nfs4sysctl.c b/fs/nfs/nfs4sysctl.c
9615 +index 8693d77c45ea..76241aa8d853 100644
9616 +--- a/fs/nfs/nfs4sysctl.c
9617 ++++ b/fs/nfs/nfs4sysctl.c
9618 +@@ -31,7 +31,7 @@ static struct ctl_table nfs4_cb_sysctls[] = {
9619 + .data = &nfs_idmap_cache_timeout,
9620 + .maxlen = sizeof(int),
9621 + .mode = 0644,
9622 +- .proc_handler = proc_dointvec_jiffies,
9623 ++ .proc_handler = proc_dointvec,
9624 + },
9625 + { }
9626 + };
9627 +diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c
9628 +index 2b71c60fe982..163131809e36 100644
9629 +--- a/fs/nilfs2/namei.c
9630 ++++ b/fs/nilfs2/namei.c
9631 +@@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode)
9632 + int err = nilfs_add_link(dentry, inode);
9633 +
9634 + if (!err) {
9635 +- d_instantiate(dentry, inode);
9636 +- unlock_new_inode(inode);
9637 ++ d_instantiate_new(dentry, inode);
9638 + return 0;
9639 + }
9640 + inode_dec_link_count(inode);
9641 +@@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
9642 + goto out_fail;
9643 +
9644 + nilfs_mark_inode_dirty(inode);
9645 +- d_instantiate(dentry, inode);
9646 +- unlock_new_inode(inode);
9647 ++ d_instantiate_new(dentry, inode);
9648 + out:
9649 + if (!err)
9650 + err = nilfs_transaction_commit(dir->i_sb);
9651 +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
9652 +index bed1fcb63088..ee8dbbae78b6 100644
9653 +--- a/fs/ocfs2/acl.c
9654 ++++ b/fs/ocfs2/acl.c
9655 +@@ -314,7 +314,9 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type)
9656 + return ERR_PTR(ret);
9657 + }
9658 +
9659 ++ down_read(&OCFS2_I(inode)->ip_xattr_sem);
9660 + acl = ocfs2_get_acl_nolock(inode, type, di_bh);
9661 ++ up_read(&OCFS2_I(inode)->ip_xattr_sem);
9662 +
9663 + ocfs2_inode_unlock(inode, 0);
9664 + brelse(di_bh);
9665 +@@ -333,7 +335,9 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
9666 + if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
9667 + return 0;
9668 +
9669 ++ down_read(&OCFS2_I(inode)->ip_xattr_sem);
9670 + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
9671 ++ up_read(&OCFS2_I(inode)->ip_xattr_sem);
9672 + if (IS_ERR(acl) || !acl)
9673 + return PTR_ERR(acl);
9674 + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
9675 +@@ -364,8 +368,10 @@ int ocfs2_init_acl(handle_t *handle,
9676 +
9677 + if (!S_ISLNK(inode->i_mode)) {
9678 + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
9679 ++ down_read(&OCFS2_I(dir)->ip_xattr_sem);
9680 + acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
9681 + dir_bh);
9682 ++ up_read(&OCFS2_I(dir)->ip_xattr_sem);
9683 + if (IS_ERR(acl))
9684 + return PTR_ERR(acl);
9685 + }
9686 +diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
9687 +index 733e4e79c8e2..73be0c6dba5d 100644
9688 +--- a/fs/ocfs2/dlm/dlmdomain.c
9689 ++++ b/fs/ocfs2/dlm/dlmdomain.c
9690 +@@ -675,20 +675,6 @@ static void dlm_leave_domain(struct dlm_ctxt *dlm)
9691 + spin_unlock(&dlm->spinlock);
9692 + }
9693 +
9694 +-int dlm_shutting_down(struct dlm_ctxt *dlm)
9695 +-{
9696 +- int ret = 0;
9697 +-
9698 +- spin_lock(&dlm_domain_lock);
9699 +-
9700 +- if (dlm->dlm_state == DLM_CTXT_IN_SHUTDOWN)
9701 +- ret = 1;
9702 +-
9703 +- spin_unlock(&dlm_domain_lock);
9704 +-
9705 +- return ret;
9706 +-}
9707 +-
9708 + void dlm_unregister_domain(struct dlm_ctxt *dlm)
9709 + {
9710 + int leave = 0;
9711 +diff --git a/fs/ocfs2/dlm/dlmdomain.h b/fs/ocfs2/dlm/dlmdomain.h
9712 +index fd6122a38dbd..8a9281411c18 100644
9713 +--- a/fs/ocfs2/dlm/dlmdomain.h
9714 ++++ b/fs/ocfs2/dlm/dlmdomain.h
9715 +@@ -28,7 +28,30 @@
9716 + extern spinlock_t dlm_domain_lock;
9717 + extern struct list_head dlm_domains;
9718 +
9719 +-int dlm_shutting_down(struct dlm_ctxt *dlm);
9720 ++static inline int dlm_joined(struct dlm_ctxt *dlm)
9721 ++{
9722 ++ int ret = 0;
9723 ++
9724 ++ spin_lock(&dlm_domain_lock);
9725 ++ if (dlm->dlm_state == DLM_CTXT_JOINED)
9726 ++ ret = 1;
9727 ++ spin_unlock(&dlm_domain_lock);
9728 ++
9729 ++ return ret;
9730 ++}
9731 ++
9732 ++static inline int dlm_shutting_down(struct dlm_ctxt *dlm)
9733 ++{
9734 ++ int ret = 0;
9735 ++
9736 ++ spin_lock(&dlm_domain_lock);
9737 ++ if (dlm->dlm_state == DLM_CTXT_IN_SHUTDOWN)
9738 ++ ret = 1;
9739 ++ spin_unlock(&dlm_domain_lock);
9740 ++
9741 ++ return ret;
9742 ++}
9743 ++
9744 + void dlm_fire_domain_eviction_callbacks(struct dlm_ctxt *dlm,
9745 + int node_num);
9746 +
9747 +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
9748 +index eef324823311..844dc8da53fb 100644
9749 +--- a/fs/ocfs2/dlm/dlmrecovery.c
9750 ++++ b/fs/ocfs2/dlm/dlmrecovery.c
9751 +@@ -1378,6 +1378,15 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data,
9752 + if (!dlm_grab(dlm))
9753 + return -EINVAL;
9754 +
9755 ++ if (!dlm_joined(dlm)) {
9756 ++ mlog(ML_ERROR, "Domain %s not joined! "
9757 ++ "lockres %.*s, master %u\n",
9758 ++ dlm->name, mres->lockname_len,
9759 ++ mres->lockname, mres->master);
9760 ++ dlm_put(dlm);
9761 ++ return -EINVAL;
9762 ++ }
9763 ++
9764 + BUG_ON(!(mres->flags & (DLM_MRES_RECOVERY|DLM_MRES_MIGRATION)));
9765 +
9766 + real_master = mres->master;
9767 +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
9768 +index a244f14c6b87..fa947d36ae1d 100644
9769 +--- a/fs/ocfs2/journal.c
9770 ++++ b/fs/ocfs2/journal.c
9771 +@@ -666,23 +666,24 @@ static int __ocfs2_journal_access(handle_t *handle,
9772 + /* we can safely remove this assertion after testing. */
9773 + if (!buffer_uptodate(bh)) {
9774 + mlog(ML_ERROR, "giving me a buffer that's not uptodate!\n");
9775 +- mlog(ML_ERROR, "b_blocknr=%llu\n",
9776 +- (unsigned long long)bh->b_blocknr);
9777 ++ mlog(ML_ERROR, "b_blocknr=%llu, b_state=0x%lx\n",
9778 ++ (unsigned long long)bh->b_blocknr, bh->b_state);
9779 +
9780 + lock_buffer(bh);
9781 + /*
9782 +- * A previous attempt to write this buffer head failed.
9783 +- * Nothing we can do but to retry the write and hope for
9784 +- * the best.
9785 ++ * A previous transaction with a couple of buffer heads fail
9786 ++ * to checkpoint, so all the bhs are marked as BH_Write_EIO.
9787 ++ * For current transaction, the bh is just among those error
9788 ++ * bhs which previous transaction handle. We can't just clear
9789 ++ * its BH_Write_EIO and reuse directly, since other bhs are
9790 ++ * not written to disk yet and that will cause metadata
9791 ++ * inconsistency. So we should set fs read-only to avoid
9792 ++ * further damage.
9793 + */
9794 + if (buffer_write_io_error(bh) && !buffer_uptodate(bh)) {
9795 +- clear_buffer_write_io_error(bh);
9796 +- set_buffer_uptodate(bh);
9797 +- }
9798 +-
9799 +- if (!buffer_uptodate(bh)) {
9800 + unlock_buffer(bh);
9801 +- return -EIO;
9802 ++ return ocfs2_error(osb->sb, "A previous attempt to "
9803 ++ "write this buffer head failed\n");
9804 + }
9805 + unlock_buffer(bh);
9806 + }
9807 +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
9808 +index f56fe39fab04..64dfbe5755da 100644
9809 +--- a/fs/ocfs2/super.c
9810 ++++ b/fs/ocfs2/super.c
9811 +@@ -473,9 +473,8 @@ static int ocfs2_init_global_system_inodes(struct ocfs2_super *osb)
9812 + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
9813 + if (!new) {
9814 + ocfs2_release_system_inodes(osb);
9815 +- status = -EINVAL;
9816 ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
9817 + mlog_errno(status);
9818 +- /* FIXME: Should ERROR_RO_FS */
9819 + mlog(ML_ERROR, "Unable to load system inode %d, "
9820 + "possibly corrupt fs?", i);
9821 + goto bail;
9822 +@@ -504,7 +503,7 @@ static int ocfs2_init_local_system_inodes(struct ocfs2_super *osb)
9823 + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
9824 + if (!new) {
9825 + ocfs2_release_system_inodes(osb);
9826 +- status = -EINVAL;
9827 ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
9828 + mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n",
9829 + status, i, osb->slot_num);
9830 + goto bail;
9831 +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
9832 +index cb157a34a656..03f6ff249edb 100644
9833 +--- a/fs/ocfs2/xattr.c
9834 ++++ b/fs/ocfs2/xattr.c
9835 +@@ -638,9 +638,11 @@ int ocfs2_calc_xattr_init(struct inode *dir,
9836 + si->value_len);
9837 +
9838 + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
9839 ++ down_read(&OCFS2_I(dir)->ip_xattr_sem);
9840 + acl_len = ocfs2_xattr_get_nolock(dir, dir_bh,
9841 + OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT,
9842 + "", NULL, 0);
9843 ++ up_read(&OCFS2_I(dir)->ip_xattr_sem);
9844 + if (acl_len > 0) {
9845 + a_size = ocfs2_xattr_entry_real_size(0, acl_len);
9846 + if (S_ISDIR(mode))
9847 +diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c
9848 +index 7c315938e9c2..561497a7a247 100644
9849 +--- a/fs/orangefs/namei.c
9850 ++++ b/fs/orangefs/namei.c
9851 +@@ -70,8 +70,7 @@ static int orangefs_create(struct inode *dir,
9852 + get_khandle_from_ino(inode),
9853 + dentry);
9854 +
9855 +- d_instantiate(dentry, inode);
9856 +- unlock_new_inode(inode);
9857 ++ d_instantiate_new(dentry, inode);
9858 + orangefs_set_timeout(dentry);
9859 + ORANGEFS_I(inode)->getattr_time = jiffies - 1;
9860 +
9861 +@@ -318,8 +317,7 @@ static int orangefs_symlink(struct inode *dir,
9862 + "Assigned symlink inode new number of %pU\n",
9863 + get_khandle_from_ino(inode));
9864 +
9865 +- d_instantiate(dentry, inode);
9866 +- unlock_new_inode(inode);
9867 ++ d_instantiate_new(dentry, inode);
9868 + orangefs_set_timeout(dentry);
9869 + ORANGEFS_I(inode)->getattr_time = jiffies - 1;
9870 +
9871 +@@ -382,8 +380,7 @@ static int orangefs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
9872 + "Assigned dir inode new number of %pU\n",
9873 + get_khandle_from_ino(inode));
9874 +
9875 +- d_instantiate(dentry, inode);
9876 +- unlock_new_inode(inode);
9877 ++ d_instantiate_new(dentry, inode);
9878 + orangefs_set_timeout(dentry);
9879 + ORANGEFS_I(inode)->getattr_time = jiffies - 1;
9880 +
9881 +diff --git a/fs/proc/base.c b/fs/proc/base.c
9882 +index 3fec83ba75fa..591bf2b1ab66 100644
9883 +--- a/fs/proc/base.c
9884 ++++ b/fs/proc/base.c
9885 +@@ -94,6 +94,8 @@
9886 + #include "internal.h"
9887 + #include "fd.h"
9888 +
9889 ++#include "../../lib/kstrtox.h"
9890 ++
9891 + /* NOTE:
9892 + * Implementing inode permission operations in /proc is almost
9893 + * certainly an error. Permission checks need to happen during
9894 +@@ -1864,8 +1866,33 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx,
9895 + static int dname_to_vma_addr(struct dentry *dentry,
9896 + unsigned long *start, unsigned long *end)
9897 + {
9898 +- if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2)
9899 ++ const char *str = dentry->d_name.name;
9900 ++ unsigned long long sval, eval;
9901 ++ unsigned int len;
9902 ++
9903 ++ len = _parse_integer(str, 16, &sval);
9904 ++ if (len & KSTRTOX_OVERFLOW)
9905 ++ return -EINVAL;
9906 ++ if (sval != (unsigned long)sval)
9907 + return -EINVAL;
9908 ++ str += len;
9909 ++
9910 ++ if (*str != '-')
9911 ++ return -EINVAL;
9912 ++ str++;
9913 ++
9914 ++ len = _parse_integer(str, 16, &eval);
9915 ++ if (len & KSTRTOX_OVERFLOW)
9916 ++ return -EINVAL;
9917 ++ if (eval != (unsigned long)eval)
9918 ++ return -EINVAL;
9919 ++ str += len;
9920 ++
9921 ++ if (*str != '\0')
9922 ++ return -EINVAL;
9923 ++
9924 ++ *start = sval;
9925 ++ *end = eval;
9926 +
9927 + return 0;
9928 + }
9929 +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
9930 +index df7e07986ead..7ed961c0124f 100644
9931 +--- a/fs/proc/kcore.c
9932 ++++ b/fs/proc/kcore.c
9933 +@@ -505,6 +505,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
9934 + /* we have to zero-fill user buffer even if no read */
9935 + if (copy_to_user(buffer, buf, tsz))
9936 + return -EFAULT;
9937 ++ } else if (m->type == KCORE_USER) {
9938 ++ /* User page is handled prior to normal kernel page: */
9939 ++ if (copy_to_user(buffer, (char *)start, tsz))
9940 ++ return -EFAULT;
9941 + } else {
9942 + if (kern_addr_valid(start)) {
9943 + /*
9944 +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
9945 +index d4e37acd4821..847f23420b40 100644
9946 +--- a/fs/proc/proc_sysctl.c
9947 ++++ b/fs/proc/proc_sysctl.c
9948 +@@ -660,7 +660,10 @@ static bool proc_sys_link_fill_cache(struct file *file,
9949 + struct ctl_table *table)
9950 + {
9951 + bool ret = true;
9952 ++
9953 + head = sysctl_head_grab(head);
9954 ++ if (IS_ERR(head))
9955 ++ return false;
9956 +
9957 + if (S_ISLNK(table->mode)) {
9958 + /* It is not an error if we can not follow the link ignore it */
9959 +diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
9960 +index e6a2b406af36..1ec728cf82d1 100644
9961 +--- a/fs/reiserfs/namei.c
9962 ++++ b/fs/reiserfs/namei.c
9963 +@@ -687,8 +687,7 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod
9964 + reiserfs_update_inode_transaction(inode);
9965 + reiserfs_update_inode_transaction(dir);
9966 +
9967 +- unlock_new_inode(inode);
9968 +- d_instantiate(dentry, inode);
9969 ++ d_instantiate_new(dentry, inode);
9970 + retval = journal_end(&th);
9971 +
9972 + out_failed:
9973 +@@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode
9974 + goto out_failed;
9975 + }
9976 +
9977 +- unlock_new_inode(inode);
9978 +- d_instantiate(dentry, inode);
9979 ++ d_instantiate_new(dentry, inode);
9980 + retval = journal_end(&th);
9981 +
9982 + out_failed:
9983 +@@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
9984 + /* the above add_entry did not update dir's stat data */
9985 + reiserfs_update_sd(&th, dir);
9986 +
9987 +- unlock_new_inode(inode);
9988 +- d_instantiate(dentry, inode);
9989 ++ d_instantiate_new(dentry, inode);
9990 + retval = journal_end(&th);
9991 + out_failed:
9992 + reiserfs_write_unlock(dir->i_sb);
9993 +@@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode *parent_dir,
9994 + goto out_failed;
9995 + }
9996 +
9997 +- unlock_new_inode(inode);
9998 +- d_instantiate(dentry, inode);
9999 ++ d_instantiate_new(dentry, inode);
10000 + retval = journal_end(&th);
10001 + out_failed:
10002 + reiserfs_write_unlock(parent_dir->i_sb);
10003 +diff --git a/fs/udf/namei.c b/fs/udf/namei.c
10004 +index 2d65e280748b..348b922d1b6a 100644
10005 +--- a/fs/udf/namei.c
10006 ++++ b/fs/udf/namei.c
10007 +@@ -621,8 +621,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode)
10008 + if (fibh.sbh != fibh.ebh)
10009 + brelse(fibh.ebh);
10010 + brelse(fibh.sbh);
10011 +- unlock_new_inode(inode);
10012 +- d_instantiate(dentry, inode);
10013 ++ d_instantiate_new(dentry, inode);
10014 +
10015 + return 0;
10016 + }
10017 +@@ -732,8 +731,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
10018 + inc_nlink(dir);
10019 + dir->i_ctime = dir->i_mtime = current_time(dir);
10020 + mark_inode_dirty(dir);
10021 +- unlock_new_inode(inode);
10022 +- d_instantiate(dentry, inode);
10023 ++ d_instantiate_new(dentry, inode);
10024 + if (fibh.sbh != fibh.ebh)
10025 + brelse(fibh.ebh);
10026 + brelse(fibh.sbh);
10027 +diff --git a/fs/udf/super.c b/fs/udf/super.c
10028 +index 4b1f6d5372c3..12467ad608cd 100644
10029 +--- a/fs/udf/super.c
10030 ++++ b/fs/udf/super.c
10031 +@@ -2094,8 +2094,9 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
10032 + bool lvid_open = false;
10033 +
10034 + uopt.flags = (1 << UDF_FLAG_USE_AD_IN_ICB) | (1 << UDF_FLAG_STRICT);
10035 +- uopt.uid = INVALID_UID;
10036 +- uopt.gid = INVALID_GID;
10037 ++ /* By default we'll use overflow[ug]id when UDF inode [ug]id == -1 */
10038 ++ uopt.uid = make_kuid(current_user_ns(), overflowuid);
10039 ++ uopt.gid = make_kgid(current_user_ns(), overflowgid);
10040 + uopt.umask = 0;
10041 + uopt.fmode = UDF_INVALID_MODE;
10042 + uopt.dmode = UDF_INVALID_MODE;
10043 +diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
10044 +index 8eca4eda8450..2109c071718b 100644
10045 +--- a/fs/ufs/namei.c
10046 ++++ b/fs/ufs/namei.c
10047 +@@ -38,8 +38,7 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode)
10048 + {
10049 + int err = ufs_add_link(dentry, inode);
10050 + if (!err) {
10051 +- unlock_new_inode(inode);
10052 +- d_instantiate(dentry, inode);
10053 ++ d_instantiate_new(dentry, inode);
10054 + return 0;
10055 + }
10056 + inode_dec_link_count(inode);
10057 +@@ -192,8 +191,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode)
10058 + if (err)
10059 + goto out_fail;
10060 +
10061 +- unlock_new_inode(inode);
10062 +- d_instantiate(dentry, inode);
10063 ++ d_instantiate_new(dentry, inode);
10064 + return 0;
10065 +
10066 + out_fail:
10067 +diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c
10068 +index 4ff499aa7338..b2ab123e561d 100644
10069 +--- a/fs/xfs/xfs_discard.c
10070 ++++ b/fs/xfs/xfs_discard.c
10071 +@@ -50,19 +50,19 @@ xfs_trim_extents(
10072 +
10073 + pag = xfs_perag_get(mp, agno);
10074 +
10075 +- error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
10076 +- if (error || !agbp)
10077 +- goto out_put_perag;
10078 +-
10079 +- cur = xfs_allocbt_init_cursor(mp, NULL, agbp, agno, XFS_BTNUM_CNT);
10080 +-
10081 + /*
10082 + * Force out the log. This means any transactions that might have freed
10083 +- * space before we took the AGF buffer lock are now on disk, and the
10084 ++ * space before we take the AGF buffer lock are now on disk, and the
10085 + * volatile disk cache is flushed.
