diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2019-12-31 08:56:10 -0500 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2019-12-31 08:56:10 -0500 |
| commit | 38a3596cbc44155e080a890297511b9b663caf94 (patch) | |
| tree | 8da40b6ecdf38921f7c49acc8703fc5ab6fc0273 /1160_linux-4.14.161.patch | |
| parent | Linux patch 4.14.160 (diff) | |
| download | linux-patches-38a3596cbc44155e080a890297511b9b663caf94.tar.gz linux-patches-38a3596cbc44155e080a890297511b9b663caf94.tar.bz2 linux-patches-38a3596cbc44155e080a890297511b9b663caf94.zip | |
Linux patch 4.14.1614.14-170
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
Diffstat (limited to '1160_linux-4.14.161.patch')
| -rw-r--r-- | 1160_linux-4.14.161.patch | 4240 |
1 files changed, 4240 insertions, 0 deletions
diff --git a/1160_linux-4.14.161.patch b/1160_linux-4.14.161.patch new file mode 100644 index 00000000..a74a8d40 --- /dev/null +++ b/1160_linux-4.14.161.patch @@ -0,0 +1,4240 @@ +diff --git a/Makefile b/Makefile +index f011cb69545f..6b4528888a75 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 160 ++SUBLEVEL = 161 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c +index e8edbf13302a..3856d51c645b 100644 +--- a/arch/arm64/kernel/psci.c ++++ b/arch/arm64/kernel/psci.c +@@ -84,7 +84,8 @@ static void cpu_psci_cpu_die(unsigned int cpu) + + static int cpu_psci_cpu_kill(unsigned int cpu) + { +- int err, i; ++ int err; ++ unsigned long start, end; + + if (!psci_ops.affinity_info) + return 0; +@@ -94,16 +95,18 @@ static int cpu_psci_cpu_kill(unsigned int cpu) + * while it is dying. So, try again a few times. + */ + +- for (i = 0; i < 10; i++) { ++ start = jiffies; ++ end = start + msecs_to_jiffies(100); ++ do { + err = psci_ops.affinity_info(cpu_logical_map(cpu), 0); + if (err == PSCI_0_2_AFFINITY_LEVEL_OFF) { +- pr_info("CPU%d killed.\n", cpu); ++ pr_info("CPU%d killed (polled %d ms)\n", cpu, ++ jiffies_to_msecs(jiffies - start)); + return 0; + } + +- msleep(10); +- pr_info("Retrying again to check for CPU kill\n"); +- } ++ usleep_range(100, 1000); ++ } while (time_before(jiffies, end)); + + pr_warn("CPU%d may not have shut down cleanly (AFFINITY_INFO reports %d)\n", + cpu, err); +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index cfbf7bd0dfba..32ae5c9daac4 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -1785,8 +1785,11 @@ static const struct sys_reg_desc *index_to_sys_reg_desc(struct kvm_vcpu *vcpu, + if ((id & KVM_REG_ARM_COPROC_MASK) != KVM_REG_ARM64_SYSREG) + return NULL; + ++ if (!index_to_params(id, ¶ms)) ++ return NULL; ++ + table = get_target_table(vcpu->arch.target, true, &num); +- r = find_reg_by_id(id, ¶ms, table, num); ++ r = find_reg(¶ms, table, num); + if (!r) + r = find_reg(¶ms, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); + +diff --git a/arch/mips/include/asm/pgtable-64.h b/arch/mips/include/asm/pgtable-64.h +index a2252c2a9ded..d0b9912fb63f 100644 +--- a/arch/mips/include/asm/pgtable-64.h ++++ b/arch/mips/include/asm/pgtable-64.h +@@ -18,10 +18,12 @@ + #include <asm/fixmap.h> + + #define __ARCH_USE_5LEVEL_HACK +-#if defined(CONFIG_PAGE_SIZE_64KB) && !defined(CONFIG_MIPS_VA_BITS_48) ++#if CONFIG_PGTABLE_LEVELS == 2 + #include <asm-generic/pgtable-nopmd.h> +-#elif !(defined(CONFIG_PAGE_SIZE_4KB) && defined(CONFIG_MIPS_VA_BITS_48)) ++#elif CONFIG_PGTABLE_LEVELS == 3 + #include <asm-generic/pgtable-nopud.h> ++#else ++#include <asm-generic/5level-fixup.h> + #endif + + /* +@@ -222,6 +224,9 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd) + return pgd_val(pgd); + } + ++#define pgd_phys(pgd) virt_to_phys((void *)pgd_val(pgd)) ++#define pgd_page(pgd) (pfn_to_page(pgd_phys(pgd) >> PAGE_SHIFT)) ++ + static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) + { + return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address); +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 0ce8b0e5d7ba..207ba53a500b 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -561,8 +561,6 @@ void __do_irq(struct pt_regs *regs) + + trace_irq_entry(regs); + +- check_stack_overflow(); +- + /* + * Query the platform PIC for the interrupt & ack it. + * +@@ -594,6 +592,8 @@ void do_IRQ(struct pt_regs *regs) + irqtp = hardirq_ctx[raw_smp_processor_id()]; + sirqtp = softirq_ctx[raw_smp_processor_id()]; + ++ check_stack_overflow(); ++ + /* Already there ? */ + if (unlikely(curtp == irqtp || curtp == sirqtp)) { + __do_irq(regs); +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index bbe99cb8219d..11857fea993c 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -70,7 +70,12 @@ static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION2_ENTRY_EMPTY); + return (p4d_t *) table; + } +-#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d) ++ ++static inline void p4d_free(struct mm_struct *mm, p4d_t *p4d) ++{ ++ if (!mm_p4d_folded(mm)) ++ crst_table_free(mm, (unsigned long *) p4d); ++} + + static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + { +@@ -79,7 +84,12 @@ static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address) + crst_table_init(table, _REGION3_ENTRY_EMPTY); + return (pud_t *) table; + } +-#define pud_free(mm, pud) crst_table_free(mm, (unsigned long *) pud) ++ ++static inline void pud_free(struct mm_struct *mm, pud_t *pud) ++{ ++ if (!mm_pud_folded(mm)) ++ crst_table_free(mm, (unsigned long *) pud); ++} + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + { +@@ -97,6 +107,8 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long vmaddr) + + static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd) + { ++ if (mm_pmd_folded(mm)) ++ return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + crst_table_free(mm, (unsigned long *) pmd); + } +diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h +index 64539c221672..2dc9eb4e1acc 100644 +--- a/arch/s390/include/asm/timex.h ++++ b/arch/s390/include/asm/timex.h +@@ -10,8 +10,9 @@ + #ifndef _ASM_S390_TIMEX_H + #define _ASM_S390_TIMEX_H + +-#include <asm/lowcore.h> ++#include <linux/preempt.h> + #include <linux/time64.h> ++#include <asm/lowcore.h> + + /* The value of the TOD clock for 1.1.1970. */ + #define TOD_UNIX_EPOCH 0x7d91048bca000000ULL +@@ -186,15 +187,18 @@ extern unsigned char tod_clock_base[16] __aligned(8); + /** + * get_clock_monotonic - returns current time in clock rate units + * +- * The caller must ensure that preemption is disabled. + * The clock and tod_clock_base get changed via stop_machine. +- * Therefore preemption must be disabled when calling this +- * function, otherwise the returned value is not guaranteed to +- * be monotonic. ++ * Therefore preemption must be disabled, otherwise the returned ++ * value is not guaranteed to be monotonic. + */ + static inline unsigned long long get_tod_clock_monotonic(void) + { +- return get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ unsigned long long tod; ++ ++ preempt_disable_notrace(); ++ tod = get_tod_clock() - *(unsigned long long *) &tod_clock_base[1]; ++ preempt_enable_notrace(); ++ return tod; + } + + /** +diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c +index 2394557653d5..6d154069c962 100644 +--- a/arch/s390/kernel/dis.c ++++ b/arch/s390/kernel/dis.c +@@ -1930,10 +1930,11 @@ static int print_insn(char *buffer, unsigned char *code, unsigned long addr) + ptr += sprintf(ptr, "%%c%i", value); + else if (operand->flags & OPERAND_VR) + ptr += sprintf(ptr, "%%v%i", value); +- else if (operand->flags & OPERAND_PCREL) +- ptr += sprintf(ptr, "%lx", (signed int) value +- + addr); +- else if (operand->flags & OPERAND_SIGNED) ++ else if (operand->flags & OPERAND_PCREL) { ++ void *pcrel = (void *)((int)value + addr); ++ ++ ptr += sprintf(ptr, "%px", pcrel); ++ } else if (operand->flags & OPERAND_SIGNED) + ptr += sprintf(ptr, "%i", value); + else + ptr += sprintf(ptr, "%u", value); +@@ -2005,7 +2006,7 @@ void show_code(struct pt_regs *regs) + else + *ptr++ = ' '; + addr = regs->psw.addr + start - 32; +- ptr += sprintf(ptr, "%016lx: ", addr); ++ ptr += sprintf(ptr, "%px: ", (void *)addr); + if (start + opsize >= end) + break; + for (i = 0; i < opsize; i++) +@@ -2033,7 +2034,7 @@ void print_fn_code(unsigned char *code, unsigned long len) + opsize = insn_length(*code); + if (opsize > len) + break; +- ptr += sprintf(ptr, "%p: ", code); ++ ptr += sprintf(ptr, "%px: ", code); + for (i = 0; i < opsize; i++) + ptr += sprintf(ptr, "%02x", code[i]); + *ptr++ = '\t'; +diff --git a/arch/sh/include/cpu-sh4/cpu/sh7734.h b/arch/sh/include/cpu-sh4/cpu/sh7734.h +index 96f0246ad2f2..82b63208135a 100644 +--- a/arch/sh/include/cpu-sh4/cpu/sh7734.h ++++ b/arch/sh/include/cpu-sh4/cpu/sh7734.h +@@ -134,7 +134,7 @@ enum { + GPIO_FN_EX_WAIT1, GPIO_FN_SD1_DAT0_A, GPIO_FN_DREQ2, GPIO_FN_CAN1_TX_C, + GPIO_FN_ET0_LINK_C, GPIO_FN_ET0_ETXD5_A, + GPIO_FN_EX_WAIT0, GPIO_FN_TCLK1_B, +- GPIO_FN_RD_WR, GPIO_FN_TCLK0, ++ GPIO_FN_RD_WR, GPIO_FN_TCLK0, GPIO_FN_CAN_CLK_B, GPIO_FN_ET0_ETXD4, + GPIO_FN_EX_CS5, GPIO_FN_SD1_CMD_A, GPIO_FN_ATADIR, GPIO_FN_QSSL_B, + GPIO_FN_ET0_ETXD3_A, + GPIO_FN_EX_CS4, GPIO_FN_SD1_WP_A, GPIO_FN_ATAWR, GPIO_FN_QMI_QIO1_B, +diff --git a/arch/x86/include/asm/crash.h b/arch/x86/include/asm/crash.h +index a7adb2bfbf0b..6b8ad6fa3979 100644 +--- a/arch/x86/include/asm/crash.h ++++ b/arch/x86/include/asm/crash.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_CRASH_H + #define _ASM_X86_CRASH_H + ++struct kimage; ++ + int crash_load_segments(struct kimage *image); + int crash_copy_backup_region(struct kimage *image); + int crash_setup_memmap_entries(struct kimage *image, +diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h +index 6390bd8c141b..5e12b2319d7a 100644 +--- a/arch/x86/include/asm/fixmap.h ++++ b/arch/x86/include/asm/fixmap.h +@@ -159,7 +159,7 @@ extern pte_t *kmap_pte; + extern pte_t *pkmap_page_table; + + void __native_set_fixmap(enum fixed_addresses idx, pte_t pte); +-void native_set_fixmap(enum fixed_addresses idx, ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, + phys_addr_t phys, pgprot_t flags); + + #ifndef CONFIG_PARAVIRT +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 566b7bc5deaa..2271adbc3c42 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -1690,9 +1690,10 @@ static bool io_apic_level_ack_pending(struct mp_chip_data *data) + + static inline bool ioapic_irqd_mask(struct irq_data *data) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic_irq(data); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic_irq(data); + return true; + } + return false; +@@ -1729,7 +1730,9 @@ static inline void ioapic_irqd_unmask(struct irq_data *data, bool masked) + */ + if (!io_apic_level_ack_pending(data->chip_data)) + irq_move_masked_irq(data); +- unmask_ioapic_irq(data); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic_irq(data); + } + } + #else +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index b434780ae680..a8f47697276b 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -228,10 +228,10 @@ static void smca_configure(unsigned int bank, unsigned int cpu) + } + + /* Return early if this bank was already initialized. */ +- if (smca_banks[bank].hwid) ++ if (smca_banks[bank].hwid && smca_banks[bank].hwid->hwid_mcatype != 0) + return; + +- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { ++ if (rdmsr_safe(MSR_AMD64_SMCA_MCx_IPID(bank), &low, &high)) { + pr_warn("Failed to read MCA_IPID for bank %d\n", bank); + return; + } +diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c +index ee229ceee745..ec6a07b04fdb 100644 +--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c ++++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c +@@ -185,7 +185,7 @@ static void therm_throt_process(bool new_event, int event, int level) + /* if we just entered the thermal event */ + if (new_event) { + if (event == THERMAL_THROTTLING_EVENT) +- pr_crit("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", ++ pr_warn("CPU%d: %s temperature above threshold, cpu clock throttled (total events = %lu)\n", + this_cpu, + level == CORE_LEVEL ? "Core" : "Package", + state->count); +diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/arch/x86/lib/x86-opcode-map.txt ++++ b/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index b4fd36271f90..55338b392221 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -590,8 +590,8 @@ void __native_set_fixmap(enum fixed_addresses idx, pte_t pte) + fixmaps_set++; + } + +-void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, +- pgprot_t flags) ++void native_set_fixmap(unsigned /* enum fixed_addresses */ idx, ++ phys_addr_t phys, pgprot_t flags) + { + __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags)); + } +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index cbb162b683b6..08f67c109429 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -6676,6 +6676,9 @@ void ata_host_detach(struct ata_host *host) + { + int i; + ++ /* Ensure ata_port probe has completed */ ++ async_synchronize_full(); ++ + for (i = 0; i < host->n_ports; i++) + ata_port_detach(host->ports[i]); + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ec61dd873c93..453e3728e657 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -414,18 +414,20 @@ out_free_page: + return ret; + } + +-static int lo_discard(struct loop_device *lo, struct request *rq, loff_t pos) ++static int lo_fallocate(struct loop_device *lo, struct request *rq, loff_t pos, ++ int mode) + { + /* +- * We use punch hole to reclaim the free space used by the +- * image a.k.a. discard. However we do not support discard if +- * encryption is enabled, because it may give an attacker +- * useful information. ++ * We use fallocate to manipulate the space mappings used by the image ++ * a.k.a. discard/zerorange. However we do not support this if ++ * encryption is enabled, because it may give an attacker useful ++ * information. + */ + struct file *file = lo->lo_backing_file; +- int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + int ret; + ++ mode |= FALLOC_FL_KEEP_SIZE; ++ + if ((!file->f_op->fallocate) || lo->lo_encrypt_key_size) { + ret = -EOPNOTSUPP; + goto out; +@@ -565,9 +567,17 @@ static int do_req_filebacked(struct loop_device *lo, struct request *rq) + switch (req_op(rq)) { + case REQ_OP_FLUSH: + return lo_req_flush(lo, rq); +- case REQ_OP_DISCARD: + case REQ_OP_WRITE_ZEROES: +- return lo_discard(lo, rq, pos); ++ /* ++ * If the caller doesn't want deallocation, call zeroout to ++ * write zeroes the range. Otherwise, punch them out. ++ */ ++ return lo_fallocate(lo, rq, pos, ++ (rq->cmd_flags & REQ_NOUNMAP) ? ++ FALLOC_FL_ZERO_RANGE : ++ FALLOC_FL_PUNCH_HOLE); ++ case REQ_OP_DISCARD: ++ return lo_fallocate(lo, rq, pos, FALLOC_FL_PUNCH_HOLE); + case REQ_OP_WRITE: + if (lo->transfer) + return lo_write_transfer(lo, rq, pos); +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 929bd255a290..4c661ad91e7d 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1234,10 +1234,10 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b + mutex_unlock(&nbd->config_lock); + ret = wait_event_interruptible(config->recv_wq, + atomic_read(&config->recv_threads) == 0); +- if (ret) { ++ if (ret) + sock_shutdown(nbd); +- flush_workqueue(nbd->recv_workq); +- } ++ flush_workqueue(nbd->recv_workq); ++ + mutex_lock(&nbd->config_lock); + bd_set_size(bdev, 0); + /* user requested, ignore socket errors */ +diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c +index 38b719017186..648e39ce6bd9 100644 +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -121,7 +121,8 @@ static int omap3_rom_rng_remove(struct platform_device *pdev) + { + cancel_delayed_work_sync(&idle_work); + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 480e8c13567c..c798a1233e6a 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -2475,6 +2475,13 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) + if (cpufreq_disabled()) + return -ENODEV; + ++ /* ++ * The cpufreq core depends heavily on the availability of device ++ * structure, make sure they are available before proceeding further. ++ */ ++ if (!get_cpu_device(0)) ++ return -EPROBE_DEFER; ++ + if (!driver_data || !driver_data->verify || !driver_data->init || + !