10086 + */
10087 + xfs_log_force(mp, XFS_LOG_SYNC);
10088 +
10089 ++ error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
10090 ++ if (error || !agbp)
10091 ++ goto out_put_perag;
10092 ++
10093 ++ cur = xfs_allocbt_init_cursor(mp, NULL, agbp, agno, XFS_BTNUM_CNT);
10094 ++
10095 + /*
10096 + * Look up the longest btree in the AGF and start with it.
10097 + */
10098 +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
10099 +index f6ea0f3c03f8..4e8551c8ef18 100644
10100 +--- a/include/asm-generic/pgtable.h
10101 ++++ b/include/asm-generic/pgtable.h
10102 +@@ -234,6 +234,21 @@ extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
10103 + extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
10104 + #endif
10105 +
10106 ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
10107 ++/*
10108 ++ * This is an implementation of pmdp_establish() that is only suitable for an
10109 ++ * architecture that doesn't have hardware dirty/accessed bits. In this case we
10110 ++ * can't race with CPU which sets these bits and non-atomic aproach is fine.
10111 ++ */
10112 ++static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma,
10113 ++ unsigned long address, pmd_t *pmdp, pmd_t pmd)
10114 ++{
10115 ++ pmd_t old_pmd = *pmdp;
10116 ++ set_pmd_at(vma->vm_mm, address, pmdp, pmd);
10117 ++ return old_pmd;
10118 ++}
10119 ++#endif
10120 ++
10121 + #ifndef __HAVE_ARCH_PMDP_INVALIDATE
10122 + extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
10123 + pmd_t *pmdp);
10124 +diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
10125 +index 18ba29ff1449..203ad564dc60 100644
10126 +--- a/include/linux/cpumask.h
10127 ++++ b/include/linux/cpumask.h
10128 +@@ -164,6 +164,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
10129 + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
10130 + #define for_each_cpu_not(cpu, mask) \
10131 + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
10132 ++#define for_each_cpu_wrap(cpu, mask, start) \
10133 ++ for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
10134 + #define for_each_cpu_and(cpu, mask, and) \
10135 + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
10136 + #else
10137 +diff --git a/include/linux/dcache.h b/include/linux/dcache.h
10138 +index ff295e166b2c..b757ee42bc63 100644
10139 +--- a/include/linux/dcache.h
10140 ++++ b/include/linux/dcache.h
10141 +@@ -219,6 +219,7 @@ extern seqlock_t rename_lock;
10142 + * These are the low-level FS interfaces to the dcache..
10143 + */
10144 + extern void d_instantiate(struct dentry *, struct inode *);
10145 ++extern void d_instantiate_new(struct dentry *, struct inode *);
10146 + extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *);
10147 + extern int d_instantiate_no_diralias(struct dentry *, struct inode *);
10148 + extern void __d_drop(struct dentry *dentry);
10149 +diff --git a/include/linux/kcore.h b/include/linux/kcore.h
10150 +index d92762286645..3ffade4f2798 100644
10151 +--- a/include/linux/kcore.h
10152 ++++ b/include/linux/kcore.h
10153 +@@ -9,6 +9,7 @@ enum kcore_type {
10154 + KCORE_VMALLOC,
10155 + KCORE_RAM,
10156 + KCORE_VMEMMAP,
10157 ++ KCORE_USER,
10158 + KCORE_OTHER,
10159 + };
10160 +
10161 +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
10162 +index 8c58db2c09c6..eb55374b73f3 100644
10163 +--- a/include/linux/kvm_host.h
10164 ++++ b/include/linux/kvm_host.h
10165 +@@ -1070,7 +1070,6 @@ static inline void kvm_irq_routing_update(struct kvm *kvm)
10166 + {
10167 + }
10168 + #endif
10169 +-void kvm_arch_irq_routing_update(struct kvm *kvm);
10170 +
10171 + static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
10172 + {
10173 +@@ -1079,6 +1078,8 @@ static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
10174 +
10175 + #endif /* CONFIG_HAVE_KVM_EVENTFD */
10176 +
10177 ++void kvm_arch_irq_routing_update(struct kvm *kvm);
10178 ++
10179 + static inline void kvm_make_request(int req, struct kvm_vcpu *vcpu)
10180 + {
10181 + /*
10182 +diff --git a/include/linux/property.h b/include/linux/property.h
10183 +index 338f9b76914b..459337fb44d0 100644
10184 +--- a/include/linux/property.h
10185 ++++ b/include/linux/property.h
10186 +@@ -187,7 +187,7 @@ struct property_entry {
10187 + */
10188 +
10189 + #define PROPERTY_ENTRY_INTEGER_ARRAY(_name_, _type_, _val_) \
10190 +-{ \
10191 ++(struct property_entry) { \
10192 + .name = _name_, \
10193 + .length = ARRAY_SIZE(_val_) * sizeof(_type_), \
10194 + .is_array = true, \
10195 +@@ -205,7 +205,7 @@ struct property_entry {
10196 + PROPERTY_ENTRY_INTEGER_ARRAY(_name_, u64, _val_)
10197 +
10198 + #define PROPERTY_ENTRY_STRING_ARRAY(_name_, _val_) \
10199 +-{ \
10200 ++(struct property_entry) { \
10201 + .name = _name_, \
10202 + .length = ARRAY_SIZE(_val_) * sizeof(const char *), \
10203 + .is_array = true, \
10204 +@@ -214,7 +214,7 @@ struct property_entry {
10205 + }
10206 +
10207 + #define PROPERTY_ENTRY_INTEGER(_name_, _type_, _val_) \
10208 +-{ \
10209 ++(struct property_entry) { \
10210 + .name = _name_, \
10211 + .length = sizeof(_type_), \
10212 + .is_string = false, \
10213 +@@ -231,7 +231,7 @@ struct property_entry {
10214 + PROPERTY_ENTRY_INTEGER(_name_, u64, _val_)
10215 +
10216 + #define PROPERTY_ENTRY_STRING(_name_, _val_) \
10217 +-{ \
10218 ++(struct property_entry) { \
10219 + .name = _name_, \
10220 + .length = sizeof(_val_), \
10221 + .is_string = true, \
10222 +@@ -239,7 +239,7 @@ struct property_entry {
10223 + }
10224 +
10225 + #define PROPERTY_ENTRY_BOOL(_name_) \
10226 +-{ \
10227 ++(struct property_entry) { \
10228 + .name = _name_, \
10229 + }
10230 +
10231 +diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
10232 +index 05c6d20c2a7a..ac377a23265f 100644
10233 +--- a/include/linux/ptr_ring.h
10234 ++++ b/include/linux/ptr_ring.h
10235 +@@ -351,7 +351,7 @@ static inline void *ptr_ring_consume_bh(struct ptr_ring *r)
10236 +
10237 + static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
10238 + {
10239 +- if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
10240 ++ if (size > KMALLOC_MAX_SIZE / sizeof(void *))
10241 + return NULL;
10242 + return kcalloc(size, sizeof(void *), gfp);
10243 + }
10244 +diff --git a/include/linux/suspend.h b/include/linux/suspend.h
10245 +index d9718378a8be..249dafce2788 100644
10246 +--- a/include/linux/suspend.h
10247 ++++ b/include/linux/suspend.h
10248 +@@ -378,6 +378,8 @@ extern int swsusp_page_is_forbidden(struct page *);
10249 + extern void swsusp_set_page_free(struct page *);
10250 + extern void swsusp_unset_page_free(struct page *);
10251 + extern unsigned long get_safe_page(gfp_t gfp_mask);
10252 ++extern asmlinkage int swsusp_arch_suspend(void);
10253 ++extern asmlinkage int swsusp_arch_resume(void);
10254 +
10255 + extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
10256 + extern int hibernate(void);
10257 +diff --git a/include/net/ip.h b/include/net/ip.h
10258 +index 0e3dcd5a134d..bc9b4deeb60e 100644
10259 +--- a/include/net/ip.h
10260 ++++ b/include/net/ip.h
10261 +@@ -304,6 +304,13 @@ int ip_decrease_ttl(struct iphdr *iph)
10262 + return --iph->ttl;
10263 + }
10264 +
10265 ++static inline int ip_mtu_locked(const struct dst_entry *dst)
10266 ++{
10267 ++ const struct rtable *rt = (const struct rtable *)dst;
10268 ++
10269 ++ return rt->rt_mtu_locked || dst_metric_locked(dst, RTAX_MTU);
10270 ++}
10271 ++
10272 + static inline
10273 + int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst)
10274 + {
10275 +@@ -311,7 +318,7 @@ int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst)
10276 +
10277 + return pmtudisc == IP_PMTUDISC_DO ||
10278 + (pmtudisc == IP_PMTUDISC_WANT &&
10279 +- !(dst_metric_locked(dst, RTAX_MTU)));
10280 ++ !ip_mtu_locked(dst));
10281 + }
10282 +
10283 + static inline bool ip_sk_accept_pmtu(const struct sock *sk)
10284 +@@ -337,7 +344,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
10285 + struct net *net = dev_net(dst->dev);
10286 +
10287 + if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
10288 +- dst_metric_locked(dst, RTAX_MTU) ||
10289 ++ ip_mtu_locked(dst) ||
10290 + !forwarding)
10291 + return dst_mtu(dst);
10292 +
10293 +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
10294 +index aa758280d8a8..978387d6c3e6 100644
10295 +--- a/include/net/ip_fib.h
10296 ++++ b/include/net/ip_fib.h
10297 +@@ -57,6 +57,7 @@ struct fib_nh_exception {
10298 + int fnhe_genid;
10299 + __be32 fnhe_daddr;
10300 + u32 fnhe_pmtu;
10301 ++ bool fnhe_mtu_locked;
10302 + __be32 fnhe_gw;
10303 + unsigned long fnhe_expires;
10304 + struct rtable __rcu *fnhe_rth_input;
10305 +diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
10306 +index ea985aa7a6c5..df528a623548 100644
10307 +--- a/include/net/llc_conn.h
10308 ++++ b/include/net/llc_conn.h
10309 +@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk);
10310 +
10311 + /* Access to a connection */
10312 + int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
10313 +-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
10314 ++int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
10315 + void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
10316 + void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit);
10317 + void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit);
10318 +diff --git a/include/net/mac80211.h b/include/net/mac80211.h
10319 +index 8fd61bc50383..920a771c710f 100644
10320 +--- a/include/net/mac80211.h
10321 ++++ b/include/net/mac80211.h
10322 +@@ -4091,7 +4091,7 @@ void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid);
10323 + * The TX headroom reserved by mac80211 for its own tx_status functions.
10324 + * This is enough for the radiotap header.
10325 + */
10326 +-#define IEEE80211_TX_STATUS_HEADROOM 14
10327 ++#define IEEE80211_TX_STATUS_HEADROOM ALIGN(14, 4)
10328 +
10329 + /**
10330 + * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
10331 +diff --git a/include/net/regulatory.h b/include/net/regulatory.h
10332 +index ebc5a2ed8631..f83cacce3308 100644
10333 +--- a/include/net/regulatory.h
10334 ++++ b/include/net/regulatory.h
10335 +@@ -78,7 +78,7 @@ struct regulatory_request {
10336 + int wiphy_idx;
10337 + enum nl80211_reg_initiator initiator;
10338 + enum nl80211_user_reg_hint_type user_reg_hint_type;
10339 +- char alpha2[2];
10340 ++ char alpha2[3];
10341 + enum nl80211_dfs_regions dfs_region;
10342 + bool intersect;
10343 + bool processed;
10344 +diff --git a/include/net/route.h b/include/net/route.h
10345 +index 0429d47cad25..b8488efef920 100644
10346 +--- a/include/net/route.h
10347 ++++ b/include/net/route.h
10348 +@@ -63,7 +63,8 @@ struct rtable {
10349 + __be32 rt_gateway;
10350 +
10351 + /* Miscellaneous cached information */
10352 +- u32 rt_pmtu;
10353 ++ u32 rt_mtu_locked:1,
10354 ++ rt_pmtu:31;
10355 +
10356 + u32 rt_table_id;
10357 +
10358 +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
10359 +index 28c5da6fdfac..3411da79407d 100644
10360 +--- a/include/trace/events/timer.h
10361 ++++ b/include/trace/events/timer.h
10362 +@@ -125,6 +125,20 @@ DEFINE_EVENT(timer_class, timer_cancel,
10363 + TP_ARGS(timer)
10364 + );
10365 +
10366 ++#define decode_clockid(type) \
10367 ++ __print_symbolic(type, \
10368 ++ { CLOCK_REALTIME, "CLOCK_REALTIME" }, \
10369 ++ { CLOCK_MONOTONIC, "CLOCK_MONOTONIC" }, \
10370 ++ { CLOCK_BOOTTIME, "CLOCK_BOOTTIME" }, \
10371 ++ { CLOCK_TAI, "CLOCK_TAI" })
10372 ++
10373 ++#define decode_hrtimer_mode(mode) \
10374 ++ __print_symbolic(mode, \
10375 ++ { HRTIMER_MODE_ABS, "ABS" }, \
10376 ++ { HRTIMER_MODE_REL, "REL" }, \
10377 ++ { HRTIMER_MODE_ABS_PINNED, "ABS|PINNED" }, \
10378 ++ { HRTIMER_MODE_REL_PINNED, "REL|PINNED" })
10379 ++
10380 + /**
10381 + * hrtimer_init - called when the hrtimer is initialized
10382 + * @hrtimer: pointer to struct hrtimer
10383 +@@ -151,10 +165,8 @@ TRACE_EVENT(hrtimer_init,
10384 + ),
10385 +
10386 + TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer,
10387 +- __entry->clockid == CLOCK_REALTIME ?
10388 +- "CLOCK_REALTIME" : "CLOCK_MONOTONIC",
10389 +- __entry->mode == HRTIMER_MODE_ABS ?
10390 +- "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL")
10391 ++ decode_clockid(__entry->clockid),
10392 ++ decode_hrtimer_mode(__entry->mode))
10393 + );
10394 +
10395 + /**
10396 +diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h
10397 +index 91a31ffed828..9a781f0611df 100644
10398 +--- a/include/uapi/drm/virtgpu_drm.h
10399 ++++ b/include/uapi/drm/virtgpu_drm.h
10400 +@@ -63,6 +63,7 @@ struct drm_virtgpu_execbuffer {
10401 + };
10402 +
10403 + #define VIRTGPU_PARAM_3D_FEATURES 1 /* do we have 3D features in the hw */
10404 ++#define VIRTGPU_PARAM_CAPSET_QUERY_FIX 2 /* do we have the capset fix */
10405 +
10406 + struct drm_virtgpu_getparam {
10407 + __u64 param;
10408 +diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h
10409 +index 117d02e0fc31..659b1634de61 100644
10410 +--- a/include/uapi/linux/if_ether.h
10411 ++++ b/include/uapi/linux/if_ether.h
10412 +@@ -29,6 +29,7 @@
10413 + */
10414 +
10415 + #define ETH_ALEN 6 /* Octets in one ethernet addr */
10416 ++#define ETH_TLEN 2 /* Octets in ethernet type field */
10417 + #define ETH_HLEN 14 /* Total octets in header. */
10418 + #define ETH_ZLEN 60 /* Min. octets in frame sans FCS */
10419 + #define ETH_DATA_LEN 1500 /* Max. octets in payload */
10420 +diff --git a/ipc/shm.c b/ipc/shm.c
10421 +index b626745e771c..9c687cda9b0a 100644
10422 +--- a/ipc/shm.c
10423 ++++ b/ipc/shm.c
10424 +@@ -1127,14 +1127,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
10425 + goto out;
10426 + else if ((addr = (ulong)shmaddr)) {
10427 + if (addr & (shmlba - 1)) {
10428 +- /*
10429 +- * Round down to the nearest multiple of shmlba.
10430 +- * For sane do_mmap_pgoff() parameters, avoid
10431 +- * round downs that trigger nil-page and MAP_FIXED.
10432 +- */
10433 +- if ((shmflg & SHM_RND) && addr >= shmlba)
10434 +- addr &= ~(shmlba - 1);
10435 +- else
10436 ++ if (shmflg & SHM_RND) {
10437 ++ addr &= ~(shmlba - 1); /* round down */
10438 ++
10439 ++ /*
10440 ++ * Ensure that the round-down is non-nil
10441 ++ * when remapping. This can happen for
10442 ++ * cases when addr < shmlba.