(driver_data->setpolicy || driver_data->target_index || + driver_data->target) || +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +index 5cf64746731a..22e491857925 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-cipher.c +@@ -81,7 +81,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + oi = 0; + oo = 0; + do { +- todo = min3(rx_cnt, ileft, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo) { + ileft -= todo; + writesl(ss->base + SS_RXFIFO, mi.addr + oi, todo); +@@ -96,7 +97,8 @@ static int sun4i_ss_opti_poll(struct skcipher_request *areq) + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); + +- todo = min3(tx_cnt, oleft, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + oleft -= todo; + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); +@@ -220,7 +222,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * todo is the number of consecutive 4byte word that we + * can read from current SG + */ +- todo = min3(rx_cnt, ileft / 4, (mi.length - oi) / 4); ++ todo = min(rx_cnt, ileft / 4); ++ todo = min_t(size_t, todo, (mi.length - oi) / 4); + if (todo && !ob) { + writesl(ss->base + SS_RXFIFO, mi.addr + oi, + todo); +@@ -234,8 +237,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * we need to be able to write all buf in one + * pass, so it is why we min() with rx_cnt + */ +- todo = min3(rx_cnt * 4 - ob, ileft, +- mi.length - oi); ++ todo = min(rx_cnt * 4 - ob, ileft); ++ todo = min_t(size_t, todo, mi.length - oi); + memcpy(buf + ob, mi.addr + oi, todo); + ileft -= todo; + oi += todo; +@@ -255,7 +258,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + spaces = readl(ss->base + SS_FCSR); + rx_cnt = SS_RXFIFO_SPACES(spaces); + tx_cnt = SS_TXFIFO_SPACES(spaces); +- dev_dbg(ss->dev, "%x %u/%u %u/%u cnt=%u %u/%u %u/%u cnt=%u %u\n", ++ dev_dbg(ss->dev, ++ "%x %u/%zu %u/%u cnt=%u %u/%zu %u/%u cnt=%u %u\n", + mode, + oi, mi.length, ileft, areq->cryptlen, rx_cnt, + oo, mo.length, oleft, areq->cryptlen, tx_cnt, ob); +@@ -263,7 +267,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + if (!tx_cnt) + continue; + /* todo in 4bytes word */ +- todo = min3(tx_cnt, oleft / 4, (mo.length - oo) / 4); ++ todo = min(tx_cnt, oleft / 4); ++ todo = min_t(size_t, todo, (mo.length - oo) / 4); + if (todo) { + readsl(ss->base + SS_TXFIFO, mo.addr + oo, todo); + oleft -= todo * 4; +@@ -287,7 +292,8 @@ static int sun4i_ss_cipher_poll(struct skcipher_request *areq) + * no more than remaining buffer + * no need to test against oleft + */ +- todo = min(mo.length - oo, obl - obo); ++ todo = min_t(size_t, ++ mo.length - oo, obl - obo); + memcpy(mo.addr + oo, bufo + obo, todo); + oleft -= todo; + obo += todo; +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +index f6936bb3b7be..1a724263761b 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-hash.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-hash.c +@@ -276,8 +276,8 @@ static int sun4i_hash(struct ahash_request *areq) + */ + while (op->len < 64 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, end - i, +- 64 - op->len); ++ in_r = min(end - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +@@ -297,8 +297,8 @@ static int sun4i_hash(struct ahash_request *areq) + } + if (mi.length - in_i > 3 && i < end) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- ((mi.length - in_i) / 4) * 4); ++ in_r = min_t(size_t, mi.length - in_i, areq->nbytes - i); ++ in_r = min_t(size_t, ((mi.length - in_i) / 4) * 4, in_r); + /* how many bytes we can write in the device*/ + todo = min3((u32)(end - i) / 4, rx_cnt, (u32)in_r / 4); + writesl(ss->base + SS_RXFIFO, mi.addr + in_i, todo); +@@ -324,8 +324,8 @@ static int sun4i_hash(struct ahash_request *areq) + if ((areq->nbytes - i) < 64) { + while (i < areq->nbytes && in_i < mi.length && op->len < 64) { + /* how many bytes we can read from current SG */ +- in_r = min3(mi.length - in_i, areq->nbytes - i, +- 64 - op->len); ++ in_r = min(areq->nbytes - i, 64 - op->len); ++ in_r = min_t(size_t, mi.length - in_i, in_r); + memcpy(op->buf + op->len, mi.addr + in_i, in_r); + op->len += in_r; + i += in_r; +diff --git a/drivers/crypto/virtio/virtio_crypto_algs.c b/drivers/crypto/virtio/virtio_crypto_algs.c +index 5035b0dc1e40..e2231a1a05a1 100644 +--- a/drivers/crypto/virtio/virtio_crypto_algs.c ++++ b/drivers/crypto/virtio/virtio_crypto_algs.c +@@ -110,8 +110,6 @@ virtio_crypto_alg_validate_key(int key_len, uint32_t *alg) + *alg = VIRTIO_CRYPTO_CIPHER_AES_CBC; + break; + default: +- pr_err("virtio_crypto: Unsupported key length: %d\n", +- key_len); + return -EINVAL; + } + return 0; +@@ -485,6 +483,11 @@ static int virtio_crypto_ablkcipher_encrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +@@ -505,6 +508,11 @@ static int virtio_crypto_ablkcipher_decrypt(struct ablkcipher_request *req) + /* Use the first data virtqueue as default */ + struct data_queue *data_vq = &vcrypto->data_vq[0]; + ++ if (!req->nbytes) ++ return 0; ++ if (req->nbytes % AES_BLOCK_SIZE) ++ return -EINVAL; ++ + vc_req->dataq = data_vq; + vc_req->alg_cb = virtio_crypto_dataq_sym_callback; + vc_sym_req->ablkcipher_ctx = ctx; +diff --git a/drivers/crypto/vmx/Makefile b/drivers/crypto/vmx/Makefile +index cab32cfec9c4..709670d2b553 100644 +--- a/drivers/crypto/vmx/Makefile ++++ b/drivers/crypto/vmx/Makefile +@@ -3,13 +3,13 @@ obj-$(CONFIG_CRYPTO_DEV_VMX_ENCRYPT) += vmx-crypto.o + vmx-crypto-objs := vmx.o aesp8-ppc.o ghashp8-ppc.o aes.o aes_cbc.o aes_ctr.o aes_xts.o ghash.o + + ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y) +-TARGET := linux-ppc64le ++override flavour := linux-ppc64le + else +-TARGET := linux-ppc64 ++override flavour := linux-ppc64 + endif + + quiet_cmd_perl = PERL $@ +- cmd_perl = $(PERL) $(<) $(TARGET) > $(@) ++ cmd_perl = $(PERL) $(<) $(flavour) > $(@) + + targets += aesp8-ppc.S ghashp8-ppc.S + +diff --git a/drivers/edac/ghes_edac.c b/drivers/edac/ghes_edac.c +index 6f80eb65c26c..acae39278669 100644 +--- a/drivers/edac/ghes_edac.c ++++ b/drivers/edac/ghes_edac.c +@@ -187,6 +187,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + /* Cleans the error report buffer */ + memset(e, 0, sizeof (*e)); + e->error_count = 1; ++ e->grain = 1; + strcpy(e->label, "unknown label"); + e->msg = pvt->msg; + e->other_detail = pvt->other_detail; +@@ -282,7 +283,7 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + + /* Error grain */ + if (mem_err->validation_bits & CPER_MEM_VALID_PA_MASK) +- e->grain = ~(mem_err->physical_addr_mask & ~PAGE_MASK); ++ e->grain = ~mem_err->physical_addr_mask + 1; + + /* Memory error location, mapped on e->location */ + p = e->location; +@@ -389,8 +390,13 @@ void ghes_edac_report_mem_error(struct ghes *ghes, int sev, + if (p > pvt->other_detail) + *(p - 1) = '\0'; + ++ /* Sanity-check driver-supplied grain value. */ ++ if (WARN_ON_ONCE(!e->grain)) ++ e->grain = 1; ++ ++ grain_bits = fls_long(e->grain - 1); ++ + /* Generate the trace event */ +- grain_bits = fls_long(e->grain); + snprintf(pvt->detail_location, sizeof(pvt->detail_location), + "APEI location: %s %s", e->location, e->other_detail); + trace_mc_event(type, e->msg, e->label, e->error_count, +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index 106ef0297b53..1a1ee3db3455 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -69,6 +69,10 @@ struct sm5502_muic_info { + /* Default value of SM5502 register to bring up MUIC device. */ + static struct reg_data sm5502_reg_data[] = { + { ++ .reg = SM5502_REG_RESET, ++ .val = SM5502_REG_RESET_MASK, ++ .invert = true, ++ }, { + .reg = SM5502_REG_CONTROL, + .val = SM5502_REG_CONTROL_MASK_INT_MASK, + .invert = false, +diff --git a/drivers/extcon/extcon-sm5502.h b/drivers/extcon/extcon-sm5502.h +index 974b53222f56..12f8b01e5753 100644 +--- a/drivers/extcon/extcon-sm5502.h ++++ b/drivers/extcon/extcon-sm5502.h +@@ -241,6 +241,8 @@ enum sm5502_reg { + #define DM_DP_SWITCH_UART ((DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DP_SHIFT) \ + | (DM_DP_CON_SWITCH_UART <<SM5502_REG_MANUAL_SW1_DM_SHIFT)) + ++#define SM5502_REG_RESET_MASK (0x1) ++ + /* SM5502 Interrupts */ + enum sm5502_irq { + /* INT1 */ +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 4ea63d9bd131..8feca59c1f6b 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -419,6 +419,31 @@ static int fsi_slave_scan(struct fsi_slave *slave) + return 0; + } + ++static unsigned long aligned_access_size(size_t offset, size_t count) ++{ ++ unsigned long offset_unit, count_unit; ++ ++ /* Criteria: ++ * ++ * 1. Access size must be less than or equal to the maximum access ++ * width or the highest power-of-two factor of offset ++ * 2. Access size must be less than or equal to the amount specified by ++ * count ++ * ++ * The access width is optimal if we can calculate 1 to be strictly ++ * equal while still satisfying 2. ++ */ ++ ++ /* Find 1 by the bottom bit of offset (with a 4 byte access cap) */ ++ offset_unit = BIT(__builtin_ctzl(offset | 4)); ++ ++ /* Find 2 by the top bit of count */ ++ count_unit = BIT(8 * sizeof(unsigned long) - 1 - __builtin_clzl(count)); ++ ++ /* Constrain the maximum access width to the minimum of both criteria */ ++ return BIT(__builtin_ctzl(offset_unit | count_unit)); ++} ++ + static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + struct kobject *kobj, struct bin_attribute *attr, char *buf, + loff_t off, size_t count) +@@ -434,8 +459,7 @@ static ssize_t fsi_slave_sysfs_raw_read(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += read_len) { +- read_len = min_t(size_t, count, 4); +- read_len -= off & 0x3; ++ read_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_read(slave, off, buf + total_len, read_len); + if (rc) +@@ -462,8 +486,7 @@ static ssize_t fsi_slave_sysfs_raw_write(struct file *file, + return -EINVAL; + + for (total_len = 0; total_len < count; total_len += write_len) { +- write_len = min_t(size_t, count, 4); +- write_len -= off & 0x3; ++ write_len = aligned_access_size(off, count - total_len); + + rc = fsi_slave_write(slave, off, buf + total_len, write_len); + if (rc) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +index ed8c3739015b..b35b0741fd97 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c +@@ -125,6 +125,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(vram_obj, &vram_map); + if (r) { +@@ -170,6 +171,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev) + } + + dma_fence_put(fence); ++ fence = NULL; + + r = amdgpu_bo_kmap(gtt_obj[i], >t_map); + if (r) { +diff --git a/drivers/gpu/drm/bridge/analogix-anx78xx.c b/drivers/gpu/drm/bridge/analogix-anx78xx.c +index 9385eb0b1ee4..cd2bfd7bf048 100644 +--- a/drivers/gpu/drm/bridge/analogix-anx78xx.c ++++ b/drivers/gpu/drm/bridge/analogix-anx78xx.c +@@ -725,7 +725,9 @@ static int anx78xx_init_pdata(struct anx78xx *anx78xx) + /* 1.0V digital core power regulator */ + pdata->dvdd10 = devm_regulator_get(dev, "dvdd10"); + if (IS_ERR(pdata->dvdd10)) { +- DRM_ERROR("DVDD10 regulator not found\n"); ++ if (PTR_ERR(pdata->dvdd10) != -EPROBE_DEFER) ++ DRM_ERROR("DVDD10 regulator not found\n"); ++ + return PTR_ERR(pdata->dvdd10); + } + +@@ -1344,7 +1346,9 @@ static int anx78xx_i2c_probe(struct i2c_client *client, + + err = anx78xx_init_pdata(anx78xx); + if (err) { +- DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ if (err != -EPROBE_DEFER) ++ DRM_ERROR("Failed to initialize pdata: %d\n", err); ++ + return err; + } + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 4db31b89507c..cc1094f90125 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -39,6 +39,7 @@ + + #include <media/cec-notifier.h> + ++#define DDC_CI_ADDR 0x37 + #define DDC_SEGMENT_ADDR 0x30 + + #define HDMI_EDID_LEN 512 +@@ -320,6 +321,15 @@ static int dw_hdmi_i2c_xfer(struct i2c_adapter *adap, + u8 addr = msgs[0].addr; + int i, ret = 0; + ++ if (addr == DDC_CI_ADDR) ++ /* ++ * The internal I2C controller does not support the multi-byte ++ * read and write operations needed for DDC/CI. ++ * TOFIX: Blacklist the DDC/CI address until we filter out ++ * unsupported I2C operations. ++ */ ++ return -EOPNOTSUPP; ++ + dev_dbg(hdmi->dev, "xfer: num: %d, addr: %#x\n", num, addr); + + for (i = 0; i < num; i++) { +@@ -1733,7 +1743,7 @@ static int dw_hdmi_setup(struct dw_hdmi *hdmi, struct drm_display_mode *mode) + + /* HDMI Initialization Step E - Configure audio */ + hdmi_clk_regenerator_update_pixel_clock(hdmi); +- hdmi_enable_audio_clk(hdmi, true); ++ hdmi_enable_audio_clk(hdmi, hdmi->audio_enable); + } + + /* not for DVI mode */ +diff --git a/drivers/gpu/drm/gma500/oaktrail_crtc.c b/drivers/gpu/drm/gma500/oaktrail_crtc.c +index 0fff269d3fe6..42785f3df60f 100644 +--- a/drivers/gpu/drm/gma500/oaktrail_crtc.c ++++ b/drivers/gpu/drm/gma500/oaktrail_crtc.c +@@ -139,6 +139,7 @@ static bool mrst_sdvo_find_best_pll(const struct gma_limit_t *limit, + s32 freq_error, min_error = 100000; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.n = limit->n.min; clock.n <= limit->n.max; +@@ -195,6 +196,7 @@ static bool mrst_lvds_find_best_pll(const struct gma_limit_t *limit, + int err = target; + + memset(best_clock, 0, sizeof(*best_clock)); ++ memset(&clock, 0, sizeof(clock)); + + for (clock.m = limit->m.min; clock.m <= limit->m.max; clock.m++) { + for (clock.p1 = limit->p1.min; clock.p1 <= limit->p1.max; +diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c +index acd99783bbca..67f3c050c4cf 100644 +--- a/drivers/gpu/host1x/job.c ++++ b/drivers/gpu/host1x/job.c +@@ -545,7 +545,8 @@ out: + return err; + } + +-static inline int copy_gathers(struct host1x_job *job, struct device *dev) ++static inline int copy_gathers(struct device *host, struct host1x_job *job, ++ struct device *dev) + { + struct host1x_firewall fw; + size_t size = 0; +@@ -570,12 +571,12 @@ static inline int copy_gathers(struct host1x_job *job, struct device *dev) + * Try a non-blocking allocation from a higher priority pools first, + * as awaiting for the allocation here is a major performance hit. + */ +- job->gather_copy_mapped = dma_alloc_wc(dev, size, &job->gather_copy, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, &job->gather_copy, + GFP_NOWAIT); + + /* the higher priority allocation failed, try the generic-blocking */ + if (!job->gather_copy_mapped) +- job->gather_copy_mapped = dma_alloc_wc(dev, size, ++ job->gather_copy_mapped = dma_alloc_wc(host, size, + &job->gather_copy, + GFP_KERNEL); + if (!job->gather_copy_mapped) +@@ -636,7 +637,7 @@ int host1x_job_pin(struct host1x_job *job, struct device *dev) + goto out; + + if (IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL)) { +- err = copy_gathers(job, dev); ++ err = copy_gathers(host->dev, job, dev); + if (err) + goto out; + } +@@ -701,7 +702,7 @@ void host1x_job_unpin(struct host1x_job *job) + job->num_unpins = 0; + + if (job->gather_copy_size) +- dma_free_wc(job->channel->dev, job->gather_copy_size, ++ dma_free_wc(host->dev, job->gather_copy_size, + job->gather_copy_mapped, job->gather_copy); + } + EXPORT_SYMBOL(host1x_job_unpin); +diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c +index c224b92a80f1..fc371444407d 100644 +--- a/drivers/hwtracing/intel_th/pci.c ++++ b/drivers/hwtracing/intel_th/pci.c +@@ -188,6 +188,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x06a6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Comet Lake PCH-V */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa3a6), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { + /* Ice Lake NNPI */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x45c5), +@@ -213,6 +218,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4da6), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, ++ { ++ /* Elkhart Lake */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26), ++ .driver_data = (kernel_ulong_t)&intel_th_2x, ++ }, + { 0 }, + }; + +diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c +index ab8d6aed5085..2a299bbd6acf 100644 +--- a/drivers/iio/adc/dln2-adc.c ++++ b/drivers/iio/adc/dln2-adc.c +@@ -528,6 +528,10 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + u16 conflict; + unsigned int trigger_chan; + ++ ret = iio_triggered_buffer_postenable(indio_dev); ++ if (ret) ++ return ret; ++ + mutex_lock(&dln2->mutex); + + /* Enable ADC */ +@@ -541,6 +545,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + (int)conflict); + ret = -EBUSY; + } ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + +@@ -554,6 +559,7 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + if (ret < 0) { + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); ++ iio_triggered_buffer_predisable(indio_dev); + return ret; + } + } else { +@@ -561,12 +567,12 @@ static int dln2_adc_triggered_buffer_postenable(struct iio_dev *indio_dev) + mutex_unlock(&dln2->mutex); + } + +- return iio_triggered_buffer_postenable(indio_dev); ++ return 0; + } + + static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + { +- int ret; ++ int ret, ret2; + struct dln2_adc *dln2 = iio_priv(indio_dev); + + mutex_lock(&dln2->mutex); +@@ -581,12 +587,14 @@ static int dln2_adc_triggered_buffer_predisable(struct iio_dev *indio_dev) + ret = dln2_adc_set_port_enabled(dln2, false, NULL); + + mutex_unlock(&dln2->mutex); +- if (ret < 0) { ++ if (ret < 0) + dev_dbg(&dln2->pdev->dev, "Problem in %s\n", __func__); +- return ret; +- } + +- return iio_triggered_buffer_predisable(indio_dev); ++ ret2 = iio_triggered_buffer_predisable(indio_dev); ++ if (ret == 0) ++ ret = ret2; ++ ++ return ret; + } + + static const struct iio_buffer_setup_ops dln2_adc_buffer_setup_ops = { +diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c +index ebc715927e63..03af02769370 100644 +--- a/drivers/iio/adc/max1027.c ++++ b/drivers/iio/adc/max1027.c +@@ -462,6 +462,14 @@ static int max1027_probe(struct spi_device *spi) + goto fail_dev_register; + } + ++ /* Internal reset */ ++ st->reg = MAX1027_RST_REG; ++ ret = spi_write(st->spi, &st->reg, 1); ++ if (ret < 0) { ++ dev_err(&indio_dev->dev, "Failed to reset the ADC\n"); ++ return ret; ++ } ++ + /* Disable averaging */ + st->reg = MAX1027_AVG_REG; + ret = spi_write(st->spi, &st->reg, 1); +diff --git a/drivers/iio/light/bh1750.c b/drivers/iio/light/bh1750.c +index 6c61187e630f..0b7ba02c8d16 100644 +--- a/drivers/iio/light/bh1750.c ++++ b/drivers/iio/light/bh1750.c +@@ -62,9 +62,9 @@ struct bh1750_chip_info { + + u16 int_time_low_mask; + u16 int_time_high_mask; +-} ++}; + +-static const bh1750_chip_info_tbl[] = { ++static const struct bh1750_chip_info bh1750_chip_info_tbl[] = { + [BH1710] = { 140, 1022, 300, 400, 250000000, 2, 0x001F, 0x03E0 }, + [BH1721] = { 140, 1020, 300, 400, 250000000, 2, 0x0010, 0x03E0 }, + [BH1750] = { 31, 254, 69, 1740, 57500000, 1, 0x001F, 0x00E0 }, +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 7f4cc9336442..656e7c1a4449 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1343,6 +1343,14 @@ static void qedr_cleanup_user(struct qedr_dev *dev, struct qedr_qp *qp) + if (qp->urq.umem) + ib_umem_release(qp->urq.umem); + qp->urq.umem = NULL; ++ ++ if (rdma_protocol_roce(&dev->ibdev, 1)) { ++ qedr_free_pbl(dev, &qp->usq.pbl_info, qp->usq.pbl_tbl); ++ qedr_free_pbl(dev, &qp->urq.pbl_info, qp->urq.pbl_tbl); ++ } else { ++ kfree(qp->usq.pbl_tbl); ++ kfree(qp->urq.pbl_tbl); ++ } + } + + static int qedr_create_user_qp(struct qedr_dev *dev, +@@ -2331,8 +2339,8 @@ int qedr_dereg_mr(struct ib_mr *ib_mr) + + dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid); + +- if ((mr->type != QEDR_MR_DMA) && (mr->type != QEDR_MR_FRMR)) +- qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table); ++ if (mr->type != QEDR_MR_DMA) ++ free_mr_info(dev, &mr->info); + + /* it could be user registered memory. */ + if (mr->umem) +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 19624e023ebd..b5a789567b4e 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -648,6 +648,7 @@ iscsi_iser_session_create(struct iscsi_endpoint *ep, + if (ib_conn->pi_support) { + u32 sig_caps = ib_conn->device->ib_device->attrs.sig_prot_cap; + ++ shost->sg_prot_tablesize = shost->sg_tablesize; + scsi_host_set_prot(shost, iser_dif_prot_caps(sig_caps)); + scsi_host_set_guard(shost, SHOST_DIX_GUARD_IP | + SHOST_DIX_GUARD_CRC); +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index ce23f436e130..44b0584eb8a6 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -419,10 +419,14 @@ static struct sensor_register ov2659_720p[] = { + { REG_TIMING_YINC, 0x11 }, + { REG_TIMING_VERT_FORMAT, 0x80 }, + { REG_TIMING_HORIZ_FORMAT, 0x00 }, ++ { 0x370a, 0x12 }, + { 0x3a03, 0xe8 }, + { 0x3a09, 0x6f }, + { 0x3a0b, 0x5d }, + { 0x3a15, 0x9a }, ++ { REG_VFIFO_READ_START_H, 0x00 }, ++ { REG_VFIFO_READ_START_L, 0x80 }, ++ { REG_ISP_CTRL02, 0x00 }, + { REG_NULL, 0x00 }, + }; + +@@ -1203,11 +1207,15 @@ static int ov2659_s_stream(struct v4l2_subdev *sd, int on) + goto unlock; + } + +- ov2659_set_pixel_clock(ov2659); +- ov2659_set_frame_size(ov2659); +- ov2659_set_format(ov2659); +- ov2659_set_streaming(ov2659, 1); +- ov2659->streaming = on; ++ ret = ov2659_set_pixel_clock(ov2659); ++ if (!ret) ++ ret = ov2659_set_frame_size(ov2659); ++ if (!ret) ++ ret = ov2659_set_format(ov2659); ++ if (!ret) { ++ ov2659_set_streaming(ov2659, 1); ++ ov2659->streaming = on; ++ } + + unlock: + mutex_unlock(&ov2659->lock); +diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c +index 025869eec2ac..348296be4925 100644 +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -469,38 +469,39 @@ static int ov6650_set_selection(struct v4l2_subdev *sd, + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov6650 *priv = to_ov6650(client); +- struct v4l2_rect rect = sel->r; + int ret; + + if (sel->which != V4L2_SUBDEV_FORMAT_ACTIVE || + sel->target != V4L2_SEL_TGT_CROP) + return -EINVAL; + +- v4l_bound_align_image(&rect.width, 2, W_CIF, 1, +- &rect.height, 2, H_CIF, 1, 0); +- v4l_bound_align_image(&rect.left, DEF_HSTRT << 1, +- (DEF_HSTRT << 1) + W_CIF - (__s32)rect.width, 1, +- &rect.top, DEF_VSTRT << 1, +- (DEF_VSTRT << 1) + H_CIF - (__s32)rect.height, 1, +- 0); ++ v4l_bound_align_image(&sel->r.width, 2, W_CIF, 1, ++ &sel->r.height, 2, H_CIF, 1, 0); ++ v4l_bound_align_image(&sel->r.left, DEF_HSTRT << 1, ++ (DEF_HSTRT << 1) + W_CIF - (__s32)sel->r.width, 1, ++ &sel->r.top, DEF_VSTRT << 1, ++ (DEF_VSTRT << 1) + H_CIF - (__s32)sel->r.height, ++ 1, 0); + +- ret = ov6650_reg_write(client, REG_HSTRT, rect.left >> 1); ++ ret = ov6650_reg_write(client, REG_HSTRT, sel->r.left >> 1); + if (!ret) { +- priv->rect.left = rect.left; ++ priv->rect.width += priv->rect.left - sel->r.left; ++ priv->rect.left = sel->r.left; + ret = ov6650_reg_write(client, REG_HSTOP, +- (rect.left + rect.width) >> 1); ++ (sel->r.left + sel->r.width) >> 1); + } + if (!ret) { +- priv->rect.width = rect.width; +- ret = ov6650_reg_write(client, REG_VSTRT, rect.top >> 1); ++ priv->rect.width = sel->r.width; ++ ret = ov6650_reg_write(client, REG_VSTRT, sel->r.top >> 1); + } + if (!ret) { +- priv->rect.top = rect.top; ++ priv->rect.height += priv->rect.top - sel->r.top; ++ priv->rect.top = sel->r.top; + ret = ov6650_reg_write(client, REG_VSTOP, +- (rect.top + rect.height) >> 1); ++ (sel->r.top + sel->r.height) >> 1); + } + if (!ret) +- priv->rect.height = rect.height; ++ priv->rect.height = sel->r.height; + + return ret; + } +@@ -614,7 +615,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); + return -EINVAL; + } +- priv->code = code; + + if (code == MEDIA_BUS_FMT_Y8_1X8 || + code == MEDIA_BUS_FMT_SBGGR8_1X8) { +@@ -640,7 +640,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + dev_dbg(&client->dev, "max resolution: CIF\n"); + coma_mask |= COMA_QCIF; + } +- priv->half_scale = half_scale; + + clkrc = CLKRC_12MHz; + mclk = 12000000; +@@ -658,8 +657,13 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf) + ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); + if (!ret) + ret = ov6650_reg_write(client, REG_CLKRC, clkrc); +- if (!ret) ++ if (!ret) { ++ priv->half_scale = half_scale; ++ + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); ++ } ++ if (!ret) ++ priv->code = code; + + if (!ret) { + mf->colorspace = priv->colorspace; +diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c +index 7d25ecd4404b..1748812bd7e5 100644 +--- a/drivers/media/pci/cx88/cx88-video.c ++++ b/drivers/media/pci/cx88/cx88-video.c +@@ -1310,7 +1310,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + core = cx88_core_get(dev->pci); + if (!core) { + err = -EINVAL; +- goto fail_free; ++ goto fail_disable; + } + dev->core = core; + +@@ -1356,7 +1356,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->audio_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + } +@@ -1370,7 +1370,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + cc->step, cc->default_value); + if (!vc) { + err = core->video_hdl.error; +- goto fail_core; ++ goto fail_irq; + } + vc->priv = (void *)cc; + if (vc->id == V4L2_CID_CHROMA_AGC) +@@ -1533,11 +1533,14 @@ static int cx8800_initdev(struct pci_dev *pci_dev, + + fail_unreg: + cx8800_unregister_video(dev); +- free_irq(pci_dev->irq, dev); + mutex_unlock(&core->lock); ++fail_irq: ++ free_irq(pci_dev->irq, dev); + fail_core: + core->v4ldev = NULL; + cx88_core_put(core, dev->pci); ++fail_disable: ++ pci_disable_device(pci_dev); + fail_free: + kfree(dev); + return err; +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index dfcc484cab89..e92c5b56be42 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1848,6 +1848,10 @@ static int vpfe_s_std(struct file *file, void *priv, v4l2_std_id std_id) + if (!(sdinfo->inputs[0].capabilities & V4L2_IN_CAP_STD)) + return -ENODATA; + ++ /* if trying to set the same std then nothing to do */ ++ if (vpfe_standards[vpfe->std_index].std_id == std_id) ++ return 0; ++ + /* If streaming is started, return error */ + if (vb2_is_busy(&vpfe->buffer_queue)) { + vpfe_err(vpfe, "%s device busy\n", __func__); +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index 769e9e68562d..9360b36b82cd 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -345,10 +345,11 @@ static const struct venus_resources msm8916_res = { + }; + + static const struct freq_tbl msm8996_freq_table[] = { +- { 1944000, 490000000 }, /* 4k UHD @ 60 */ +- { 972000, 320000000 }, /* 4k UHD @ 30 */ +- { 489600, 150000000 }, /* 1080p @ 60 */ +- { 244800, 75000000 }, /* 1080p @ 30 */ ++ { 1944000, 520000000 }, /* 4k UHD @ 60 (decode only) */ ++ { 972000, 520000000 }, /* 4k UHD @ 30 */ ++ { 489600, 346666667 }, /* 1080p @ 60 */ ++ { 244800, 150000000 }, /* 1080p @ 30 */ ++ { 108000, 75000000 }, /* 720p @ 30 */ + }; + + static const struct reg_val msm8996_reg_preset[] = { +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 522364ff0d5d..3871ed6a1fcb 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -915,6 +915,7 @@ static int rcar_drif_g_fmt_sdr_cap(struct file *file, void *priv, + { + struct rcar_drif_sdr *sdr = video_drvdata(file); + ++ memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved)); + f->fmt.sdr.pixelformat = sdr->fmt->pixelformat; + f->fmt.sdr.buffersize = sdr->fmt->buffersize; + +diff --git a/drivers/media/platform/ti-vpe/vpdma.h b/drivers/media/platform/ti-vpe/vpdma.h +index 7e611501c291..f29074c84915 100644 +--- a/drivers/media/platform/ti-vpe/vpdma.h ++++ b/drivers/media/platform/ti-vpe/vpdma.h +@@ -60,6 +60,7 @@ struct vpdma_data_format { + * line stride of source and dest + * buffers should be 16 byte aligned + */ ++#define VPDMA_MAX_STRIDE 65520 /* Max line stride 16 byte aligned */ + #define VPDMA_DTD_DESC_SIZE 32 /* 8 words */ + #define VPDMA_CFD_CTD_DESC_SIZE 16 /* 4 words */ + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index 45bd10544189..2e8970c7e22d 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -352,20 +352,25 @@ enum { + }; + + /* find our format description corresponding to the passed v4l2_format */ +-static struct vpe_fmt *find_format(struct v4l2_format *f) ++static struct vpe_fmt *__find_format(u32 fourcc) + { + struct vpe_fmt *fmt; + unsigned int k; + + for (k = 0; k < ARRAY_SIZE(vpe_formats); k++) { + fmt = &vpe_formats[k]; +- if (fmt->fourcc == f->fmt.pix.pixelformat) ++ if (fmt->fourcc == fourcc) + return fmt; + } + + return NULL; + } + ++static struct vpe_fmt *find_format(struct v4l2_format *f) ++{ ++ return __find_format(f->fmt.pix.pixelformat); ++} ++ + /* + * there is one vpe_dev structure in the driver, it is shared by + * all instances. +@@ -1044,11 +1049,14 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_OUT) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; + q_data = &ctx->q_data[Q_DATA_SRC]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1075,6 +1083,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + } + + if (q_data->flags & Q_DATA_FRAME_1D) +@@ -1086,7 +1095,7 @@ static void add_out_dtd(struct vpe_ctx *ctx, int port) + MAX_W, MAX_H); + + vpdma_add_out_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, ++ stride, &q_data->c_rect, + vpdma_fmt, dma_addr, MAX_OUT_WIDTH_REG1, + MAX_OUT_HEIGHT_REG1, p_data->channel, flags); + } +@@ -1105,10 +1114,13 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + dma_addr_t dma_addr; + u32 flags = 0; + u32 offset = 0; ++ u32 stride; + + if (port == VPE_PORT_MV_IN) { + vpdma_fmt = &vpdma_misc_fmts[VPDMA_DATA_FMT_MV]; + dma_addr = ctx->mv_buf_dma[mv_buf_selector]; ++ stride = ALIGN((q_data->width * vpdma_fmt->depth) >> 3, ++ VPDMA_STRIDE_ALIGN); + } else { + /* to incorporate interleaved formats */ + int plane = fmt->coplanar ? p_data->vb_part : 0; +@@ -1135,6 +1147,7 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + } + /* Apply the offset */ + dma_addr += offset; ++ stride = q_data->bytesperline[VPE_LUMA]; + + if (q_data->flags & Q_DATA_INTERLACED_SEQ_TB) { + /* +@@ -1170,10 +1183,10 @@ static void add_in_dtd(struct vpe_ctx *ctx, int port) + if (p_data->vb_part && fmt->fourcc == V4L2_PIX_FMT_NV12) + frame_height /= 2; + +- vpdma_add_in_dtd(&ctx->desc_list, q_data->width, +- q_data->bytesperline[VPE_LUMA], &q_data->c_rect, +- vpdma_fmt, dma_addr, p_data->channel, field, flags, frame_width, +- frame_height, 0, 0); ++ vpdma_add_in_dtd(&ctx->desc_list, q_data->width, stride, ++ &q_data->c_rect, vpdma_fmt, dma_addr, ++ p_data->channel, field, flags, frame_width, ++ frame_height, 0, 0); + } + + /* +@@ -1422,9 +1435,6 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + /* the previous dst mv buffer becomes the next src mv buffer */ + ctx->src_mv_buf_selector = !ctx->src_mv_buf_selector; + +- if (ctx->aborting) +- goto finished; +- + s_vb = ctx->src_vbs[0]; + d_vb = ctx->dst_vb; + +@@ -1435,6 +1445,7 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + d_vb->timecode = s_vb->timecode; + + d_vb->sequence = ctx->sequence; ++ s_vb->sequence = ctx->sequence; + + d_q_data = &ctx->q_data[Q_DATA_DST]; + if (d_q_data->flags & Q_IS_INTERLACED) { +@@ -1488,6 +1499,9 @@ static irqreturn_t vpe_irq(int irq_vpe, void *data) + ctx->src_vbs[0] = NULL; + ctx->dst_vb = NULL; + ++ if (ctx->aborting) ++ goto finished; ++ + ctx->bufs_completed++; + if (ctx->bufs_completed < ctx->bufs_per_job && job_ready(ctx)) { + device_run(ctx); +@@ -1600,9 +1614,9 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + unsigned int stride = 0; + + if (!fmt || !