10443 ++ */
10444 ++ if (!addr && (shmflg & SHM_REMAP))
10445 ++ goto out;
10446 ++ } else
10447 + #ifndef __ARCH_FORCE_SHMLBA
10448 + if (addr & ~PAGE_MASK)
10449 + #endif
10450 +diff --git a/kernel/audit.c b/kernel/audit.c
10451 +index da4e7c0e36f7..3461a3d874fe 100644
10452 +--- a/kernel/audit.c
10453 ++++ b/kernel/audit.c
10454 +@@ -742,6 +742,8 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
10455 + return;
10456 +
10457 + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
10458 ++ if (!ab)
10459 ++ return;
10460 + audit_log_task_info(ab, current);
10461 + audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
10462 + audit_feature_names[which], !!old_feature, !!new_feature,
10463 +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
10464 +index 2a20c0dfdafc..5a58421d7e2d 100644
10465 +--- a/kernel/debug/kdb/kdb_main.c
10466 ++++ b/kernel/debug/kdb/kdb_main.c
10467 +@@ -1564,6 +1564,7 @@ static int kdb_md(int argc, const char **argv)
10468 + int symbolic = 0;
10469 + int valid = 0;
10470 + int phys = 0;
10471 ++ int raw = 0;
10472 +
10473 + kdbgetintenv("MDCOUNT", &mdcount);
10474 + kdbgetintenv("RADIX", &radix);
10475 +@@ -1573,9 +1574,10 @@ static int kdb_md(int argc, const char **argv)
10476 + repeat = mdcount * 16 / bytesperword;
10477 +
10478 + if (strcmp(argv[0], "mdr") == 0) {
10479 +- if (argc != 2)
10480 ++ if (argc == 2 || (argc == 0 && last_addr != 0))
10481 ++ valid = raw = 1;
10482 ++ else
10483 + return KDB_ARGCOUNT;
10484 +- valid = 1;
10485 + } else if (isdigit(argv[0][2])) {
10486 + bytesperword = (int)(argv[0][2] - '0');
10487 + if (bytesperword == 0) {
10488 +@@ -1611,7 +1613,10 @@ static int kdb_md(int argc, const char **argv)
10489 + radix = last_radix;
10490 + bytesperword = last_bytesperword;
10491 + repeat = last_repeat;
10492 +- mdcount = ((repeat * bytesperword) + 15) / 16;
10493 ++ if (raw)
10494 ++ mdcount = repeat;
10495 ++ else
10496 ++ mdcount = ((repeat * bytesperword) + 15) / 16;
10497 + }
10498 +
10499 + if (argc) {
10500 +@@ -1628,7 +1633,10 @@ static int kdb_md(int argc, const char **argv)
10501 + diag = kdbgetularg(argv[nextarg], &val);
10502 + if (!diag) {
10503 + mdcount = (int) val;
10504 +- repeat = mdcount * 16 / bytesperword;
10505 ++ if (raw)
10506 ++ repeat = mdcount;
10507 ++ else
10508 ++ repeat = mdcount * 16 / bytesperword;
10509 + }
10510 + }
10511 + if (argc >= nextarg+1) {
10512 +@@ -1638,8 +1646,15 @@ static int kdb_md(int argc, const char **argv)
10513 + }
10514 + }
10515 +
10516 +- if (strcmp(argv[0], "mdr") == 0)
10517 +- return kdb_mdr(addr, mdcount);
10518 ++ if (strcmp(argv[0], "mdr") == 0) {
10519 ++ int ret;
10520 ++ last_addr = addr;
10521 ++ ret = kdb_mdr(addr, mdcount);
10522 ++ last_addr += mdcount;
10523 ++ last_repeat = mdcount;
10524 ++ last_bytesperword = bytesperword; // to make REPEAT happy
10525 ++ return ret;
10526 ++ }
10527 +
10528 + switch (radix) {
10529 + case 10:
10530 +diff --git a/kernel/events/core.c b/kernel/events/core.c
10531 +index cbc51826cb94..6e6ec229c780 100644
10532 +--- a/kernel/events/core.c
10533 ++++ b/kernel/events/core.c
10534 +@@ -634,9 +634,15 @@ static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
10535 +
10536 + static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
10537 + {
10538 +- struct perf_cgroup *cgrp_out = cpuctx->cgrp;
10539 +- if (cgrp_out)
10540 +- __update_cgrp_time(cgrp_out);
10541 ++ struct perf_cgroup *cgrp = cpuctx->cgrp;
10542 ++ struct cgroup_subsys_state *css;
10543 ++
10544 ++ if (cgrp) {
10545 ++ for (css = &cgrp->css; css; css = css->parent) {
10546 ++ cgrp = container_of(css, struct perf_cgroup, css);
10547 ++ __update_cgrp_time(cgrp);
10548 ++ }
10549 ++ }
10550 + }
10551 +
10552 + static inline void update_cgrp_time_from_event(struct perf_event *event)
10553 +@@ -664,6 +670,7 @@ perf_cgroup_set_timestamp(struct task_struct *task,
10554 + {
10555 + struct perf_cgroup *cgrp;
10556 + struct perf_cgroup_info *info;
10557 ++ struct cgroup_subsys_state *css;
10558 +
10559 + /*
10560 + * ctx->lock held by caller
10561 +@@ -674,8 +681,12 @@ perf_cgroup_set_timestamp(struct task_struct *task,
10562 + return;
10563 +
10564 + cgrp = perf_cgroup_from_task(task, ctx);
10565 +- info = this_cpu_ptr(cgrp->info);
10566 +- info->timestamp = ctx->timestamp;
10567 ++
10568 ++ for (css = &cgrp->css; css; css = css->parent) {
10569 ++ cgrp = container_of(css, struct perf_cgroup, css);
10570 ++ info = this_cpu_ptr(cgrp->info);
10571 ++ info->timestamp = ctx->timestamp;
10572 ++ }
10573 + }
10574 +
10575 + #define PERF_CGROUP_SWOUT 0x1 /* cgroup switch out every event */
10576 +@@ -5689,7 +5700,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,
10577 + if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
10578 + values[n++] = running;
10579 +
10580 +- if (leader != event)
10581 ++ if ((leader != event) &&
10582 ++ (leader->state == PERF_EVENT_STATE_ACTIVE))
10583 + leader->pmu->read(leader);
10584 +
10585 + values[n++] = perf_event_count(leader);
10586 +diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
10587 +index b2caec7315af..a72f5df643f8 100644
10588 +--- a/kernel/locking/qspinlock.c
10589 ++++ b/kernel/locking/qspinlock.c
10590 +@@ -495,6 +495,14 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)
10591 + tail = encode_tail(smp_processor_id(), idx);
10592 +
10593 + node += idx;
10594 ++
10595 ++ /*
10596 ++ * Ensure that we increment the head node->count before initialising
10597 ++ * the actual node. If the compiler is kind enough to reorder these
10598 ++ * stores, then an IRQ could overwrite our assignments.
10599 ++ */
10600 ++ barrier();
10601 ++
10602 + node->locked = 0;
10603 + node->next = NULL;
10604 + pv_init_node(node);
10605 +diff --git a/kernel/power/power.h b/kernel/power/power.h
10606 +index 56d1d0dedf76..ccba4d820078 100644
10607 +--- a/kernel/power/power.h
10608 ++++ b/kernel/power/power.h
10609 +@@ -103,9 +103,6 @@ extern int in_suspend;
10610 + extern dev_t swsusp_resume_device;
10611 + extern sector_t swsusp_resume_block;
10612 +
10613 +-extern asmlinkage int swsusp_arch_suspend(void);
10614 +-extern asmlinkage int swsusp_arch_resume(void);
10615 +-
10616 + extern int create_basic_memory_bitmaps(void);
10617 + extern void free_basic_memory_bitmaps(void);
10618 + extern int hibernate_preallocate_memory(void);
10619 +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
10620 +index e3944c4b072d..554ea54e8d61 100644
10621 +--- a/kernel/rcu/tree_plugin.h
10622 ++++ b/kernel/rcu/tree_plugin.h
10623 +@@ -521,8 +521,14 @@ static void rcu_print_detail_task_stall_rnp(struct rcu_node *rnp)
10624 + }
10625 + t = list_entry(rnp->gp_tasks->prev,
10626 + struct task_struct, rcu_node_entry);
10627 +- list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry)
10628 ++ list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry) {
10629 ++ /*
10630 ++ * We could be printing a lot while holding a spinlock.
10631 ++ * Avoid triggering hard lockup.
10632 ++ */
10633 ++ touch_nmi_watchdog();
10634 + sched_show_task(t);
10635 ++ }
10636 + raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
10637 + }
10638 +
10639 +@@ -1629,6 +1635,12 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu)
10640 + char *ticks_title;
10641 + unsigned long ticks_value;
10642 +
10643 ++ /*
10644 ++ * We could be printing a lot while holding a spinlock. Avoid
10645 ++ * triggering hard lockup.
10646 ++ */
10647 ++ touch_nmi_watchdog();
10648 ++
10649 + if (rsp->gpnum == rdp->gpnum) {
10650 + ticks_title = "ticks this GP";
10651 + ticks_value = rdp->ticks_this_gp;
10652 +diff --git a/kernel/relay.c b/kernel/relay.c
10653 +index 2603e04f55f9..91e8fbf8aff3 100644
10654 +--- a/kernel/relay.c
10655 ++++ b/kernel/relay.c
10656 +@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
10657 + {
10658 + struct rchan_buf *buf;
10659 +
10660 +- if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
10661 ++ if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
10662 + return NULL;
10663 +
10664 + buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
10665 +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
10666 +index c7b0d2e7a9aa..9ab4d73e9cc9 100644
10667 +--- a/kernel/sched/rt.c
10668 ++++ b/kernel/sched/rt.c
10669 +@@ -830,6 +830,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
10670 + struct rq *rq = rq_of_rt_rq(rt_rq);
10671 +
10672 + raw_spin_lock(&rq->lock);
10673 ++ update_rq_clock(rq);
10674 ++
10675 + if (rt_rq->rt_time) {
10676 + u64 runtime;
10677 +
10678 +diff --git a/kernel/signal.c b/kernel/signal.c
10679 +index 17428fec19b0..4364e57e6038 100644
10680 +--- a/kernel/signal.c
10681 ++++ b/kernel/signal.c
10682 +@@ -1392,6 +1392,10 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
10683 + return ret;
10684 + }
10685 +
10686 ++ /* -INT_MIN is undefined. Exclude this case to avoid a UBSAN warning */
10687 ++ if (pid == INT_MIN)
10688 ++ return -ESRCH;
10689 ++
10690 + read_lock(&tasklist_lock);
10691 + if (pid != -1) {
10692 + ret = __kill_pgrp_info(sig, info,
10693 +diff --git a/kernel/sys.c b/kernel/sys.c
10694 +index 143cd63f1d47..b13b530b5e0f 100644
10695 +--- a/kernel/sys.c
10696 ++++ b/kernel/sys.c
10697 +@@ -1313,6 +1313,7 @@ SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
10698 + if (resource >= RLIM_NLIMITS)
10699 + return -EINVAL;
10700 +
10701 ++ resource = array_index_nospec(resource, RLIM_NLIMITS);
10702 + task_lock(current->group_leader);
10703 + x = current->signal->rlim[resource];
10704 + task_unlock(current->group_leader);
10705 +diff --git a/kernel/workqueue.c b/kernel/workqueue.c
10706 +index 664aebc50fe3..1961dd408bc5 100644
10707 +--- a/kernel/workqueue.c
10708 ++++ b/kernel/workqueue.c
10709 +@@ -5272,7 +5272,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
10710 +
10711 + ret = device_register(&wq_dev->dev);
10712 + if (ret) {
10713 +- kfree(wq_dev);
10714 ++ put_device(&wq_dev->dev);
10715 + wq->wq_dev = NULL;
10716 + return ret;
10717 + }
10718 +diff --git a/lib/test_bpf.c b/lib/test_bpf.c
10719 +index 98da7520a6aa..1586dfdea809 100644
10720 +--- a/lib/test_bpf.c
10721 ++++ b/lib/test_bpf.c
10722 +@@ -83,6 +83,7 @@ struct bpf_test {
10723 + __u32 result;
10724 + } test[MAX_SUBTESTS];
10725 + int (*fill_helper)(struct bpf_test *self);
10726 ++ int expected_errcode; /* used when FLAG_EXPECTED_FAIL is set in the aux */
10727 + __u8 frag_data[MAX_DATA];
10728 + };
10729 +
10730 +@@ -1900,7 +1901,9 @@ static struct bpf_test tests[] = {
10731 + },
10732 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10733 + { },
10734 +- { }
10735 ++ { },
10736 ++ .fill_helper = NULL,
10737 ++ .expected_errcode = -EINVAL,
10738 + },
10739 + {
10740 + "check: div_k_0",
10741 +@@ -1910,7 +1913,9 @@ static struct bpf_test tests[] = {
10742 + },
10743 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10744 + { },
10745 +- { }
10746 ++ { },
10747 ++ .fill_helper = NULL,
10748 ++ .expected_errcode = -EINVAL,
10749 + },
10750 + {
10751 + "check: unknown insn",
10752 +@@ -1921,7 +1926,9 @@ static struct bpf_test tests[] = {
10753 + },
10754 + CLASSIC | FLAG_EXPECTED_FAIL,
10755 + { },
10756 +- { }
10757 ++ { },
10758 ++ .fill_helper = NULL,
10759 ++ .expected_errcode = -EINVAL,
10760 + },
10761 + {
10762 + "check: out of range spill/fill",
10763 +@@ -1931,7 +1938,9 @@ static struct bpf_test tests[] = {
10764 + },
10765 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10766 + { },
10767 +- { }
10768 ++ { },
10769 ++ .fill_helper = NULL,
10770 ++ .expected_errcode = -EINVAL,
10771 + },
10772 + {
10773 + "JUMPS + HOLES",
10774 +@@ -2023,6 +2032,8 @@ static struct bpf_test tests[] = {
10775 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10776 + { },
10777 + { },
10778 ++ .fill_helper = NULL,
10779 ++ .expected_errcode = -EINVAL,
10780 + },
10781 + {
10782 + "check: LDX + RET X",
10783 +@@ -2033,6 +2044,8 @@ static struct bpf_test tests[] = {
10784 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10785 + { },
10786 + { },
10787 ++ .fill_helper = NULL,
10788 ++ .expected_errcode = -EINVAL,
10789 + },
10790 + { /* Mainly checking JIT here. */
10791 + "M[]: alt STX + LDX",
10792 +@@ -2207,6 +2220,8 @@ static struct bpf_test tests[] = {
10793 + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10794 + { },
10795 + { },
10796 ++ .fill_helper = NULL,
10797 ++ .expected_errcode = -EINVAL,
10798 + },
10799 + { /* Passes checker but fails during runtime. */
10800 + "LD [SKF_AD_OFF-1]",
10801 +@@ -4803,6 +4818,7 @@ static struct bpf_test tests[] = {
10802 + { },
10803 + { },
10804 + .fill_helper = bpf_fill_maxinsns4,
10805 ++ .expected_errcode = -EINVAL,
10806 + },
10807 + { /* Mainly checking JIT here. */
10808 + "BPF_MAXINSNS: Very long jump",
10809 +@@ -4858,10 +4874,15 @@ static struct bpf_test tests[] = {
10810 + {
10811 + "BPF_MAXINSNS: Jump, gap, jump, ...",
10812 + { },
10813 ++#ifdef CONFIG_BPF_JIT_ALWAYS_ON
10814 ++ CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
10815 ++#else
10816 + CLASSIC | FLAG_NO_DATA,
10817 ++#endif
10818 + { },
10819 + { { 0, 0xababcbac } },
10820 + .fill_helper = bpf_fill_maxinsns11,
10821 ++ .expected_errcode = -ENOTSUPP,
10822 + },
10823 + {
10824 + "BPF_MAXINSNS: ld_abs+get_processor_id",
10825 +@@ -5632,7 +5653,7 @@ static struct bpf_prog *generate_filter(int which, int *err)
10826 +
10827 + *err = bpf_prog_create(&fp, &fprog);
10828 + if (tests[which].aux & FLAG_EXPECTED_FAIL) {
10829 +- if (*err == -EINVAL) {
10830 ++ if (*err == tests[which].expected_errcode) {
10831 + pr_cont("PASS\n");
10832 + /* Verifier rejected filter as expected. */
10833 + *err = 0;
10834 +diff --git a/mm/fadvise.c b/mm/fadvise.c
10835 +index 6c707bfe02fd..27fc9ad267ac 100644
10836 +--- a/mm/fadvise.c
10837 ++++ b/mm/fadvise.c
10838 +@@ -126,7 +126,15 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
10839 + */
10840 + start_index = (offset+(PAGE_SIZE-1)) >> PAGE_SHIFT;
10841 + end_index = (endbyte >> PAGE_SHIFT);
10842 +- if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK) {
10843 ++ /*
10844 ++ * The page at end_index will be inclusively discarded according
10845 ++ * by invalidate_mapping_pages(), so subtracting 1 from
10846 ++ * end_index means we will skip the last page. But if endbyte
10847 ++ * is page aligned or is at the end of file, we should not skip
10848 ++ * that page - discarding the last page is safe enough.
10849 ++ */
10850 ++ if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK &&
10851 ++ endbyte != inode->i_size - 1) {
10852 + /* First page is tricky as 0 - 1 = -1, but pgoff_t
10853 + * is unsigned, so the end_index >= start_index
10854 + * check below would be true and we'll discard the whole
10855 +diff --git a/mm/huge_memory.c b/mm/huge_memory.c
10856 +index e2982ea26090..724372866e67 100644
10857 +--- a/mm/huge_memory.c
10858 ++++ b/mm/huge_memory.c
10859 +@@ -542,7 +542,8 @@ static int __do_huge_pmd_anonymous_page(struct fault_env *fe, struct page *page,
10860 +
10861 + VM_BUG_ON_PAGE(!PageCompound(page), page);
10862 +
10863 +- if (mem_cgroup_try_charge(page, vma->vm_mm, gfp, &memcg, true)) {
10864 ++ if (mem_cgroup_try_charge(page, vma->vm_mm, gfp | __GFP_NORETRY, &memcg,
10865 ++ true)) {
10866 + put_page(page);
10867 + count_vm_event(THP_FAULT_FALLBACK);
10868 + return VM_FAULT_FALLBACK;
10869 +@@ -1060,7 +1061,7 @@ int do_huge_pmd_wp_page(struct fault_env *fe, pmd_t orig_pmd)
10870 + }
10871 +
10872 + if (unlikely(mem_cgroup_try_charge(new_page, vma->vm_mm,
10873 +- huge_gfp, &memcg, true))) {
10874 ++ huge_gfp | __GFP_NORETRY, &memcg, true))) {
10875 + put_page(new_page);
10876 + split_huge_pmd(vma, fe->pmd, fe->address);
10877 + if (page)
10878 +diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
10879 +index 0e9505f66ec1..73c258129257 100644
10880 +--- a/mm/kasan/kasan.c
10881 ++++ b/mm/kasan/kasan.c
10882 +@@ -800,5 +800,5 @@ static int __init kasan_memhotplug_init(void)
10883 + return 0;
10884 + }
10885 +
10886 +-module_init(kasan_memhotplug_init);
10887 ++core_initcall(kasan_memhotplug_init);
10888 + #endif
10889 +diff --git a/mm/khugepaged.c b/mm/khugepaged.c
10890 +index 898eb26f5dc8..1df37ee996d5 100644
10891 +--- a/mm/khugepaged.c
10892 ++++ b/mm/khugepaged.c
10893 +@@ -963,7 +963,9 @@ static void collapse_huge_page(struct mm_struct *mm,
10894 + goto out_nolock;
10895 + }
10896 +
10897 +- if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) {
10898 ++ /* Do not oom kill for khugepaged charges */
10899 ++ if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY,
10900 ++ &memcg, true))) {
10901 + result = SCAN_CGROUP_CHARGE_FAIL;
10902 + goto out_nolock;
10903 + }
10904 +@@ -1323,7 +1325,9 @@ static void collapse_shmem(struct mm_struct *mm,
10905 + goto out;
10906 + }
10907 +
10908 +- if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) {
10909 ++ /* Do not oom kill for khugepaged charges */
10910 ++ if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY,
10911 ++ &memcg, true))) {
10912 + result = SCAN_CGROUP_CHARGE_FAIL;
10913 + goto out;
10914 + }
10915 +@@ -1678,10 +1682,14 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
10916 + spin_unlock(&khugepaged_mm_lock);
10917 +
10918 + mm = mm_slot->mm;
10919 +- down_read(&mm->mmap_sem);
10920 +- if (unlikely(khugepaged_test_exit(mm)))
10921 +- vma = NULL;
10922 +- else
10923 ++ /*
10924 ++ * Don't wait for semaphore (to avoid long wait times). Just move to
10925 ++ * the next mm on the list.
10926 ++ */
10927 ++ vma = NULL;
10928 ++ if (unlikely(!down_read_trylock(&mm->mmap_sem)))
10929 ++ goto breakouterloop_mmap_sem;
10930 ++ if (likely(!khugepaged_test_exit(mm)))
10931 + vma = find_vma(mm, khugepaged_scan.address);
10932 +
10933 + progress++;
10934 +diff --git a/mm/kmemleak.c b/mm/kmemleak.c
10935 +index 20cf3be9a5e8..9e66449ed91f 100644
10936 +--- a/mm/kmemleak.c
10937 ++++ b/mm/kmemleak.c
10938 +@@ -1577,8 +1577,7 @@ static void start_scan_thread(void)
10939 + }
10940 +
10941 + /*
10942 +- * Stop the automatic memory scanning thread. This function must be called
10943 +- * with the scan_mutex held.
10944 ++ * Stop the automatic memory scanning thread.
10945 + */
10946 + static void stop_scan_thread(void)
10947 + {
10948 +@@ -1841,12 +1840,15 @@ static void kmemleak_do_cleanup(struct work_struct *work)
10949 + {
10950 + stop_scan_thread();
10951 +
10952 ++ mutex_lock(&scan_mutex);
10953 + /*
10954 +- * Once the scan thread has stopped, it is safe to no longer track
10955 +- * object freeing. Ordering of the scan thread stopping and the memory
10956 +- * accesses below is guaranteed by the kthread_stop() function.
10957 ++ * Once it is made sure that kmemleak_scan has stopped, it is safe to no
10958 ++ * longer track object freeing. Ordering of the scan thread stopping and
10959 ++ * the memory accesses below is guaranteed by the kthread_stop()
10960 ++ * function.
10961 + */
10962 + kmemleak_free_enabled = 0;
10963 ++ mutex_unlock(&scan_mutex);
10964 +
10965 + if (!kmemleak_found_leaks)
10966 + __kmemleak_do_cleanup();
10967 +diff --git a/mm/ksm.c b/mm/ksm.c
10968 +index caa54a55a357..614b2cce9ad7 100644
10969 +--- a/mm/ksm.c
10970 ++++ b/mm/ksm.c
10971 +@@ -1469,8 +1469,22 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
10972 + tree_rmap_item =
10973 + unstable_tree_search_insert(rmap_item, page, &tree_page);
10974 + if (tree_rmap_item) {
10975 ++ bool split;
10976 ++
10977 + kpage = try_to_merge_two_pages(rmap_item, page,
10978 + tree_rmap_item, tree_page);
10979 ++ /*
10980 ++ * If both pages we tried to merge belong to the same compound
10981 ++ * page, then we actually ended up increasing the reference
10982 ++ * count of the same compound page twice, and split_huge_page
10983 ++ * failed.
10984 ++ * Here we set a flag if that happened, and we use it later to
10985 ++ * try split_huge_page again. Since we call put_page right
10986 ++ * afterwards, the reference count will be correct and
10987 ++ * split_huge_page should succeed.
10988 ++ */
10989 ++ split = PageTransCompound(page)
10990 ++ && compound_head(page) == compound_head(tree_page);
10991 + put_page(tree_page);
10992 + if (kpage) {
10993 + /*
10994 +@@ -1495,6 +1509,20 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
10995 + break_cow(tree_rmap_item);
10996 + break_cow(rmap_item);
10997 + }
10998 ++ } else if (split) {
10999 ++ /*
11000 ++ * We are here if we tried to merge two pages and
11001 ++ * failed because they both belonged to the same
11002 ++ * compound page. We will split the page now, but no
11003 ++ * merging will take place.
11004 ++ * We do not want to add the cost of a full lock; if
11005 ++ * the page is locked, it is better to skip it and
11006 ++ * perhaps try again later.
11007 ++ */
11008 ++ if (!trylock_page(page))
11009 ++ return;
11010 ++ split_huge_page(page);
11011 ++ unlock_page(page);
11012 + }
11013 + }
11014 + }
11015 +diff --git a/mm/mempolicy.c b/mm/mempolicy.c
11016 +index a8ab5e73dc61..69c4a0c92ebb 100644
11017 +--- a/mm/mempolicy.c
11018 ++++ b/mm/mempolicy.c
11019 +@@ -1264,6 +1264,7 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
11020 + unsigned long maxnode)
11021 + {
11022 + unsigned long k;
11023 ++ unsigned long t;
11024 + unsigned long nlongs;
11025 + unsigned long endmask;
11026 +
11027 +@@ -1280,13 +1281,19 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
11028 + else
11029 + endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1;
11030 +
11031 +- /* When the user specified more nodes than supported just check
11032 +- if the non supported part is all zero. */
11033 ++ /*
11034 ++ * When the user specified more nodes than supported just check
11035 ++ * if the non supported part is all zero.
11036 ++ *
11037 ++ * If maxnode have more longs than MAX_NUMNODES, check
11038 ++ * the bits in that area first. And then go through to
11039 ++ * check the rest bits which equal or bigger than MAX_NUMNODES.
11040 ++ * Otherwise, just check bits [MAX_NUMNODES, maxnode).
11041 ++ */
11042 + if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) {
11043 + if (nlongs > PAGE_SIZE/sizeof(long))
11044 + return -EINVAL;
11045 + for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) {
11046 +- unsigned long t;
11047 + if (get_user(t, nmask + k))
11048 + return -EFAULT;
11049 + if (k == nlongs - 1) {
11050 +@@ -1299,6 +1306,16 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
11051 + endmask = ~0UL;
11052 + }
11053 +
11054 ++ if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) {
11055 ++ unsigned long valid_mask = endmask;
11056 ++
11057 ++ valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1);
11058 ++ if (get_user(t, nmask + nlongs - 1))
11059 ++ return -EFAULT;
11060 ++ if (t & valid_mask)
11061 ++ return -EINVAL;
11062 ++ }
11063 ++
11064 + if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned long)))
11065 + return -EFAULT;
11066 + nodes_addr(*nodes)[nlongs-1] &= endmask;
11067 +@@ -1425,10 +1442,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
11068 + goto out_put;
11069 + }
11070 +
11071 +- if (!nodes_subset(*new, node_states[N_MEMORY])) {
11072 +- err = -EINVAL;
11073 ++ task_nodes = cpuset_mems_allowed(current);
11074 ++ nodes_and(*new, *new, task_nodes);
11075 ++ if (nodes_empty(*new))
11076 ++ goto out_put;
11077 ++
11078 ++ nodes_and(*new, *new, node_states[N_MEMORY]);
11079 ++ if (nodes_empty(*new))
11080 + goto out_put;
11081 +- }
11082 +
11083 + err = security_task_movememory(task);
11084 + if (err)
11085 +@@ -2138,6 +2159,9 @@ bool __mpol_equal(struct mempolicy *a, struct mempolicy *b)
11086 + case MPOL_INTERLEAVE:
11087 + return !!nodes_equal(a->v.nodes, b->v.nodes);
11088 + case MPOL_PREFERRED:
11089 ++ /* a's ->flags is the same as b's */
11090 ++ if (a->flags & MPOL_F_LOCAL)
11091 ++ return true;
11092 + return a->v.preferred_node == b->v.preferred_node;
11093 + default:
11094 + BUG();
11095 +diff --git a/mm/swapfile.c b/mm/swapfile.c
11096 +index d76b2a18f044..79c03ecd31c8 100644
11097 +--- a/mm/swapfile.c
11098 ++++ b/mm/swapfile.c
11099 +@@ -2271,6 +2271,10 @@ static unsigned long read_swap_header(struct swap_info_struct *p,
11100 + maxpages = swp_offset(pte_to_swp_entry(
11101 + swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
11102 + last_page = swap_header->info.last_page;
11103 ++ if (!last_page) {
11104 ++ pr_warn("Empty swap-file\n");
11105 ++ return 0;
11106 ++ }
11107 + if (last_page > maxpages) {
11108 + pr_warn("Truncating oversized swap area, only using %luk out of %luk\n",
11109 + maxpages << (PAGE_SHIFT - 10),
11110 +diff --git a/mm/vmscan.c b/mm/vmscan.c
11111 +index 557ad1367595..2d4b6478237b 100644
11112 +--- a/mm/vmscan.c
11113 ++++ b/mm/vmscan.c
11114 +@@ -1374,6 +1374,7 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode)
11115 +
11116 + if (PageDirty(page)) {
11117 + struct address_space *mapping;
11118 ++ bool migrate_dirty;
11119 +
11120 + /* ISOLATE_CLEAN means only clean pages */
11121 + if (mode & ISOLATE_CLEAN)
11122 +@@ -1382,10 +1383,19 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode)
11123 + /*
11124 + * Only pages without mappings or that have a
11125 + * ->migratepage callback are possible to migrate
11126 +- * without blocking
11127 ++ * without blocking. However, we can be racing with
11128 ++ * truncation so it's necessary to lock the page
11129 ++ * to stabilise the mapping as truncation holds
11130 ++ * the page lock until after the page is removed
11131 ++ * from the page cache.
11132 + */
11133 ++ if (!trylock_page(page))
11134 ++ return ret;
11135 ++
11136 + mapping = page_mapping(page);
11137 +- if (mapping && !mapping->a_ops->migratepage)
11138 ++ migrate_dirty = mapping && mapping->a_ops->migratepage;
11139 ++ unlock_page(page);
11140 ++ if (!migrate_dirty)
11141 + return ret;
11142 + }
11143 + }
11144 +@@ -3847,7 +3857,13 @@ int node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask, unsigned int order)
11145 + */
11146 + int page_evictable(struct page *page)
11147 + {
11148 +- return !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
11149 ++ int ret;
11150 ++
11151 ++ /* Prevent address_space of inode and swap cache from being freed */
11152 ++ rcu_read_lock();
11153 ++ ret = !mapping_unevictable(page_mapping(page)) && !PageMlocked(page);
11154 ++ rcu_read_unlock();
11155 ++ return ret;
11156 + }
11157 +
11158 + #ifdef CONFIG_SHMEM
11159 +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
11160 +index e2d18d0b1f06..946f1c269b1f 100644
11161 +--- a/net/batman-adv/bat_iv_ogm.c
11162 ++++ b/net/batman-adv/bat_iv_ogm.c
11163 +@@ -2705,7 +2705,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
11164 + struct batadv_neigh_ifinfo *router_ifinfo = NULL;
11165 + struct batadv_neigh_node *router;
11166 + struct batadv_gw_node *curr_gw;
11167 +- int ret = -EINVAL;
11168 ++ int ret = 0;
11169 + void *hdr;
11170 +
11171 + router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
11172 +diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
11173 +index e79f6f01182e..ed4ddf2059a6 100644
11174 +--- a/net/batman-adv/bat_v.c
11175 ++++ b/net/batman-adv/bat_v.c
11176 +@@ -920,7 +920,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
11177 + struct batadv_neigh_ifinfo *router_ifinfo = NULL;
11178 + struct batadv_neigh_node *router;
11179 + struct batadv_gw_node *curr_gw;
11180 +- int ret = -EINVAL;
11181 ++ int ret = 0;
11182 + void *hdr;
11183 +
11184 + router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
11185 +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
11186 +index 5419b1214abd..582e27698bf0 100644
11187 +--- a/net/batman-adv/bridge_loop_avoidance.c
11188 ++++ b/net/batman-adv/bridge_loop_avoidance.c
11189 +@@ -2149,22 +2149,25 @@ batadv_bla_claim_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
11190 + {
11191 + struct batadv_bla_claim *claim;
11192 + int idx = 0;
11193 ++ int ret = 0;
11194 +
11195 + rcu_read_lock();
11196 + hlist_for_each_entry_rcu(claim, head, hash_entry) {
11197 + if (idx++ < *idx_skip)
11198 + continue;
11199 +- if (batadv_bla_claim_dump_entry(msg, portid, seq,
11200 +- primary_if, claim)) {
11201 ++
11202 ++ ret = batadv_bla_claim_dump_entry(msg, portid, seq,
11203 ++ primary_if, claim);
11204 ++ if (ret) {
11205 + *idx_skip = idx - 1;
11206 + goto unlock;
11207 + }
11208 + }
11209 +
11210 +- *idx_skip = idx;
11211 ++ *idx_skip = 0;
11212 + unlock:
11213 + rcu_read_unlock();
11214 +- return 0;
11215 ++ return ret;
11216 + }
11217 +
11218 + /**
11219 +@@ -2379,22 +2382,25 @@ batadv_bla_backbone_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
11220 + {
11221 + struct batadv_bla_backbone_gw *backbone_gw;
11222 + int idx = 0;
11223 ++ int ret = 0;
11224 +
11225 + rcu_read_lock();
11226 + hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
11227 + if (idx++ < *idx_skip)
11228 + continue;
11229 +- if (batadv_bla_backbone_dump_entry(msg, portid, seq,
11230 +- primary_if, backbone_gw)) {
11231 ++
11232 ++ ret = batadv_bla_backbone_dump_entry(msg, portid, seq,
11233 ++ primary_if, backbone_gw);
11234 ++ if (ret) {
11235 + *idx_skip = idx - 1;
11236 + goto unlock;
11237 + }
11238 + }
11239 +
11240 +- *idx_skip = idx;
11241 ++ *idx_skip = 0;
11242 + unlock:
11243 + rcu_read_unlock();
11244 +- return 0;
11245 ++ return ret;
11246 + }
11247 +
11248 + /**
11249 +diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
11250 +index e257efdc5d03..df7c6a080188 100644
11251 +--- a/net/batman-adv/distributed-arp-table.c
11252 ++++ b/net/batman-adv/distributed-arp-table.c
11253 +@@ -391,7 +391,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
11254 + batadv_arp_hw_src(skb, hdr_size), &ip_src,
11255 + batadv_arp_hw_dst(skb, hdr_size), &ip_dst);
11256 +
11257 +- if (hdr_size == 0)
11258 ++ if (hdr_size < sizeof(struct batadv_unicast_packet))
11259 + return;
11260 +
11261 + unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
11262 +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
11263 +index 0934730fb7ff..57215e3fd1a0 100644
11264 +--- a/net/batman-adv/fragmentation.c
11265 ++++ b/net/batman-adv/fragmentation.c
11266 +@@ -276,7 +276,8 @@ batadv_frag_merge_packets(struct hlist_head *chain)
11267 + /* Move the existing MAC header to just before the payload. (Override
11268 + * the fragment header.)
11269 + */
11270 +- skb_pull_rcsum(skb_out, hdr_size);
11271 ++ skb_pull(skb_out, hdr_size);
11272 ++ skb_out->ip_summed = CHECKSUM_NONE;
11273 + memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN);
11274 + skb_set_mac_header(skb_out, -ETH_HLEN);
11275 + skb_reset_network_header(skb_out);
11276 +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
11277 +index de055d64debe..ed9aaf30fbcf 100644
11278 +--- a/net/batman-adv/gateway_client.c
11279 ++++ b/net/batman-adv/gateway_client.c
11280 +@@ -715,6 +715,9 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
11281 +
11282 + vid = batadv_get_vid(skb, 0);
11283 +
11284 ++ if (is_multicast_ether_addr(ethhdr->h_dest))
11285 ++ goto out;
11286 ++
11287 + orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
11288 + ethhdr->h_dest, vid);
11289 + if (!orig_dst_node)
11290 +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
11291 +index 13661f43386f..5a2aac17805b 100644
11292 +--- a/net/batman-adv/multicast.c
11293 ++++ b/net/batman-adv/multicast.c
11294 +@@ -527,8 +527,8 @@ static bool batadv_mcast_mla_tvlv_update(struct batadv_priv *bat_priv)
11295 + bat_priv->mcast.enabled = true;
11296 + }
11297 +
11298 +- return !(mcast_data.flags &
11299 +- (BATADV_MCAST_WANT_ALL_IPV4 | BATADV_MCAST_WANT_ALL_IPV6));
11300 ++ return !(mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV4 &&
11301 ++ mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV6);
11302 + }
11303 +
11304 + /**
11305 +@@ -769,8 +769,8 @@ static struct batadv_orig_node *
11306 + batadv_mcast_forw_tt_node_get(struct batadv_priv *bat_priv,
11307 + struct ethhdr *ethhdr)
11308 + {
11309 +- return batadv_transtable_search(bat_priv, ethhdr->h_source,
11310 +- ethhdr->h_dest, BATADV_NO_FLAGS);
11311 ++ return batadv_transtable_search(bat_priv, NULL, ethhdr->h_dest,
11312 ++ BATADV_NO_FLAGS);
11313 + }
11314 +
11315 + /**
11316 +diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
11317 +index 7e8dc648b95a..8b98609ebc1e 100644
11318 +--- a/net/batman-adv/routing.c
11319 ++++ b/net/batman-adv/routing.c
11320 +@@ -724,6 +724,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
11321 + /**
11322 + * batadv_reroute_unicast_packet - update the unicast header for re-routing
11323 + * @bat_priv: the bat priv with all the soft interface information
11324 ++ * @skb: unicast packet to process
11325 + * @unicast_packet: the unicast header to be updated
11326 + * @dst_addr: the payload destination
11327 + * @vid: VLAN identifier
11328 +@@ -735,7 +736,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
11329 + * Return: true if the packet header has been updated, false otherwise
11330 + */
11331 + static bool
11332 +-batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
11333 ++batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
11334 + struct batadv_unicast_packet *unicast_packet,
11335 + u8 *dst_addr, unsigned short vid)
11336 + {
11337 +@@ -764,8 +765,10 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
11338 + }
11339 +
11340 + /* update the packet header */
11341 ++ skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
11342 + ether_addr_copy(unicast_packet->dest, orig_addr);
11343 + unicast_packet->ttvn = orig_ttvn;
11344 ++ skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
11345 +
11346 + ret = true;
11347 + out:
11348 +@@ -806,7 +809,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
11349 + * the packet to
11350 + */
11351 + if (batadv_tt_local_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) {
11352 +- if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
11353 ++ if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
11354 + ethhdr->h_dest, vid))
11355 + batadv_dbg_ratelimited(BATADV_DBG_TT,
11356 + bat_priv,
11357 +@@ -852,7 +855,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
11358 + * destination can possibly be updated and forwarded towards the new
11359 + * target host
11360 + */
11361 +- if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
11362 ++ if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
11363 + ethhdr->h_dest, vid)) {
11364 + batadv_dbg_ratelimited(BATADV_DBG_TT, bat_priv,
11365 + "Rerouting unicast packet to %pM (dst=%pM): TTVN mismatch old_ttvn=%u new_ttvn=%u\n",
11366 +@@ -875,12 +878,14 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
11367 + if (!primary_if)
11368 + return false;
11369 +
11370 ++ /* update the packet header */
11371 ++ skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
11372 + ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr);
11373 ++ unicast_packet->ttvn = curr_ttvn;
11374 ++ skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
11375 +
11376 + batadv_hardif_put(primary_if);
11377 +
11378 +- unicast_packet->ttvn = curr_ttvn;
11379 +-
11380 + return true;
11381 + }
11382 +
11383 +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
11384 +index 49e16b6e0ba3..84c1b388d9ed 100644
11385 +--- a/net/batman-adv/soft-interface.c
11386 ++++ b/net/batman-adv/soft-interface.c
11387 +@@ -448,13 +448,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
11388 +
11389 + /* skb->dev & skb->pkt_type are set here */
11390 + skb->protocol = eth_type_trans(skb, soft_iface);
11391 +-
11392 +- /* should not be necessary anymore as we use skb_pull_rcsum()
11393 +- * TODO: please verify this and remove this TODO
11394 +- * -- Dec 21st 2009, Simon Wunderlich
11395 +- */
11396 +-
11397 +- /* skb->ip_summed = CHECKSUM_UNNECESSARY; */
11398 ++ skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
11399 +
11400 + batadv_inc_counter(bat_priv, BATADV_CNT_RX);
11401 + batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
11402 +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
11403 +index 5a89a4ac86ef..0a9222ef904c 100644
11404 +--- a/net/bridge/netfilter/ebtables.c
11405 ++++ b/net/bridge/netfilter/ebtables.c
11406 +@@ -1625,7 +1625,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
11407 + int off = ebt_compat_match_offset(match, m->match_size);
11408 + compat_uint_t msize = m->match_size - off;
11409 +
11410 +- BUG_ON(off >= m->match_size);
11411 ++ if (WARN_ON(off >= m->match_size))
11412 ++ return -EINVAL;
11413 +
11414 + if (copy_to_user(cm->u.name, match->name,
11415 + strlen(match->name) + 1) || put_user(msize, &cm->match_size))
11416 +@@ -1652,7 +1653,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
11417 + int off = xt_compat_target_offset(target);
11418 + compat_uint_t tsize = t->target_size - off;
11419 +
11420 +- BUG_ON(off >= t->target_size);
11421 ++ if (WARN_ON(off >= t->target_size))
11422 ++ return -EINVAL;
11423 +
11424 + if (copy_to_user(cm->u.name, target->name,
11425 + strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
11426 +@@ -1880,7 +1882,8 @@ static int ebt_buf_add(struct ebt_entries_buf_state *state,
11427 + if (state->buf_kern_start == NULL)
11428 + goto count_only;
11429 +
11430 +- BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
11431 ++ if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))
11432 ++ return -EINVAL;
11433 +
11434 + memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
11435 +
11436 +@@ -1893,7 +1896,8 @@ static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
11437 + {
11438 + char *b = state->buf_kern_start;
11439 +
11440 +- BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
11441 ++ if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))
11442 ++ return -EINVAL;
11443 +
11444 + if (b != NULL && sz > 0)
11445 + memset(b + state->buf_kern_offset, 0, sz);
11446 +@@ -1970,8 +1974,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
11447 + pad = XT_ALIGN(size_kern) - size_kern;
11448 +
11449 + if (pad > 0 && dst) {
11450 +- BUG_ON(state->buf_kern_len <= pad);
11451 +- BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
11452 ++ if (WARN_ON(state->buf_kern_len <= pad))
11453 ++ return -EINVAL;
11454 ++ if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))
11455 ++ return -EINVAL;
11456 + memset(dst + size_kern, 0, pad);
11457 + }
11458 + return off + match_size;
11459 +@@ -2021,7 +2027,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
11460 + if (ret < 0)
11461 + return ret;
11462 +
11463 +- BUG_ON(ret < match32->match_size);
11464 ++ if (WARN_ON(ret < match32->match_size))
11465 ++ return -EINVAL;
11466 + growth += ret - match32->match_size;
11467 + growth += ebt_compat_entry_padsize();
11468 +
11469 +@@ -2090,8 +2097,12 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
11470 + * offsets are relative to beginning of struct ebt_entry (i.e., 0).