(fmt->types & type)) { +- vpe_err(ctx->dev, "Fourcc format (0x%08x) invalid.\n", ++ vpe_dbg(ctx->dev, "Fourcc format (0x%08x) invalid.\n", + pix->pixelformat); +- return -EINVAL; ++ fmt = __find_format(V4L2_PIX_FMT_YUYV); + } + + if (pix->field != V4L2_FIELD_NONE && pix->field != V4L2_FIELD_ALTERNATE +@@ -1649,7 +1663,7 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + &pix->height, MIN_H, MAX_H, H_ALIGN, + S_ALIGN); + +- if (!pix->num_planes) ++ if (!pix->num_planes || pix->num_planes > 2) + pix->num_planes = fmt->coplanar ? 2 : 1; + else if (pix->num_planes > 1 && !fmt->coplanar) + pix->num_planes = 1; +@@ -1688,6 +1702,10 @@ static int __vpe_try_fmt(struct vpe_ctx *ctx, struct v4l2_format *f, + if (stride > plane_fmt->bytesperline) + plane_fmt->bytesperline = stride; + ++ plane_fmt->bytesperline = clamp_t(u32, plane_fmt->bytesperline, ++ stride, ++ VPDMA_MAX_STRIDE); ++ + plane_fmt->bytesperline = ALIGN(plane_fmt->bytesperline, + VPDMA_STRIDE_ALIGN); + +@@ -2308,7 +2326,7 @@ static int vpe_open(struct file *file) + v4l2_ctrl_handler_setup(hdl); + + s_q_data = &ctx->q_data[Q_DATA_SRC]; +- s_q_data->fmt = &vpe_formats[2]; ++ s_q_data->fmt = __find_format(V4L2_PIX_FMT_YUYV); + s_q_data->width = 1920; + s_q_data->height = 1080; + s_q_data->nplanes = 1; +@@ -2386,6 +2404,12 @@ static int vpe_release(struct file *file) + + mutex_lock(&dev->dev_mutex); + free_mv_buffers(ctx); ++ ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->desc_list.buf); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->mmr_adb); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_h); ++ vpdma_unmap_desc_buf(dev->vpdma, &ctx->sc_coeff_v); ++ + vpdma_free_desc_list(&ctx->desc_list); + vpdma_free_desc_buf(&ctx->mmr_adb); + +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index 8ce6f9cff746..b60fb6ed5aeb 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -455,6 +455,8 @@ static int si470x_i2c_remove(struct i2c_client *client) + video_unregister_device(&radio->videodev); + kfree(radio); + ++ v4l2_ctrl_handler_free(&radio->hdl); ++ v4l2_device_unregister(&radio->v4l2_dev); + return 0; + } + +diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c +index ac4fddfd0a43..f1807c16438d 100644 +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -503,7 +503,13 @@ urb_error: + static int flexcop_usb_init(struct flexcop_usb *fc_usb) + { + /* use the alternate setting with the larges buffer */ +- usb_set_interface(fc_usb->udev,0,1); ++ int ret = usb_set_interface(fc_usb->udev, 0, 1); ++ ++ if (ret) { ++ err("set interface failed."); ++ return ret; ++ } ++ + switch (fc_usb->udev->speed) { + case USB_SPEED_LOW: + err("cannot handle USB speed because it is too slow."); +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +index 4320bda9352d..e0413db26781 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +@@ -915,8 +915,12 @@ static void pvr2_v4l2_internal_check(struct pvr2_channel *chp) + pvr2_v4l2_dev_disassociate_parent(vp->dev_video); + pvr2_v4l2_dev_disassociate_parent(vp->dev_radio); + if (!list_empty(&vp->dev_video->devbase.fh_list) || +- !list_empty(&vp->dev_radio->devbase.fh_list)) ++ (vp->dev_radio && ++ !list_empty(&vp->dev_radio->devbase.fh_list))) { ++ pvr2_trace(PVR2_TRACE_STRUCT, ++ "pvr2_v4l2 internal_check exit-empty id=%p", vp); + return; ++ } + pvr2_v4l2_destroy_no_lock(vp); + } + +@@ -990,7 +994,8 @@ static int pvr2_v4l2_release(struct file *file) + kfree(fhp); + if (vp->channel.mc_head->disconnect_flag && + list_empty(&vp->dev_video->devbase.fh_list) && +- list_empty(&vp->dev_radio->devbase.fh_list)) { ++ (!vp->dev_radio || ++ list_empty(&vp->dev_radio->devbase.fh_list))) { + pvr2_v4l2_destroy_no_lock(vp); + } + return 0; +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index 681eef972e63..7cafc8a57950 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -1363,10 +1363,26 @@ static int v4l_enum_fmt(const struct v4l2_ioctl_ops *ops, + return ret; + } + ++static void v4l_pix_format_touch(struct v4l2_pix_format *p) ++{ ++ /* ++ * The v4l2_pix_format structure contains fields that make no sense for ++ * touch. Set them to default values in this case. ++ */ ++ ++ p->field = V4L2_FIELD_NONE; ++ p->colorspace = V4L2_COLORSPACE_RAW; ++ p->flags = 0; ++ p->ycbcr_enc = 0; ++ p->quantization = 0; ++ p->xfer_func = 0; ++} ++ + static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { + struct v4l2_format *p = arg; ++ struct video_device *vfd = video_devdata(file); + int ret = check_fmt(file, p->type); + + if (ret) +@@ -1404,6 +1420,8 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + ret = ops->vidioc_g_fmt_vid_cap(file, fh, arg); + /* just in case the driver zeroed it again */ + p->fmt.pix.priv = V4L2_PIX_FMT_PRIV_MAGIC; ++ if (vfd->vfl_type == VFL_TYPE_TOUCH) ++ v4l_pix_format_touch(&p->fmt.pix); + return ret; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: + return ops->vidioc_g_fmt_vid_cap_mplane(file, fh, arg); +@@ -1439,21 +1457,6 @@ static int v4l_g_fmt(const struct v4l2_ioctl_ops *ops, + return -EINVAL; + } + +-static void v4l_pix_format_touch(struct v4l2_pix_format *p) +-{ +- /* +- * The v4l2_pix_format structure contains fields that make no sense for +- * touch. Set them to default values in this case. +- */ +- +- p->field = V4L2_FIELD_NONE; +- p->colorspace = V4L2_COLORSPACE_RAW; +- p->flags = 0; +- p->ycbcr_enc = 0; +- p->quantization = 0; +- p->xfer_func = 0; +-} +- + static int v4l_s_fmt(const struct v4l2_ioctl_ops *ops, + struct file *file, void *fh, void *arg) + { +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index a2ac9938d945..1a5d5c40324b 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -212,6 +212,8 @@ + #define MSDC_PATCH_BIT_SPCPUSH (0x1 << 29) /* RW */ + #define MSDC_PATCH_BIT_DECRCTMO (0x1 << 30) /* RW */ + ++#define MSDC_PATCH_BIT1_CMDTA (0x7 << 3) /* RW */ ++ + #define MSDC_PAD_TUNE_DATWRDLY (0x1f << 0) /* RW */ + #define MSDC_PAD_TUNE_DATRRDLY (0x1f << 8) /* RW */ + #define MSDC_PAD_TUNE_CMDRDLY (0x1f << 16) /* RW */ +@@ -1442,6 +1444,7 @@ static int hs400_tune_response(struct mmc_host *mmc, u32 opcode) + + /* select EMMC50 PAD CMD tune */ + sdr_set_bits(host->base + PAD_CMD_TUNE, BIT(0)); ++ sdr_set_field(host->base + MSDC_PATCH_BIT1, MSDC_PATCH_BIT1_CMDTA, 2); + + if (mmc->ios.timing == MMC_TIMING_MMC_HS200 || + mmc->ios.timing == MMC_TIMING_UHS_SDR104) +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 176cbc67d08a..9a1ab39ee35e 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -615,9 +615,6 @@ static void esdhc_reset(struct sdhci_host *host, u8 