11471 + */
11472 + for (i = 0; i < 4 ; ++i) {
11473 +- if (offsets[i] >= *total)
11474 ++ if (offsets[i] > *total)
11475 ++ return -EINVAL;
11476 ++
11477 ++ if (i < 3 && offsets[i] == *total)
11478 + return -EINVAL;
11479 ++
11480 + if (i == 0)
11481 + continue;
11482 + if (offsets[i-1] > offsets[i])
11483 +@@ -2130,7 +2141,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
11484 +
11485 + startoff = state->buf_user_offset - startoff;
11486 +
11487 +- BUG_ON(*total < startoff);
11488 ++ if (WARN_ON(*total < startoff))
11489 ++ return -EINVAL;
11490 + *total -= startoff;
11491 + return 0;
11492 + }
11493 +@@ -2257,7 +2269,8 @@ static int compat_do_replace(struct net *net, void __user *user,
11494 + state.buf_kern_len = size64;
11495 +
11496 + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
11497 +- BUG_ON(ret < 0); /* parses same data again */
11498 ++ if (WARN_ON(ret < 0))
11499 ++ goto out_unlock;
11500 +
11501 + vfree(entries_tmp);
11502 + tmp.entries_size = size64;
11503 +diff --git a/net/core/skbuff.c b/net/core/skbuff.c
11504 +index a40ccc184b83..9f697b00158d 100644
11505 +--- a/net/core/skbuff.c
11506 ++++ b/net/core/skbuff.c
11507 +@@ -4475,13 +4475,18 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mtu);
11508 +
11509 + static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
11510 + {
11511 ++ int mac_len;
11512 ++
11513 + if (skb_cow(skb, skb_headroom(skb)) < 0) {
11514 + kfree_skb(skb);
11515 + return NULL;
11516 + }
11517 +
11518 +- memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
11519 +- 2 * ETH_ALEN);
11520 ++ mac_len = skb->data - skb_mac_header(skb);
11521 ++ if (likely(mac_len > VLAN_HLEN + ETH_TLEN)) {
11522 ++ memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
11523 ++ mac_len - VLAN_HLEN - ETH_TLEN);
11524 ++ }
11525 + skb->mac_header += VLAN_HLEN;
11526 + return skb;
11527 + }
11528 +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
11529 +index b120b9b11402..1ac55b116d5a 100644
11530 +--- a/net/ipv4/ip_vti.c
11531 ++++ b/net/ipv4/ip_vti.c
11532 +@@ -396,8 +396,6 @@ static int vti_tunnel_init(struct net_device *dev)
11533 + memcpy(dev->dev_addr, &iph->saddr, 4);
11534 + memcpy(dev->broadcast, &iph->daddr, 4);
11535 +
11536 +- dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr);
11537 +- dev->mtu = ETH_DATA_LEN;
11538 + dev->flags = IFF_NOARP;
11539 + dev->addr_len = 4;
11540 + dev->features |= NETIF_F_LLTX;
11541 +diff --git a/net/ipv4/route.c b/net/ipv4/route.c
11542 +index 4c9fbf4f5905..890141d32ab9 100644
11543 +--- a/net/ipv4/route.c
11544 ++++ b/net/ipv4/route.c
11545 +@@ -618,6 +618,7 @@ static inline u32 fnhe_hashfun(__be32 daddr)
11546 + static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
11547 + {
11548 + rt->rt_pmtu = fnhe->fnhe_pmtu;
11549 ++ rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
11550 + rt->dst.expires = fnhe->fnhe_expires;
11551 +
11552 + if (fnhe->fnhe_gw) {
11553 +@@ -628,7 +629,7 @@ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnh
11554 + }
11555 +
11556 + static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
11557 +- u32 pmtu, unsigned long expires)
11558 ++ u32 pmtu, bool lock, unsigned long expires)
11559 + {
11560 + struct fnhe_hash_bucket *hash;
11561 + struct fib_nh_exception *fnhe;
11562 +@@ -665,8 +666,10 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
11563 + fnhe->fnhe_genid = genid;
11564 + if (gw)
11565 + fnhe->fnhe_gw = gw;
11566 +- if (pmtu)
11567 ++ if (pmtu) {
11568 + fnhe->fnhe_pmtu = pmtu;
11569 ++ fnhe->fnhe_mtu_locked = lock;
11570 ++ }
11571 + fnhe->fnhe_expires = max(1UL, expires);
11572 + /* Update all cached dsts too */
11573 + rt = rcu_dereference(fnhe->fnhe_rth_input);
11574 +@@ -690,6 +693,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
11575 + fnhe->fnhe_daddr = daddr;
11576 + fnhe->fnhe_gw = gw;
11577 + fnhe->fnhe_pmtu = pmtu;
11578 ++ fnhe->fnhe_mtu_locked = lock;
11579 + fnhe->fnhe_expires = expires;
11580 +
11581 + /* Exception created; mark the cached routes for the nexthop
11582 +@@ -771,7 +775,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
11583 + struct fib_nh *nh = &FIB_RES_NH(res);
11584 +
11585 + update_or_create_fnhe(nh, fl4->daddr, new_gw,
11586 +- 0, jiffies + ip_rt_gc_timeout);
11587 ++ 0, false,
11588 ++ jiffies + ip_rt_gc_timeout);
11589 + }
11590 + if (kill_route)
11591 + rt->dst.obsolete = DST_OBSOLETE_KILL;
11592 +@@ -983,15 +988,18 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
11593 + {
11594 + struct dst_entry *dst = &rt->dst;
11595 + struct fib_result res;
11596 ++ bool lock = false;
11597 +
11598 +- if (dst_metric_locked(dst, RTAX_MTU))
11599 ++ if (ip_mtu_locked(dst))
11600 + return;
11601 +
11602 + if (ipv4_mtu(dst) < mtu)
11603 + return;
11604 +
11605 +- if (mtu < ip_rt_min_pmtu)
11606 ++ if (mtu < ip_rt_min_pmtu) {
11607 ++ lock = true;
11608 + mtu = ip_rt_min_pmtu;
11609 ++ }
11610 +
11611 + if (rt->rt_pmtu == mtu &&
11612 + time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
11613 +@@ -1001,7 +1009,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
11614 + if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
11615 + struct fib_nh *nh = &FIB_RES_NH(res);
11616 +
11617 +- update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
11618 ++ update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
11619 + jiffies + ip_rt_mtu_expires);
11620 + }
11621 + rcu_read_unlock();
11622 +@@ -1256,7 +1264,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
11623 +
11624 + mtu = READ_ONCE(dst->dev->mtu);
11625 +
11626 +- if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
11627 ++ if (unlikely(ip_mtu_locked(dst))) {
11628 + if (rt->rt_uses_gateway && mtu > 576)
11629 + mtu = 576;
11630 + }
11631 +@@ -1481,6 +1489,7 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
11632 + rt->rt_is_input = 0;
11633 + rt->rt_iif = 0;
11634 + rt->rt_pmtu = 0;
11635 ++ rt->rt_mtu_locked = 0;
11636 + rt->rt_gateway = 0;
11637 + rt->rt_uses_gateway = 0;
11638 + rt->rt_table_id = 0;
11639 +@@ -2403,6 +2412,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
11640 + rt->rt_is_input = ort->rt_is_input;
11641 + rt->rt_iif = ort->rt_iif;
11642 + rt->rt_pmtu = ort->rt_pmtu;
11643 ++ rt->rt_mtu_locked = ort->rt_mtu_locked;
11644 +
11645 + rt->rt_genid = rt_genid_ipv4(net);
11646 + rt->rt_flags = ort->rt_flags;
11647 +@@ -2505,6 +2515,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id,
11648 + memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
11649 + if (rt->rt_pmtu && expires)
11650 + metrics[RTAX_MTU - 1] = rt->rt_pmtu;
11651 ++ if (rt->rt_mtu_locked && expires)
11652 ++ metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
11653 + if (rtnetlink_put_metrics(skb, metrics) < 0)
11654 + goto nla_put_failure;
11655 +
11656 +diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
11657 +index c8e6d86be114..95ca88731ff5 100644
11658 +--- a/net/ipv4/tcp_illinois.c
11659 ++++ b/net/ipv4/tcp_illinois.c
11660 +@@ -6,7 +6,7 @@
11661 + * The algorithm is described in:
11662 + * "TCP-Illinois: A Loss and Delay-Based Congestion Control Algorithm
11663 + * for High-Speed Networks"
11664 +- * http://www.ifp.illinois.edu/~srikant/Papers/liubassri06perf.pdf
11665 ++ * http://tamerbasar.csl.illinois.edu/LiuBasarSrikantPerfEvalArtJun2008.pdf
11666 + *
11667 + * Implemented from description in paper and ns-2 simulation.
11668 + * Copyright (C) 2007 Stephen Hemminger <shemminger@××××××××××××××××.org>
11669 +diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c
11670 +index e45e2c41c7bd..37a3cb999859 100644
11671 +--- a/net/ipv4/tcp_nv.c
11672 ++++ b/net/ipv4/tcp_nv.c
11673 +@@ -338,7 +338,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
11674 + */
11675 + cwnd_by_slope = (u32)
11676 + div64_u64(((u64)ca->nv_rtt_max_rate) * ca->nv_min_rtt,
11677 +- (u64)(80000 * tp->mss_cache));
11678 ++ 80000ULL * tp->mss_cache);
11679 + max_win = cwnd_by_slope + nv_pad;
11680 +
11681 + /* If cwnd > max_win, decrease cwnd
11682 +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
11683 +index 6a7ff6957535..622e158a6fc4 100644
11684 +--- a/net/ipv4/xfrm4_policy.c
11685 ++++ b/net/ipv4/xfrm4_policy.c
11686 +@@ -97,6 +97,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
11687 + xdst->u.rt.rt_gateway = rt->rt_gateway;
11688 + xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
11689 + xdst->u.rt.rt_pmtu = rt->rt_pmtu;
11690 ++ xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked;
11691 + xdst->u.rt.rt_table_id = rt->rt_table_id;
11692 + INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
11693 +
11694 +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
11695 +index 417af5ea2509..c7b202c1720d 100644
11696 +--- a/net/ipv6/ip6_tunnel.c
11697 ++++ b/net/ipv6/ip6_tunnel.c
11698 +@@ -1972,14 +1972,14 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
11699 + {
11700 + struct net *net = dev_net(dev);
11701 + struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
11702 +- struct ip6_tnl *nt, *t;
11703 + struct ip_tunnel_encap ipencap;
11704 ++ struct ip6_tnl *nt, *t;
11705 ++ int err;
11706 +
11707 + nt = netdev_priv(dev);
11708 +
11709 + if (ip6_tnl_netlink_encap_parms(data, &ipencap)) {
11710 +- int err = ip6_tnl_encap_setup(nt, &ipencap);
11711 +-
11712 ++ err = ip6_tnl_encap_setup(nt, &ipencap);
11713 + if (err < 0)
11714 + return err;
11715 + }
11716 +@@ -1995,7 +1995,11 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
11717 + return -EEXIST;
11718 + }
11719 +
11720 +- return ip6_tnl_create2(dev);
11721 ++ err = ip6_tnl_create2(dev);
11722 ++ if (!err && tb[IFLA_MTU])
11723 ++ ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
11724 ++
11725 ++ return err;
11726 + }
11727 +
11728 + static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
11729 +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
11730 +index b263bf3a19f7..64ec23388450 100644
11731 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
11732 ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
11733 +@@ -230,7 +230,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
11734 +
11735 + if ((unsigned int)end > IPV6_MAXPLEN) {
11736 + pr_debug("offset is too large.\n");
11737 +- return -1;
11738 ++ return -EINVAL;
11739 + }
11740 +
11741 + ecn = ip6_frag_ecn(ipv6_hdr(skb));
11742 +@@ -263,7 +263,8 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
11743 + * this case. -DaveM
11744 + */
11745 + pr_debug("end of fragment not rounded to 8 bytes.\n");
11746 +- return -1;
11747 ++ inet_frag_kill(&fq->q, &nf_frags);
11748 ++ return -EPROTO;
11749 + }
11750 + if (end > fq->q.len) {
11751 + /* Some bits beyond end -> corruption. */
11752 +@@ -357,7 +358,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
11753 + discard_fq:
11754 + inet_frag_kill(&fq->q, &nf_frags);
11755 + err:
11756 +- return -1;
11757 ++ return -EINVAL;
11758 + }
11759 +
11760 + /*
11761 +@@ -566,6 +567,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
11762 +
11763 + int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
11764 + {
11765 ++ u16 savethdr = skb->transport_header;
11766 + struct net_device *dev = skb->dev;
11767 + int fhoff, nhoff, ret;
11768 + struct frag_hdr *fhdr;
11769 +@@ -599,8 +601,12 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
11770 +
11771 + spin_lock_bh(&fq->q.lock);
11772 +
11773 +- if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) {
11774 +- ret = -EINVAL;
11775 ++ ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
11776 ++ if (ret < 0) {
11777 ++ if (ret == -EPROTO) {
11778 ++ skb->transport_header = savethdr;
11779 ++ ret = 0;
11780 ++ }
11781 + goto out_unlock;
11782 + }
11783 +
11784 +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
11785 +index dcb292134c21..ae0485d776f4 100644
11786 +--- a/net/ipv6/sit.c
11787 ++++ b/net/ipv6/sit.c
11788 +@@ -1572,6 +1572,13 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
11789 + if (err < 0)
11790 + return err;
11791 +
11792 ++ if (tb[IFLA_MTU]) {
11793 ++ u32 mtu = nla_get_u32(tb[IFLA_MTU]);
11794 ++
11795 ++ if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
11796 ++ dev->mtu = mtu;
11797 ++ }
11798 ++
11799 + #ifdef CONFIG_IPV6_SIT_6RD
11800 + if (ipip6_netlink_6rd_parms(data, &ip6rd))
11801 + err = ipip6_tunnel_update_6rd(nt, &ip6rd);
11802 +diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
11803 +index f8d4ab8ca1a5..4b60f68cb492 100644
11804 +--- a/net/llc/llc_c_ac.c
11805 ++++ b/net/llc/llc_c_ac.c
11806 +@@ -389,7 +389,7 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb)
11807 + llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR);
11808 + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
11809 + if (likely(!rc)) {
11810 +- llc_conn_send_pdu(sk, skb);
11811 ++ rc = llc_conn_send_pdu(sk, skb);
11812 + llc_conn_ac_inc_vs_by_1(sk, skb);
11813 + }
11814 + return rc;
11815 +@@ -916,7 +916,7 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
11816 + llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR);
11817 + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac);
11818 + if (likely(!rc)) {
11819 +- llc_conn_send_pdu(sk, skb);
11820 ++ rc = llc_conn_send_pdu(sk, skb);
11821 + llc_conn_ac_inc_vs_by_1(sk, skb);
11822 + }
11823 + return rc;
11824 +@@ -935,14 +935,17 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk,
11825 + int llc_conn_ac_send_i_as_ack(struct sock *sk, struct sk_buff *skb)
11826 + {
11827 + struct llc_sock *llc = llc_sk(sk);
11828 ++ int ret;
11829 +
11830 + if (llc->ack_must_be_send) {
11831 +- llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb);
11832 ++ ret = llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb);
11833 + llc->ack_must_be_send = 0 ;
11834 + llc->ack_pf = 0;
11835 +- } else
11836 +- llc_conn_ac_send_i_cmd_p_set_0(sk, skb);
11837 +- return 0;
11838 ++ } else {
11839 ++ ret = llc_conn_ac_send_i_cmd_p_set_0(sk, skb);
11840 ++ }
11841 ++
11842 ++ return ret;
11843 + }
11844 +
11845 + /**
11846 +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
11847 +index d861b74ad068..79c346fd859b 100644
11848 +--- a/net/llc/llc_conn.c
11849 ++++ b/net/llc/llc_conn.c
11850 +@@ -30,7 +30,7 @@
11851 + #endif
11852 +
11853 + static int llc_find_offset(int state, int ev_type);
11854 +-static void llc_conn_send_pdus(struct sock *sk);
11855 ++static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb);
11856 + static int llc_conn_service(struct sock *sk, struct sk_buff *skb);
11857 + static int llc_exec_conn_trans_actions(struct sock *sk,
11858 + struct llc_conn_state_trans *trans,
11859 +@@ -193,11 +193,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
11860 + return rc;
11861 + }
11862 +
11863 +-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
11864 ++int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb)
11865 + {
11866 + /* queue PDU to send to MAC layer */
11867 + skb_queue_tail(&sk->sk_write_queue, skb);
11868 +- llc_conn_send_pdus(sk);
11869 ++ return llc_conn_send_pdus(sk, skb);
11870 + }
11871 +
11872 + /**
11873 +@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
11874 + if (howmany_resend > 0)
11875 + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
11876 + /* any PDUs to re-send are queued up; start sending to MAC */
11877 +- llc_conn_send_pdus(sk);
11878 ++ llc_conn_send_pdus(sk, NULL);
11879 + out:;
11880 + }
11881 +
11882 +@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
11883 + if (howmany_resend > 0)
11884 + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
11885 + /* any PDUs to re-send are queued up; start sending to MAC */
11886 +- llc_conn_send_pdus(sk);
11887 ++ llc_conn_send_pdus(sk, NULL);
11888 + out:;
11889 + }
11890 +
11891 +@@ -340,12 +340,16 @@ int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked)
11892 + /**
11893 + * llc_conn_send_pdus - Sends queued PDUs
11894 + * @sk: active connection
11895 ++ * @hold_skb: the skb held by caller, or NULL if does not care
11896 + *
11897 +- * Sends queued pdus to MAC layer for transmission.
11898 ++ * Sends queued pdus to MAC layer for transmission. When @hold_skb is
11899 ++ * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent
11900 ++ * successfully, or 1 for failure.
11901 + */
11902 +-static void llc_conn_send_pdus(struct sock *sk)
11903 ++static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb)
11904 + {
11905 + struct sk_buff *skb;
11906 ++ int ret = 0;
11907 +
11908 + while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) {
11909 + struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
11910 +@@ -357,10 +361,20 @@ static void llc_conn_send_pdus(struct sock *sk)
11911 + skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb);
11912 + if (!skb2)
11913 + break;
11914 +- skb = skb2;
11915 ++ dev_queue_xmit(skb2);
11916 ++ } else {
11917 ++ bool is_target = skb == hold_skb;
11918 ++ int rc;
11919 ++
11920 ++ if (is_target)
11921 ++ skb_get(skb);
11922 ++ rc = dev_queue_xmit(skb);
11923 ++ if (is_target)
11924 ++ ret = rc;
11925 + }
11926 +- dev_queue_xmit(skb);
11927 + }
11928 ++
11929 ++ return ret;
11930 + }
11931 +
11932 + /**
11933 +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
11934 +index 404284a14d75..474655a2aeae 100644
11935 +--- a/net/mac80211/rx.c
11936 ++++ b/net/mac80211/rx.c
11937 +@@ -3907,7 +3907,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
11938 + if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
11939 + IEEE80211_FCTL_TODS)) !=
11940 + fast_rx->expected_ds_bits)
11941 +- goto drop;
11942 ++ return false;
11943 +
11944 + /* assign the key to drop unencrypted frames (later)
11945 + * and strip the IV/MIC if necessary
11946 +diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
11947 +index 97f4c9d6b54c..9249712765d7 100644
11948 +--- a/net/mac80211/spectmgmt.c
11949 ++++ b/net/mac80211/spectmgmt.c
11950 +@@ -8,6 +8,7 @@
11951 + * Copyright 2007, Michael Wu <flamingice@××××××××.net>
11952 + * Copyright 2007-2008, Intel Corporation
11953 + * Copyright 2008, Johannes Berg <johannes@××××××××××××.net>
11954 ++ * Copyright (C) 2018 Intel Corporation
11955 + *
11956 + * This program is free software; you can redistribute it and/or modify
11957 + * it under the terms of the GNU General Public License version 2 as
11958 +@@ -27,7 +28,7 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
11959 + u32 sta_flags, u8 *bssid,
11960 + struct ieee80211_csa_ie *csa_ie)
11961 + {
11962 +- enum nl80211_band new_band;
11963 ++ enum nl80211_band new_band = current_band;
11964 + int new_freq;
11965 + u8 new_chan_no;
11966 + struct ieee80211_channel *new_chan;
11967 +@@ -53,15 +54,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
11968 + elems->ext_chansw_ie->new_operating_class,
11969 + &new_band)) {
11970 + sdata_info(sdata,
11971 +- "cannot understand ECSA IE operating class %d, disconnecting\n",
11972 ++ "cannot understand ECSA IE operating class, %d, ignoring\n",
11973 + elems->ext_chansw_ie->new_operating_class);
11974 +- return -EINVAL;
11975 + }
11976 + new_chan_no = elems->ext_chansw_ie->new_ch_num;
11977 + csa_ie->count = elems->ext_chansw_ie->count;
11978 + csa_ie->mode = elems->ext_chansw_ie->mode;
11979 + } else if (elems->ch_switch_ie) {
11980 +- new_band = current_band;
11981 + new_chan_no = elems->ch_switch_ie->new_ch_num;
11982 + csa_ie->count = elems->ch_switch_ie->count;
11983 + csa_ie->mode = elems->ch_switch_ie->mode;
11984 +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
11985 +index 1ecf3d07d1f5..892c392ff8fc 100644
11986 +--- a/net/mac80211/sta_info.c
11987 ++++ b/net/mac80211/sta_info.c
11988 +@@ -313,7 +313,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
11989 +
11990 + if (ieee80211_hw_check(hw, USES_RSS)) {
11991 + sta->pcpu_rx_stats =
11992 +- alloc_percpu(struct ieee80211_sta_rx_stats);
11993 ++ alloc_percpu_gfp(struct ieee80211_sta_rx_stats, gfp);
11994 + if (!sta->pcpu_rx_stats)
11995 + goto free;
11996 + }
11997 +@@ -433,6 +433,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
11998 + if (sta->sta.txq[0])
11999 + kfree(to_txq_info(sta->sta.txq[0]));
12000 + free:
12001 ++ free_percpu(sta->pcpu_rx_stats);
12002 + #ifdef CONFIG_MAC80211_MESH
12003 + kfree(sta->mesh);
12004 + #endif
12005 +diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
12006 +index 4528cff9138b..a123d0dc1ef9 100644
12007 +--- a/net/netlabel/netlabel_unlabeled.c
12008 ++++ b/net/netlabel/netlabel_unlabeled.c
12009 +@@ -1469,6 +1469,16 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb,
12010 + iface = rcu_dereference(netlbl_unlhsh_def);
12011 + if (iface == NULL || !iface->valid)
12012 + goto unlabel_getattr_nolabel;
12013 ++
12014 ++#if IS_ENABLED(CONFIG_IPV6)
12015 ++ /* When resolving a fallback label, check the sk_buff version as
12016 ++ * it is possible (e.g. SCTP) to have family = PF_INET6 while
12017 ++ * receiving ip_hdr(skb)->version = 4.
12018 ++ */
12019 ++ if (family == PF_INET6 && ip_hdr(skb)->version == 4)
12020 ++ family = PF_INET;
12021 ++#endif /* IPv6 */
12022 ++
12023 + switch (family) {
12024 + case PF_INET: {
12025 + struct iphdr *hdr4;
12026 +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
12027 +index c5959ce503e6..3f266115294f 100644
12028 +--- a/net/nfc/llcp_commands.c
12029 ++++ b/net/nfc/llcp_commands.c
12030 +@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
12031 +
12032 + pr_debug("uri: %s, len: %zu\n", uri, uri_len);
12033 +
12034 ++ /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */
12035 ++ if (WARN_ON_ONCE(uri_len > U8_MAX - 4))
12036 ++ return NULL;
12037 ++
12038 + sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
12039 + if (sdreq == NULL)
12040 + return NULL;
12041 +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
12042 +index 102c681c48b5..dbf74afe82fb 100644
12043 +--- a/net/nfc/netlink.c
12044 ++++ b/net/nfc/netlink.c
12045 +@@ -68,7 +68,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
12046 + };
12047 +
12048 + static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
12049 +- [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
12050 ++ [NFC_SDP_ATTR_URI] = { .type = NLA_STRING,
12051 ++ .len = U8_MAX - 4 },
12052 + [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
12053 + };
12054 +
12055 +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
12056 +index 466393936db9..f135814c34ad 100644
12057 +--- a/net/openvswitch/conntrack.c
12058 ++++ b/net/openvswitch/conntrack.c
12059 +@@ -906,6 +906,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
12060 + return 0;
12061 + }
12062 +
12063 ++/* Trim the skb to the length specified by the IP/IPv6 header,
12064 ++ * removing any trailing lower-layer padding. This prepares the skb
12065 ++ * for higher-layer processing that assumes skb->len excludes padding
12066 ++ * (such as nf_ip_checksum). The caller needs to pull the skb to the
12067 ++ * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
12068 ++ */
12069 ++static int ovs_skb_network_trim(struct sk_buff *skb)
12070 ++{
12071 ++ unsigned int len;
12072 ++ int err;
12073 ++
12074 ++ switch (skb->protocol) {
12075 ++ case htons(ETH_P_IP):
12076 ++ len = ntohs(ip_hdr(skb)->tot_len);
12077 ++ break;
12078 ++ case htons(ETH_P_IPV6):
12079 ++ len = sizeof(struct ipv6hdr)
12080 ++ + ntohs(ipv6_hdr(skb)->payload_len);
12081 ++ break;
12082 ++ default:
12083 ++ len = skb->len;
12084 ++ }
12085 ++
12086 ++ err = pskb_trim_rcsum(skb, len);
12087 ++ if (err)
12088 ++ kfree_skb(skb);
12089 ++
12090 ++ return err;
12091 ++}
12092 ++
12093 + /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
12094 + * value if 'skb' is freed.
12095 + */
12096 +@@ -920,6 +950,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
12097 + nh_ofs = skb_network_offset(skb);
12098 + skb_pull_rcsum(skb, nh_ofs);
12099 +
12100 ++ err = ovs_skb_network_trim(skb);
12101 ++ if (err)
12102 ++ return err;
12103 ++
12104 + if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
12105 + err = handle_fragments(net, key, info->zone.id, skb);
12106 + if (err)
12107 +diff --git a/net/qrtr/smd.c b/net/qrtr/smd.c
12108 +index 0d11132b3370..ff0112bc247f 100644
12109 +--- a/net/qrtr/smd.c
12110 ++++ b/net/qrtr/smd.c
12111 +@@ -116,5 +116,6 @@ static struct qcom_smd_driver qcom_smd_qrtr_driver = {
12112 +
12113 + module_qcom_smd_driver(qcom_smd_qrtr_driver);
12114 +
12115 ++MODULE_ALIAS("rpmsg:IPCRTR");
12116 + MODULE_DESCRIPTION("Qualcomm IPC-Router SMD interface driver");
12117 + MODULE_LICENSE("GPL v2");
12118 +diff --git a/net/rds/ib.c b/net/rds/ib.c
12119 +index 5680d90b0b77..0efb3d2b338d 100644
12120 +--- a/net/rds/ib.c
12121 ++++ b/net/rds/ib.c
12122 +@@ -336,7 +336,8 @@ static int rds_ib_laddr_check(struct net *net, __be32 addr)
12123 + /* Create a CMA ID and try to bind it. This catches both
12124 + * IB and iWARP capable NICs.
12125 + */
12126 +- cm_id = rdma_create_id(&init_net, NULL, NULL, RDMA_PS_TCP, IB_QPT_RC);
12127 ++ cm_id = rdma_create_id(&init_net, rds_rdma_cm_event_handler,
12128 ++ NULL, RDMA_PS_TCP, IB_QPT_RC);
12129 + if (IS_ERR(cm_id))
12130 + return PTR_ERR(cm_id);
12131 +
12132 +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
12133 +index 1060d14d4e6a..f3ac85a285a2 100644
12134 +--- a/net/rxrpc/input.c
12135 ++++ b/net/rxrpc/input.c
12136 +@@ -1166,16 +1166,19 @@ void rxrpc_data_ready(struct sock *udp_sk)
12137 + goto discard_unlock;
12138 +
12139 + if (sp->hdr.callNumber == chan->last_call) {
12140 +- /* For the previous service call, if completed successfully, we
12141 +- * discard all further packets.
12142 ++ if (chan->call ||
12143 ++ sp->hdr.type == RXRPC_PACKET_TYPE_ABORT)
12144 ++ goto discard_unlock;
12145 ++
12146 ++ /* For the previous service call, if completed
12147 ++ * successfully, we discard all further packets.
12148 + */
12149 + if (rxrpc_conn_is_service(conn) &&
12150 +- (chan->last_type == RXRPC_PACKET_TYPE_ACK ||
12151 +- sp->hdr.type == RXRPC_PACKET_TYPE_ABORT))
12152 ++ chan->last_type == RXRPC_PACKET_TYPE_ACK)
12153 + goto discard_unlock;
12154 +
12155 +- /* But otherwise we need to retransmit the final packet from
12156 +- * data cached in the connection record.
12157 ++ /* But otherwise we need to retransmit the final packet
12158 ++ * from data cached in the connection record.
12159 + */
12160 + rxrpc_post_packet_to_conn(conn, skb);
12161 + goto out_unlock;
12162 +diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
12163 +index c29362d50a92..3e52b7fdc35d 100644
12164 +--- a/net/rxrpc/recvmsg.c
12165 ++++ b/net/rxrpc/recvmsg.c
12166 +@@ -493,9 +493,10 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
12167 + ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
12168 + sizeof(unsigned int), &id32);
12169 + } else {
12170 ++ unsigned long idl = call->user_call_ID;
12171 ++
12172 + ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID,
12173 +- sizeof(unsigned long),
12174 +- &call->user_call_ID);
12175 ++ sizeof(unsigned long), &idl);
12176 + }
12177 + if (ret < 0)
12178 + goto error;
12179 +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
12180 +index b214a4d4a641..1de27c39564b 100644
12181 +--- a/net/rxrpc/sendmsg.c
12182 ++++ b/net/rxrpc/sendmsg.c
12183 +@@ -78,7 +78,9 @@ static inline void rxrpc_instant_resend(struct rxrpc_call *call, int ix)
12184 + spin_lock_bh(&call->lock);
12185 +
12186 + if (call->state < RXRPC_CALL_COMPLETE) {
12187 +- call->rxtx_annotations[ix] = RXRPC_TX_ANNO_RETRANS;
12188 ++ call->rxtx_annotations[ix] =
12189 ++ (call->rxtx_annotations[ix] & RXRPC_TX_ANNO_LAST) |
12190 ++ RXRPC_TX_ANNO_RETRANS;
12191 + if (!test_and_set_bit(RXRPC_CALL_EV_RESEND, &call->events))
12192 + rxrpc_queue_call(call);
12193 + }
12194 +diff --git a/scripts/adjust_autoksyms.sh b/scripts/adjust_autoksyms.sh
12195 +index 8dc1918b6783..564db3542ec2 100755
12196 +--- a/scripts/adjust_autoksyms.sh
12197 ++++ b/scripts/adjust_autoksyms.sh
12198 +@@ -83,6 +83,13 @@ while read sympath; do
12199 + depfile="include/config/ksym/${sympath}.h"
12200 + mkdir -p "$(dirname "$depfile")"
12201 + touch "$depfile"
12202 ++ # Filesystems with coarse time precision may create timestamps
12203 ++ # equal to the one from a file that was very recently built and that
12204 ++ # needs to be rebuild. Let's guard against that by making sure our
12205 ++ # dep files are always newer than the first file we created here.
12206 ++ while [ ! "$depfile" -nt "$new_ksyms_file" ]; do
12207 ++ touch "$depfile"
12208 ++ done
12209 + echo $((count += 1))
12210 + done | tail -1 )
12211 + changed=${changed:-0}
12212 +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
12213 +index cbf4996dd9c1..ed29bad1f03a 100644
12214 +--- a/scripts/kconfig/expr.c
12215 ++++ b/scripts/kconfig/expr.c
12216 +@@ -113,7 +113,7 @@ void expr_free(struct expr *e)
12217 + break;
12218 + case E_NOT:
12219 + expr_free(e->left.expr);
12220 +- return;
12221 ++ break;
12222 + case E_EQUAL:
12223 + case E_GEQ:
12224 + case E_GTH:
12225 +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
12226 +index aed678e8a777..4a61636158dd 100644
12227 +--- a/scripts/kconfig/menu.c
12228 ++++ b/scripts/kconfig/menu.c
12229 +@@ -364,6 +364,7 @@ void menu_finalize(struct menu *parent)
12230 + menu->parent = parent;
12231 + last_menu = menu;
12232 + }
12233 ++ expr_free(basedep);
12234 + if (last_menu) {
12235 + parent->list = parent->next;
12236 + parent->next = last_menu->next;
12237 +diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
12238 +index 71bf8bff696a..5122ed2d839a 100644
12239 +--- a/scripts/kconfig/zconf.y
12240 ++++ b/scripts/kconfig/zconf.y
12241 +@@ -107,7 +107,27 @@ static struct menu *current_menu, *current_entry;
12242 + %%
12243 + input: nl start | start;
12244 +
12245 +-start: mainmenu_stmt stmt_list | stmt_list;
12246 ++start: mainmenu_stmt stmt_list | no_mainmenu_stmt stmt_list;
12247 ++
12248 ++/* mainmenu entry */
12249 ++
12250 ++mainmenu_stmt: T_MAINMENU prompt nl
12251 ++{
12252 ++ menu_add_prompt(P_MENU, $2, NULL);
12253 ++};
12254 ++
12255 ++/* Default main menu, if there's no mainmenu entry */
12256 ++
12257 ++no_mainmenu_stmt: /* empty */
12258 ++{
12259 ++ /*
12260 ++ * Hack: Keep the main menu title on the heap so we can safely free it
12261 ++ * later regardless of whether it comes from the 'prompt' in
12262 ++ * mainmenu_stmt or here
12263 ++ */
12264 ++ menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL);
12265 ++};
12266 ++
12267 +
12268 + stmt_list:
12269 + /* empty */
12270 +@@ -344,13 +364,6 @@ if_block:
12271 + | if_block choice_stmt
12272 + ;
12273 +
12274 +-/* mainmenu entry */
12275 +-
12276 +-mainmenu_stmt: T_MAINMENU prompt nl
12277 +-{
12278 +- menu_add_prompt(P_MENU, $2, NULL);
12279 +-};
12280 +-
12281 + /* menu entry */
12282 +
12283 + menu: T_MENU prompt T_EOL
12284 +@@ -495,6 +508,7 @@ word_opt: /* empty */ { $$ = NULL; }
12285 +
12286 + void conf_parse(const char *name)
12287 + {
12288 ++ const char *tmp;
12289 + struct symbol *sym;
12290 + int i;
12291 +
12292 +@@ -502,7 +516,6 @@ void conf_parse(const char *name)
12293 +
12294 + sym_init();
12295 + _menu_init();
12296 +- rootmenu.prompt = menu_add_prompt(P_MENU, "Linux Kernel Configuration", NULL);
12297 +
12298 + if (getenv("ZCONF_DEBUG"))
12299 + zconfdebug = 1;
12300 +@@ -512,8 +525,10 @@ void conf_parse(const char *name)
12301 + if (!modules_sym)
12302 + modules_sym = sym_find( "n" );
12303 +
12304 ++ tmp = rootmenu.prompt->text;
12305 + rootmenu.prompt->text = _(rootmenu.prompt->text);
12306 + rootmenu.prompt->text = sym_expand_string_value(rootmenu.prompt->text);
12307 ++ free((char*)tmp);
12308 +
12309 + menu_finalize(&rootmenu);
12310 + for_all_symbols(i, sym) {
12311 +diff --git a/scripts/package/builddeb b/scripts/package/builddeb
12312 +index 3c575cd07888..0a2a7372538c 100755
12313 +--- a/scripts/package/builddeb
12314 ++++ b/scripts/package/builddeb
12315 +@@ -325,7 +325,7 @@ fi
12316 +
12317 + # Build kernel header package
12318 + (cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl) > "$objtree/debian/hdrsrcfiles"
12319 +-(cd $srctree; find arch/*/include include scripts -type f) >> "$objtree/debian/hdrsrcfiles"
12320 ++(cd $srctree; find arch/*/include include scripts -type f -o -type l) >> "$objtree/debian/hdrsrcfiles"
12321 + (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles"
12322 + (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles"
12323 + if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
12324 +diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
12325 +index 4304372b323f..95433acde1c1 100644
12326 +--- a/security/integrity/digsig.c
12327 ++++ b/security/integrity/digsig.c
12328 +@@ -18,6 +18,7 @@
12329 + #include <linux/cred.h>
12330 + #include <linux/key-type.h>
12331 + #include <linux/digsig.h>
12332 ++#include <linux/vmalloc.h>
12333 + #include <crypto/public_key.h>
12334 + #include <keys/system_keyring.h>
12335 +
12336 +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
12337 +index 38f2ed830dd6..93f09173cc49 100644
12338 +--- a/security/integrity/ima/ima_crypto.c
12339 ++++ b/security/integrity/ima/ima_crypto.c
12340 +@@ -78,6 +78,8 @@ int __init ima_init_crypto(void)
12341 + hash_algo_name[ima_hash_algo], rc);
12342 + return rc;
12343 + }
12344 ++ pr_info("Allocated hash algorithm: %s\n",
12345 ++ hash_algo_name[ima_hash_algo]);
12346 + return 0;
12347 + }
12348 +
12349 +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
12350 +index 2b3def14b4fb..a71f906b4f7a 100644
12351 +--- a/security/integrity/ima/ima_main.c
12352 ++++ b/security/integrity/ima/ima_main.c
12353 +@@ -16,6 +16,9 @@
12354 + * implements the IMA hooks: ima_bprm_check, ima_file_mmap,
12355 + * and ima_file_check.
12356 + */
12357 ++
12358 ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12359 ++
12360 + #include <linux/module.h>
12361 + #include <linux/file.h>
12362 + #include <linux/binfmts.h>
12363 +@@ -426,6 +429,16 @@ static int __init init_ima(void)
12364 +
12365 + hash_setup(CONFIG_IMA_DEFAULT_HASH);
12366 + error = ima_init();
12367 ++
12368 ++ if (error && strcmp(hash_algo_name[ima_hash_algo],
12369 ++ CONFIG_IMA_DEFAULT_HASH) != 0) {
12370 ++ pr_info("Allocating %s failed, going to use default hash algorithm %s\n",
12371 ++ hash_algo_name[ima_hash_algo], CONFIG_IMA_DEFAULT_HASH);
12372 ++ hash_setup_done = 0;
12373 ++ hash_setup(CONFIG_IMA_DEFAULT_HASH);
12374 ++ error = ima_init();
12375 ++ }
12376 ++
12377 + if (!error) {
12378 + ima_initialized = 1;
12379 + ima_update_policy_flag();
12380 +diff --git a/sound/core/timer.c b/sound/core/timer.c
12381 +index e5ddc475dca4..152254193c69 100644
12382 +--- a/sound/core/timer.c
12383 ++++ b/sound/core/timer.c
12384 +@@ -547,7 +547,7 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
12385 + else
12386 + timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
12387 + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
12388 +- SNDRV_TIMER_EVENT_CONTINUE);
12389 ++ SNDRV_TIMER_EVENT_PAUSE);
12390 + unlock:
12391 + spin_unlock_irqrestore(&timer->lock, flags);
12392 + return result;
12393 +@@ -569,7 +569,7 @@ static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
12394 + list_del_init(&timeri->ack_list);
12395 + list_del_init(&timeri->active_list);
12396 + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
12397 +- SNDRV_TIMER_EVENT_CONTINUE);
12398 ++ SNDRV_TIMER_EVENT_PAUSE);
12399 + spin_unlock(&timeri->timer->lock);
12400 + }
12401 + spin_unlock_irqrestore(&slave_active_lock, flags);
12402 +diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c
12403 +index 6c58e6f73a01..7c6ef879c520 100644
12404 +--- a/sound/core/vmaster.c
12405 ++++ b/sound/core/vmaster.c
12406 +@@ -68,10 +68,13 @@ static int slave_update(struct link_slave *slave)
12407 + return -ENOMEM;
12408 + uctl->id = slave->slave.id;
12409 + err = slave->slave.get(&slave->slave, uctl);
12410 ++ if (err < 0)
12411 ++ goto error;
12412 + for (ch = 0; ch < slave->info.count; ch++)
12413 + slave->vals[ch] = uctl->value.integer.value[ch];
12414 ++ error:
12415 + kfree(uctl);
12416 +- return 0;
12417 ++ return err < 0 ? err : 0;
12418 + }
12419 +
12420 + /* get the slave ctl info and save the initial values */
12421 +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
12422 +index 7f3b5ed81995..f7a492c382d9 100644
12423 +--- a/sound/pci/hda/Kconfig
12424 ++++ b/sound/pci/hda/Kconfig
12425 +@@ -88,7 +88,6 @@ config SND_HDA_PATCH_LOADER
12426 + config SND_HDA_CODEC_REALTEK
12427 + tristate "Build Realtek HD-audio codec support"
12428 + select SND_HDA_GENERIC
12429 +- select INPUT
12430 + help
12431 + Say Y or M here to include Realtek HD-audio codec support in
12432 + snd-hda-intel driver, such as ALC880.
12433 +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
12434 +index 7ece1ab57eef..39cd35f6a6df 100644
12435 +--- a/sound/pci/hda/patch_realtek.c
12436 ++++ b/sound/pci/hda/patch_realtek.c
12437 +@@ -3495,6 +3495,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
12438 + }
12439 + }
12440 +
12441 ++#if IS_REACHABLE(INPUT)
12442 + static void gpio2_mic_hotkey_event(struct hda_codec *codec,
12443 + struct hda_jack_callback *event)
12444 + {
12445 +@@ -3627,6 +3628,10 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec,
12446 + spec->kb_dev = NULL;
12447 + }
12448 + }
12449 ++#else /* INPUT */
12450 ++#define alc280_fixup_hp_gpio2_mic_hotkey NULL
12451 ++#define alc233_fixup_lenovo_line2_mic_hotkey NULL
12452 ++#endif /* INPUT */
12453 +
12454 + static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
12455 + const struct hda_fixup *fix, int action)
12456 +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
12457 +index b699aea9a025..7788cfb7cd7e 100644
12458 +--- a/tools/lib/bpf/libbpf.c
12459 ++++ b/tools/lib/bpf/libbpf.c
12460 +@@ -590,6 +590,24 @@ bpf_object__init_maps_name(struct bpf_object *obj)
12461 + return 0;
12462 + }
12463 +
12464 ++static bool section_have_execinstr(struct bpf_object *obj, int idx)
12465 ++{
12466 ++ Elf_Scn *scn;
12467 ++ GElf_Shdr sh;
12468 ++
12469 ++ scn = elf_getscn(obj->efile.elf, idx);
12470 ++ if (!scn)
12471 ++ return false;
12472 ++
12473 ++ if (gelf_getshdr(scn, &sh) != &sh)
12474 ++ return false;
12475 ++
12476 ++ if (sh.sh_flags & SHF_EXECINSTR)
12477 ++ return true;
12478 ++
12479 ++ return false;
12480 ++}
12481 ++
12482 + static int bpf_object__elf_collect(struct bpf_object *obj)
12483 + {
12484 + Elf *elf = obj->efile.elf;
12485 +@@ -673,6 +691,14 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
12486 + } else if (sh.sh_type == SHT_REL) {
12487 + void *reloc = obj->efile.reloc;
12488 + int nr_reloc = obj->efile.nr_reloc + 1;
12489 ++ int sec = sh.sh_info; /* points to other section */
12490 ++
12491 ++ /* Only do relo for section with exec instructions */
12492 ++ if (!section_have_execinstr(obj, sec)) {
12493 ++ pr_debug("skip relo %s(%d) for section(%d)\n",
12494 ++ name, idx, sec);
12495 ++ continue;
12496 ++ }
12497 +
12498 + reloc = realloc(reloc,
12499 + sizeof(*obj->efile.reloc) * nr_reloc);
12500 +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
12501 +index 664c90c8e22b..669475300ba8 100644
12502 +--- a/tools/lib/traceevent/event-parse.c
12503 ++++ b/tools/lib/traceevent/event-parse.c
12504 +@@ -4927,21 +4927,22 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
12505 + else
12506 + ls = 2;
12507 +
12508 +- if (*(ptr+1) == 'F' || *(ptr+1) == 'f' ||
12509 +- *(ptr+1) == 'S' || *(ptr+1) == 's') {
12510 ++ if (isalnum(ptr[1]))
12511 + ptr++;
12512 ++
12513 ++ if (*ptr == 'F' || *ptr == 'f' ||
12514 ++ *ptr == 'S' || *ptr == 's') {
12515 + show_func = *ptr;
12516 +- } else if (*(ptr+1) == 'M' || *(ptr+1) == 'm') {
12517 +- print_mac_arg(s, *(ptr+1), data, size, event, arg);
12518 +- ptr++;
12519 ++ } else if (*ptr == 'M' || *ptr == 'm') {
12520 ++ print_mac_arg(s, *ptr, data, size, event, arg);
12521 + arg = arg->next;
12522 + break;
12523 +- } else if (*(ptr+1) == 'I' || *(ptr+1) == 'i') {
12524 ++ } else if (*ptr == 'I' || *ptr == 'i') {
12525 + int n;
12526 +
12527 +- n = print_ip_arg(s, ptr+1, data, size, event, arg);
12528 ++ n = print_ip_arg(s, ptr, data, size, event, arg);
12529 + if (n > 0) {
12530 +- ptr += n;
12531 ++ ptr += n - 1;
12532 + arg = arg->next;
12533 + break;
12534 + }
12535 +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
12536 +index 7c214ceb9386..5e10ba796a6f 100644
12537 +--- a/tools/lib/traceevent/parse-filter.c
12538 ++++ b/tools/lib/traceevent/parse-filter.c
12539 +@@ -1879,17 +1879,25 @@ static const char *get_field_str(struct filter_arg *arg, struct pevent_record *r
12540 + struct pevent *pevent;
12541 + unsigned long long addr;
12542 + const char *val = NULL;
12543 ++ unsigned int size;
12544 + char hex[64];
12545 +
12546 + /* If the field is not a string convert it */
12547 + if (arg->str.field->flags & FIELD_IS_STRING) {
12548 + val = record->data + arg->str.field->offset;
12549 ++ size = arg->str.field->size;
12550 ++
12551 ++ if (arg->str.field->flags & FIELD_IS_DYNAMIC) {
12552 ++ addr = *(unsigned int *)val;
12553 ++ val = record->data + (addr & 0xffff);
12554 ++ size = addr >> 16;
12555 ++ }
12556 +
12557 + /*
12558 + * We need to copy the data since we can't be sure the field
12559 + * is null terminated.
12560 + */
12561 +- if (*(val + arg->str.field->size - 1)) {
12562 ++ if (*(val + size - 1)) {
12563 + /* copy it */
12564 + memcpy(arg->str.buffer, val, arg->str.field->size);
12565 + /* the buffer is already NULL terminated */
12566 +diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c
12567 +index a74a48db26f5..2eb11543e2e9 100644
12568 +--- a/tools/perf/arch/x86/util/header.c
12569 ++++ b/tools/perf/arch/x86/util/header.c
12570 +@@ -69,7 +69,7 @@ get_cpuid_str(void)
12571 + {
12572 + char *buf = malloc(128);
12573 +
12574 +- if (__get_cpuid(buf, 128, "%s-%u-%X$") < 0) {
12575 ++ if (buf && __get_cpuid(buf, 128, "%s-%u-%X$") < 0) {
12576 + free(buf);
12577 + return NULL;
12578 + }
12579 +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
12580 +index 68861e81f06c..43d5f35e9074 100644
12581 +--- a/tools/perf/builtin-stat.c
12582 ++++ b/tools/perf/builtin-stat.c
12583 +@@ -2042,11 +2042,16 @@ static int add_default_attributes(void)
12584 + return 0;
12585 +
12586 + if (transaction_run) {
12587 ++ struct parse_events_error errinfo;
12588 ++
12589 + if (pmu_have_event("cpu", "cycles-ct") &&
12590 + pmu_have_event("cpu", "el-start"))
12591 +- err = parse_events(evsel_list, transaction_attrs, NULL);
12592 ++ err = parse_events(evsel_list, transaction_attrs,
12593 ++ &errinfo);
12594 + else
12595 +- err = parse_events(evsel_list, transaction_limited_attrs, NULL);
12596 ++ err = parse_events(evsel_list,
12597 ++ transaction_limited_attrs,
12598 ++ &errinfo);
12599 + if (err) {
12600 + fprintf(stderr, "Cannot set up transaction events\n");
12601 + return -1;
12602 +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
12603 +index c61e012e9771..e68c866ae798 100644
12604 +--- a/tools/perf/builtin-top.c
12605 ++++ b/tools/perf/builtin-top.c
12606 +@@ -1061,8 +1061,10 @@ parse_callchain_opt(const struct option *opt, const char *arg, int unset)
12607 +
12608 + static int perf_top_config(const char *var, const char *value, void *cb __maybe_unused)
12609 + {
12610 +- if (!strcmp(var, "top.call-graph"))
12611 +- var = "call-graph.record-mode"; /* fall-through */
12612 ++ if (!strcmp(var, "top.call-graph")) {
12613 ++ var = "call-graph.record-mode";
12614 ++ return perf_default_config(var, value, cb);
12615 ++ }
12616 + if (!strcmp(var, "top.children")) {
12617 + symbol_conf.cumulate_callchain = perf_config_bool(var, value);
12618 + return 0;
12619 +diff --git a/tools/perf/tests/vmlinux-kallsyms.c b/tools/perf/tests/vmlinux-kallsyms.c
12620 +index a5082331f246..2aabf0ae7c0d 100644
12621 +--- a/tools/perf/tests/vmlinux-kallsyms.c
12622 ++++ b/tools/perf/tests/vmlinux-kallsyms.c
12623 +@@ -123,7 +123,7 @@ int test__vmlinux_matches_kallsyms(int subtest __maybe_unused)
12624 +
12625 + if (pair && UM(pair->start) == mem_start) {
12626 + next_pair:
12627 +- if (strcmp(sym->name, pair->name) == 0) {
12628 ++ if (arch__compare_symbol_names(sym->name, pair->name) == 0) {
12629 + /*
12630 + * kallsyms don't have the symbol end, so we
12631 + * set that by using the next symbol start - 1,
12632 +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
12633 +index bce80f866dd0..f55d10854565 100644
12634 +--- a/tools/perf/util/evsel.c
12635 ++++ b/tools/perf/util/evsel.c
12636 +@@ -681,14 +681,14 @@ static void apply_config_terms(struct perf_evsel *evsel,
12637 + struct perf_evsel_config_term *term;
12638 + struct list_head *config_terms = &evsel->config_terms;
12639 + struct perf_event_attr *attr = &evsel->attr;
12640 +- struct callchain_param param;
12641 ++ /* callgraph default */
12642 ++ struct callchain_param param = {
12643 ++ .record_mode = callchain_param.record_mode,
12644 ++ };
12645 + u32 dump_size = 0;
12646 + int max_stack = 0;
12647 + const char *callgraph_buf = NULL;
12648 +
12649 +- /* callgraph default */
12650 +- param.record_mode = callchain_param.record_mode;
12651 +-
12652 + list_for_each_entry(term, config_terms, list) {
12653 + switch (term->type) {
12654 + case PERF_EVSEL__CONFIG_TERM_PERIOD:
12655 +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
12656 +index 10849a079026..ad613ea51434 100644
12657 +--- a/tools/perf/util/hist.c
12658 ++++ b/tools/perf/util/hist.c
12659 +@@ -865,7 +865,7 @@ iter_prepare_cumulative_entry(struct hist_entry_iter *iter,
12660 + * cumulated only one time to prevent entries more than 100%
12661 + * overhead.
12662 + */
12663 +- he_cache = malloc(sizeof(*he_cache) * (iter->max_stack + 1));
12664 ++ he_cache = malloc(sizeof(*he_cache) * (callchain_cursor.nr + 1));
12665 + if (he_cache == NULL)
12666 + return -ENOMEM;
12667 +
12668 +@@ -1030,8 +1030,6 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
12669 + if (err)
12670 + return err;
12671 +
12672 +- iter->max_stack = max_stack_depth;
12673 +-
12674 + err = iter->ops->prepare_entry(iter, al);
12675 + if (err)
12676 + goto out;
12677 +diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
12678 +index a440a04a29ff..159d616e170b 100644
12679 +--- a/tools/perf/util/hist.h
12680 ++++ b/tools/perf/util/hist.h
12681 +@@ -102,7 +102,6 @@ struct hist_entry_iter {
12682 + int curr;
12683 +
12684 + bool hide_unresolved;
12685 +- int max_stack;
12686 +
12687 + struct perf_evsel *evsel;
12688 + struct perf_sample *sample;
12689 +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
12690 +index a899ef81c705..76faf5bf0b32 100644
12691 +--- a/tools/testing/selftests/Makefile
12692 ++++ b/tools/testing/selftests/Makefile
12693 +@@ -94,6 +94,7 @@ ifdef INSTALL_PATH
12694 + for TARGET in $(TARGETS); do \
12695 + echo "echo ; echo Running tests in $$TARGET" >> $(ALL_SCRIPT); \
12696 + echo "echo ========================================" >> $(ALL_SCRIPT); \
12697 ++ echo "[ -w /dev/kmsg ] && echo \"kselftest: Running tests in $$TARGET\" >> /dev/kmsg" >> $(ALL_SCRIPT); \
12698 + echo "cd $$TARGET" >> $(ALL_SCRIPT); \
12699 + make -s --no-print-directory -C $$TARGET emit_tests >> $(ALL_SCRIPT); \
12700 + echo "cd \$$ROOT" >> $(ALL_SCRIPT); \
12701 +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
12702 +new file mode 100644
12703 +index 000000000000..5ba73035e1d9
12704 +--- /dev/null
12705 ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc
12706 +@@ -0,0 +1,46 @@
12707 ++#!/bin/sh
12708 ++# SPDX-License-Identifier: GPL-2.0
12709 ++# description: Kprobe event string type argument
12710 ++
12711 ++[ -f kprobe_events ] || exit_unsupported # this is configurable
12712 ++
12713 ++echo 0 > events/enable
12714 ++echo > kprobe_events
12715 ++
12716 ++case `uname -m` in
12717 ++x86_64)
12718 ++ ARG2=%si
12719 ++ OFFS=8
12720 ++;;
12721 ++i[3456]86)
12722 ++ ARG2=%cx
12723 ++ OFFS=4
12724 ++;;
12725 ++aarch64)
12726 ++ ARG2=%x1
12727 ++ OFFS=8
12728 ++;;
12729 ++arm*)
12730 ++ ARG2=%r1
12731 ++ OFFS=4
12732 ++;;
12733 ++*)
12734 ++ echo "Please implement other architecture here"
12735 ++ exit_untested
12736 ++esac
12737 ++
12738 ++: "Test get argument (1)"
12739 ++echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string" > kprobe_events
12740 ++echo 1 > events/kprobes/testprobe/enable
12741 ++! echo test >> kprobe_events
12742 ++tail -n 1 trace | grep -qe "testprobe.* arg1=\"test\""
12743 ++
12744 ++echo 0 > events/kprobes/testprobe/enable
12745 ++: "Test get argument (2)"
12746 ++echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string arg2=+0(+${OFFS}(${ARG2})):string" > kprobe_events
12747 ++echo 1 > events/kprobes/testprobe/enable
12748 ++! echo test1 test2 >> kprobe_events
12749 ++tail -n 1 trace | grep -qe "testprobe.* arg1=\"test1\" arg2=\"test2\""
12750 ++
12751 ++echo 0 > events/enable
12752 ++echo > kprobe_events
12753 +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
12754 +new file mode 100644
12755 +index 000000000000..231bcd2c4eb5
12756 +--- /dev/null
12757 ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc
12758 +@@ -0,0 +1,97 @@
12759 ++#!/bin/sh
12760 ++# SPDX-License-Identifier: GPL-2.0
12761 ++# description: Kprobe event argument syntax
12762 ++
12763 ++[ -f kprobe_events ] || exit_unsupported # this is configurable
12764 ++
12765 ++grep "x8/16/32/64" README > /dev/null || exit_unsupported # version issue
12766 ++
12767 ++echo 0 > events/enable
12768 ++echo > kprobe_events
12769 ++
12770 ++PROBEFUNC="vfs_read"
12771 ++GOODREG=
12772 ++BADREG=
12773 ++GOODSYM="_sdata"
12774 ++if ! grep -qw ${GOODSYM} /proc/kallsyms ; then
12775 ++ GOODSYM=$PROBEFUNC
12776 ++fi
12777 ++BADSYM="deaqswdefr"
12778 ++SYMADDR=0x`grep -w ${GOODSYM} /proc/kallsyms | cut -f 1 -d " "`
12779 ++GOODTYPE="x16"
12780 ++BADTYPE="y16"
12781 ++
12782 ++case `uname -m` in
12783 ++x86_64|i[3456]86)
12784 ++ GOODREG=%ax
12785 ++ BADREG=%ex
12786 ++;;
12787 ++aarch64)
12788 ++ GOODREG=%x0
12789 ++ BADREG=%ax
12790 ++;;
12791 ++arm*)
12792 ++ GOODREG=%r0
12793 ++ BADREG=%ax
12794 ++;;
12795 ++esac
12796 ++
12797 ++test_goodarg() # Good-args
12798 ++{
12799 ++ while [ "$1" ]; do
12800 ++ echo "p ${PROBEFUNC} $1" > kprobe_events
12801 ++ shift 1
12802 ++ done;
12803 ++}
12804 ++
12805 ++test_badarg() # Bad-args
12806 ++{
12807 ++ while [ "$1" ]; do
12808 ++ ! echo "p ${PROBEFUNC} $1" > kprobe_events
12809 ++ shift 1
12810 ++ done;
12811 ++}
12812 ++
12813 ++echo > kprobe_events
12814 ++
12815 ++: "Register access"
12816 ++test_goodarg ${GOODREG}
12817 ++test_badarg ${BADREG}
12818 ++
12819 ++: "Symbol access"
12820 ++test_goodarg "@${GOODSYM}" "@${SYMADDR}" "@${GOODSYM}+10" "@${GOODSYM}-10"
12821 ++test_badarg "@" "@${BADSYM}" "@${GOODSYM}*10" "@${GOODSYM}/10" \
12822 ++ "@${GOODSYM}%10" "@${GOODSYM}&10" "@${GOODSYM}|10"
12823 ++
12824 ++: "Stack access"
12825 ++test_goodarg "\$stack" "\$stack0" "\$stack1"
12826 ++test_badarg "\$stackp" "\$stack0+10" "\$stack1-10"
12827 ++
12828 ++: "Retval access"
12829 ++echo "r ${PROBEFUNC} \$retval" > kprobe_events
12830 ++! echo "p ${PROBEFUNC} \$retval" > kprobe_events
12831 ++
12832 ++: "Comm access"
12833 ++test_goodarg "\$comm"
12834 ++
12835 ++: "Indirect memory access"
12836 ++test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \
12837 ++ "+0(\$stack1)" "+10(@${GOODSYM}-10)" "+0(+10(+20(\$stack)))"
12838 ++test_badarg "+(${GOODREG})" "(${GOODREG}+10)" "-(${GOODREG})" "(${GOODREG})" \
12839 ++ "+10(\$comm)" "+0(${GOODREG})+10"
12840 ++
12841 ++: "Name assignment"
12842 ++test_goodarg "varname=${GOODREG}"
12843 ++test_badarg "varname=varname2=${GOODREG}"
12844 ++
12845 ++: "Type syntax"
12846 ++test_goodarg "${GOODREG}:${GOODTYPE}"
12847 ++test_badarg "${GOODREG}::${GOODTYPE}" "${GOODREG}:${BADTYPE}" \
12848 ++ "${GOODTYPE}:${GOODREG}"
12849 ++
12850 ++: "Combination check"
12851 ++
12852 ++test_goodarg "\$comm:string" "+0(\$stack):string"
12853 ++test_badarg "\$comm:x64" "\$stack:string" "${GOODREG}:string"
12854 ++
12855 ++echo > kprobe_events
12856 +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
12857 +new file mode 100644
12858 +index 000000000000..4fda01a08da4
12859 +--- /dev/null
12860 ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc
12861 +@@ -0,0 +1,43 @@
12862 ++#!/bin/sh
12863 ++# SPDX-License-Identifier: GPL-2.0
12864 ++# description: Kprobe events - probe points
12865 ++
12866 ++[ -f kprobe_events ] || exit_unsupported # this is configurable
12867 ++
12868 ++TARGET_FUNC=create_trace_kprobe
12869 ++
12870 ++dec_addr() { # hexaddr
12871 ++ printf "%d" "0x"`echo $1 | tail -c 8`
12872 ++}
12873 ++
12874 ++set_offs() { # prev target next
12875 ++ A1=`dec_addr $1`
12876 ++ A2=`dec_addr $2`
12877 ++ A3=`dec_addr $3`
12878 ++ TARGET="0x$2" # an address
12879 ++ PREV=`expr $A1 - $A2` # offset to previous symbol
12880 ++ NEXT=+`expr $A3 - $A2` # offset to next symbol
12881 ++ OVERFLOW=+`printf "0x%x" ${PREV}` # overflow offset to previous symbol
12882 ++}
12883 ++
12884 ++# We have to decode symbol addresses to get correct offsets.
12885 ++# If the offset is not an instruction boundary, it cause -EILSEQ.
12886 ++set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs`
12887 ++
12888 ++UINT_TEST=no
12889 ++# printf "%x" -1 returns (unsigned long)-1.
12890 ++if [ `printf "%x" -1 | wc -c` != 9 ]; then
12891 ++ UINT_TEST=yes
12892 ++fi
12893 ++
12894 ++echo 0 > events/enable
12895 ++echo > kprobe_events
12896 ++echo "p:testprobe ${TARGET_FUNC}" > kprobe_events
12897 ++echo "p:testprobe ${TARGET}" > kprobe_events
12898 ++echo "p:testprobe ${TARGET_FUNC}${NEXT}" > kprobe_events
12899 ++! echo "p:testprobe ${TARGET_FUNC}${PREV}" > kprobe_events
12900 ++if [ "${UINT_TEST}" = yes ]; then
12901 ++! echo "p:testprobe ${TARGET_FUNC}${OVERFLOW}" > kprobe_events
12902 ++fi
12903 ++echo > kprobe_events
12904 ++clear_trace
12905 +diff --git a/tools/testing/selftests/memfd/config b/tools/testing/selftests/memfd/config
12906 +new file mode 100644
12907 +index 000000000000..835c7f4dadcd
12908 +--- /dev/null
12909 ++++ b/tools/testing/selftests/memfd/config
12910 +@@ -0,0 +1 @@
12911 ++CONFIG_FUSE_FS=m
12912 +diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c
12913 +index 412459369686..9b654a070e7d 100644
12914 +--- a/tools/testing/selftests/net/psock_fanout.c
12915 ++++ b/tools/testing/selftests/net/psock_fanout.c
12916 +@@ -97,6 +97,8 @@ static int sock_fanout_open(uint16_t typeflags, int num_packets)
12917 +
12918 + static void sock_fanout_set_ebpf(int fd)
12919 + {
12920 ++ static char log_buf[65536];
12921 ++
12922 + const int len_off = __builtin_offsetof(struct __sk_buff, len);
12923 + struct bpf_insn prog[] = {
12924 + { BPF_ALU64 | BPF_MOV | BPF_X, 6, 1, 0, 0 },
12925 +@@ -109,7 +111,6 @@ static void sock_fanout_set_ebpf(int fd)
12926 + { BPF_ALU | BPF_MOV | BPF_K, 0, 0, 0, 0 },
12927 + { BPF_JMP | BPF_EXIT, 0, 0, 0, 0 }
12928 + };
12929 +- char log_buf[512];
12930 + union bpf_attr attr;
12931 + int pfd;
12932 +
12933 +diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
12934 +index 4a8217448f20..cad14cd0ea92 100644
12935 +--- a/tools/testing/selftests/net/reuseport_bpf.c
12936 ++++ b/tools/testing/selftests/net/reuseport_bpf.c
12937 +@@ -21,6 +21,7 @@
12938 + #include <sys/epoll.h>
12939 + #include <sys/types.h>
12940 + #include <sys/socket.h>
12941 ++#include <sys/resource.h>
12942 + #include <unistd.h>
12943 +
12944 + #ifndef ARRAY_SIZE
12945 +@@ -190,11 +191,14 @@ static void send_from(struct test_params p, uint16_t sport, char *buf,
12946 + struct sockaddr * const saddr = new_any_sockaddr(p.send_family, sport);
12947 + struct sockaddr * const daddr =
12948 + new_loopback_sockaddr(p.send_family, p.recv_port);
12949 +- const int fd = socket(p.send_family, p.protocol, 0);
12950 ++ const int fd = socket(p.send_family, p.protocol, 0), one = 1;
12951 +
12952 + if (fd < 0)
12953 + error(1, errno, "failed to create send socket");
12954 +
12955 ++ if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
12956 ++ error(1, errno, "failed to set reuseaddr");
12957 ++
12958 + if (bind(fd, saddr, sockaddr_size()))
12959 + error(1, errno, "failed to bind send socket");
12960 +
12961 +@@ -433,6 +437,21 @@ void enable_fastopen(void)
12962 + }
12963 + }
12964 +
12965 ++static struct rlimit rlim_old, rlim_new;
12966 ++
12967 ++static __attribute__((constructor)) void main_ctor(void)
12968 ++{
12969 ++ getrlimit(RLIMIT_MEMLOCK, &rlim_old);
12970 ++ rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
12971 ++ rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
12972 ++ setrlimit(RLIMIT_MEMLOCK, &rlim_new);
12973 ++}
12974 ++
12975 ++static __attribute__((destructor)) void main_dtor(void)
12976 ++{
12977 ++ setrlimit(RLIMIT_MEMLOCK, &rlim_old);
12978 ++}
12979 ++
12980 + int main(void)
12981 + {
12982 + fprintf(stderr, "---- IPv4 UDP ----\n");
12983 +diff --git a/tools/testing/selftests/powerpc/mm/subpage_prot.c b/tools/testing/selftests/powerpc/mm/subpage_prot.c
12984 +index 35ade7406dcd..3ae77ba93208 100644
12985 +--- a/tools/testing/selftests/powerpc/mm/subpage_prot.c
12986 ++++ b/tools/testing/selftests/powerpc/mm/subpage_prot.c
12987 +@@ -135,6 +135,16 @@ static int run_test(void *addr, unsigned long size)
12988 + return 0;
12989 + }
12990 +
12991 ++static int syscall_available(void)
12992 ++{
12993 ++ int rc;
12994 ++
12995 ++ errno = 0;
12996 ++ rc = syscall(__NR_subpage_prot, 0, 0, 0);
12997 ++
12998 ++ return rc == 0 || (errno != ENOENT && errno != ENOSYS);
12999 ++}
13000 ++
13001 + int test_anon(void)
13002 + {
13003 + unsigned long align;
13004 +@@ -145,6 +155,8 @@ int test_anon(void)
13005 + void *mallocblock;
13006 + unsigned long mallocsize;
13007 +
13008 ++ SKIP_IF(!syscall_available());
13009 ++
13010 + if (getpagesize() != 0x10000) {
13011 + fprintf(stderr, "Kernel page size must be 64K!\n");
13012 + return 1;
13013 +@@ -180,6 +192,8 @@ int test_file(void)
13014 + off_t filesize;
13015 + int fd;
13016 +
13017 ++ SKIP_IF(!syscall_available());
13018 ++
13019 + fd = open(file_name, O_RDWR);
13020 + if (fd == -1) {
13021 + perror("failed to open file");
13022 +diff --git a/tools/testing/selftests/pstore/config b/tools/testing/selftests/pstore/config
13023 +index 6a8e5a9bfc10..d148f9f89fb6 100644
13024 +--- a/tools/testing/selftests/pstore/config
13025 ++++ b/tools/testing/selftests/pstore/config
13026 +@@ -2,3 +2,4 @@ CONFIG_MISC_FILESYSTEMS=y
13027 + CONFIG_PSTORE=y
13028 + CONFIG_PSTORE_PMSG=y
13029 + CONFIG_PSTORE_CONSOLE=y
13030 ++CONFIG_PSTORE_RAM=m
13031 +diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c
13032 +index 1c12536f2081..18f523557983 100644
13033 +--- a/tools/thermal/tmon/sysfs.c
13034 ++++ b/tools/thermal/tmon/sysfs.c
13035 +@@ -486,6 +486,7 @@ int zone_instance_to_index(int zone_inst)
13036 + int update_thermal_data()
13037 + {
13038 + int i;
13039 ++ int next_thermal_record = cur_thermal_record + 1;
13040 + char tz_name[256];
13041 + static unsigned long samples;
13042 +
13043 +@@ -495,9 +496,9 @@ int update_thermal_data()
13044 + }
13045 +
13046 + /* circular buffer for keeping historic data */
13047 +- if (cur_thermal_record >= NR_THERMAL_RECORDS)
13048 +- cur_thermal_record = 0;
13049 +- gettimeofday(&trec[cur_thermal_record].tv, NULL);
13050 ++ if (next_thermal_record >= NR_THERMAL_RECORDS)
13051 ++ next_thermal_record = 0;
13052 ++ gettimeofday(&trec[next_thermal_record].tv, NULL);
13053 + if (tmon_log) {
13054 + fprintf(tmon_log, "%lu ", ++samples);
13055 + fprintf(tmon_log, "%3.1f ", p_param.t_target);
13056 +@@ -507,11 +508,12 @@ int update_thermal_data()
13057 + snprintf(tz_name, 256, "%s/%s%d", THERMAL_SYSFS, TZONE,
13058 + ptdata.tzi[i].instance);
13059 + sysfs_get_ulong(tz_name, "temp",
13060 +- &trec[cur_thermal_record].temp[i]);
13061 ++ &trec[next_thermal_record].temp[i]);
13062 + if (tmon_log)
13063 + fprintf(tmon_log, "%lu ",
13064 +- trec[cur_thermal_record].temp[i]/1000);
13065 ++ trec[next_thermal_record].temp[i] / 1000);
13066 + }
13067 ++ cur_thermal_record = next_thermal_record;
13068 + for (i = 0; i < ptdata.nr_cooling_dev; i++) {
13069 + char cdev_name[256];
13070 + unsigned long val;
13071 +diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c
13072 +index 9aa19652e8e8..b43138f8b862 100644
13073 +--- a/tools/thermal/tmon/tmon.c
13074 ++++ b/tools/thermal/tmon/tmon.c
13075 +@@ -336,7 +336,6 @@ int main(int argc, char **argv)
13076 + show_data_w();
13077 + show_cooling_device();
13078 + }
13079 +- cur_thermal_record++;
13080 + time_elapsed += ticktime;
13081 + controller_handler(trec[0].temp[target_tz_index] / 1000,
13082 + &yk);
13083 +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
13084 +index eaae7252f60c..4f2a2df85b1f 100644
13085 +--- a/virt/kvm/kvm_main.c
13086 ++++ b/virt/kvm/kvm_main.c
13087 +@@ -1466,7 +1466,8 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
13088 +
13089 + static int hva_to_pfn_remapped(struct vm_area_struct *vma,
13090 + unsigned long addr, bool *async,
13091 +- bool write_fault, kvm_pfn_t *p_pfn)
13092 ++ bool write_fault, bool *writable,
13093 ++ kvm_pfn_t *p_pfn)
13094 + {
13095 + unsigned long pfn;
13096 + int r;
13097 +@@ -1492,6 +1493,8 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
13098 +
13099 + }
13100 +
13101 ++ if (writable)
13102 ++ *writable = true;
13103 +
13104 + /*
13105 + * Get a reference here because callers of *hva_to_pfn* and
13106 +@@ -1557,7 +1560,7 @@ static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
13107 + if (vma == NULL)
13108 + pfn = KVM_PFN_ERR_FAULT;
13109 + else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) {
13110 +- r = hva_to_pfn_remapped(vma, addr, async, write_fault, &pfn);
13111 ++ r = hva_to_pfn_remapped(vma, addr, async, write_fault, writable, &pfn);
13112 + if (r == -EAGAIN)
13113 + goto retry;
13114 + if (r < 0)