mask) + sdhci_writel(host, host->ier, SDHCI_INT_ENABLE); + sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE); + +- if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) +- mdelay(5); +- + if (mask & SDHCI_RESET_ALL) { + val = sdhci_readl(host, ESDHC_TBCTL); + val &= ~ESDHC_TB_EN; +@@ -889,8 +886,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) + host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; + + if (of_find_compatible_node(NULL, NULL, "fsl,p2020-esdhc")) { +- host->quirks2 |= SDHCI_QUIRK_RESET_AFTER_REQUEST; +- host->quirks2 |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; ++ host->quirks |= SDHCI_QUIRK_RESET_AFTER_REQUEST; ++ host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL; + } + + if (of_device_is_compatible(np, "fsl,p5040-esdhc") || +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 5807028c8309..645775dd4edb 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1635,9 +1635,7 @@ void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing) + ctrl_2 |= SDHCI_CTRL_UHS_SDR104; + else if (timing == MMC_TIMING_UHS_SDR12) + ctrl_2 |= SDHCI_CTRL_UHS_SDR12; +- else if (timing == MMC_TIMING_SD_HS || +- timing == MMC_TIMING_MMC_HS || +- timing == MMC_TIMING_UHS_SDR25) ++ else if (timing == MMC_TIMING_UHS_SDR25) + ctrl_2 |= SDHCI_CTRL_UHS_SDR25; + else if (timing == MMC_TIMING_UHS_SDR50) + ctrl_2 |= SDHCI_CTRL_UHS_SDR50; +@@ -2164,8 +2162,8 @@ static void __sdhci_execute_tuning(struct sdhci_host *host, u32 opcode) + sdhci_send_tuning(host, opcode); + + if (!host->tuning_done) { +- pr_info("%s: Tuning timeout, falling back to fixed sampling clock\n", +- mmc_hostname(host->mmc)); ++ pr_debug("%s: Tuning timeout, falling back to fixed sampling clock\n", ++ mmc_hostname(host->mmc)); + sdhci_abort_tuning(host, opcode); + return; + } +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 2fd862dc9770..a09aad9155a5 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -1220,7 +1220,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host, + _host->start_signal_voltage_switch; + mmc->ops = &tmio_mmc_ops; + +- mmc->caps |= MMC_CAP_4_BIT_DATA | pdata->capabilities; ++ mmc->caps |= MMC_CAP_ERASE | MMC_CAP_4_BIT_DATA | pdata->capabilities; + mmc->caps2 |= pdata->capabilities2; + mmc->max_segs = pdata->max_segs ? : 32; + mmc->max_blk_size = 512; +diff --git a/drivers/net/dsa/Kconfig b/drivers/net/dsa/Kconfig +index 83a9bc892a3b..6ae13f2419e3 100644 +--- a/drivers/net/dsa/Kconfig ++++ b/drivers/net/dsa/Kconfig +@@ -55,6 +55,7 @@ config NET_DSA_QCA8K + config NET_DSA_SMSC_LAN9303 + tristate + select NET_DSA_TAG_LAN9303 ++ select REGMAP + ---help--- + This enables support for the SMSC/Microchip LAN9303 3 port ethernet + switch chips. +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 9ca994d0bab6..1977e0c552df 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -2389,15 +2389,21 @@ static int bnx2x_set_pf_tx_switching(struct bnx2x *bp, bool enable) + /* send the ramrod on all the queues of the PF */ + for_each_eth_queue(bp, i) { + struct bnx2x_fastpath *fp = &bp->fp[i]; ++ int tx_idx; + + /* Set the appropriate Queue object */ + q_params.q_obj = &bnx2x_sp_obj(bp, fp).q_obj; + +- /* Update the Queue state */ +- rc = bnx2x_queue_state_change(bp, &q_params); +- if (rc) { +- BNX2X_ERR("Failed to configure Tx switching\n"); +- return rc; ++ for (tx_idx = FIRST_TX_COS_INDEX; ++ tx_idx < fp->max_cos; tx_idx++) { ++ q_params.params.update.cid_index = tx_idx; ++ ++ /* Update the Queue state */ ++ rc = bnx2x_queue_state_change(bp, &q_params); ++ if (rc) { ++ BNX2X_ERR("Failed to configure Tx switching\n"); ++ return rc; ++ } + } + } + +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index 84c0f22ac2db..d5489cb0afff 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -456,9 +456,9 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + skb_tx_timestamp(skb); + + hip04_set_xmit_desc(priv, phys); +- priv->tx_head = TX_NEXT(tx_head); + count++; + netdev_sent_queue(ndev, skb->len); ++ priv->tx_head = TX_NEXT(tx_head); + + stats->tx_bytes += skb->len; + stats->tx_packets++; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 4801d96c4fa9..0edfd199937d 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8379,7 +8379,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) && + adapter->ptp_clock) { +- if (!test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, ++ if (adapter->tstamp_config.tx_type == HWTSTAMP_TX_ON && ++ !test_and_set_bit_lock(__IXGBE_PTP_TX_IN_PROGRESS, + &adapter->state)) { + skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; + tx_flags |= IXGBE_TX_FLAGS_TSTAMP; +diff --git a/drivers/net/ethernet/qlogic/qede/qede_filter.c b/drivers/net/ethernet/qlogic/qede/qede_filter.c +index f79e36e4060a..e7ad95de3da8 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_filter.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_filter.c +@@ -1181,7 +1181,7 @@ qede_configure_mcast_filtering(struct net_device *ndev, + netif_addr_lock_bh(ndev); + + mc_count = netdev_mc_count(ndev); +- if (mc_count < 64) { ++ if (mc_count <= 64) { + netdev_for_each_mc_addr(ha, ndev) { + ether_addr_copy(temp, ha->addr); + temp += ETH_ALEN; +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 5fca9a75780c..cc53ee26bd3e 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -2756,6 +2756,9 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + int err; + + for (i = 0; i < qdev->num_large_buffers; i++) { ++ lrg_buf_cb = &qdev->lrg_buf[i]; ++ memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); ++ + skb = netdev_alloc_skb(qdev->ndev, + qdev->lrg_buffer_len); + if (unlikely(!skb)) { +@@ -2766,11 +2769,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + ql_free_large_buffers(qdev); + return -ENOMEM; + } else { +- +- lrg_buf_cb = &qdev->lrg_buf[i]; +- memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb)); + lrg_buf_cb->index = i; +- lrg_buf_cb->skb = skb; + /* + * We save some space to copy the ethhdr from first + * buffer +@@ -2792,6 +2791,7 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev) + return -ENOMEM; + } + ++ lrg_buf_cb->skb = skb; + dma_unmap_addr_set(lrg_buf_cb, mapaddr, map); + dma_unmap_len_set(lrg_buf_cb, maplen, + qdev->lrg_buffer_len - +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 14d6579b292a..314e3eac09b9 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -181,6 +181,9 @@ static int fjes_acpi_add(struct acpi_device *device) + /* create platform_device */ + plat_dev = platform_device_register_simple(DRV_NAME, 0, fjes_resource, + ARRAY_SIZE(fjes_resource)); ++ if (IS_ERR(plat_dev)) ++ return PTR_ERR(plat_dev); ++ + device->driver_data = plat_dev; + + return 0; +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index e03e91d5f1b1..0cbcced0870e 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -84,6 +84,10 @@ + #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MAX 0x0 + #define DP83867_IO_MUX_CFG_IO_IMPEDANCE_MIN 0x1f + ++/* CFG3 bits */ ++#define DP83867_CFG3_INT_OE BIT(7) ++#define DP83867_CFG3_ROBUST_AUTO_MDIX BIT(9) ++ + /* CFG4 bits */ + #define DP83867_CFG4_PORT_MIRROR_EN BIT(0) + +@@ -320,12 +324,13 @@ static int dp83867_config_init(struct phy_device *phydev) + return ret; + } + ++ val = phy_read(phydev, DP83867_CFG3); + /* Enable Interrupt output INT_OE in CFG3 register */ +- if (phy_interrupt_is_valid(phydev)) { +- val = phy_read(phydev, DP83867_CFG3); +- val |= BIT(7); +- phy_write(phydev, DP83867_CFG3, val); +- } ++ if (phy_interrupt_is_valid(phydev)) ++ val |= DP83867_CFG3_INT_OE; ++ ++ val |= DP83867_CFG3_ROBUST_AUTO_MDIX; ++ phy_write(phydev, DP83867_CFG3, val); + + if (dp83867->port_mirroring != DP83867_PORT_MIRROING_KEEP) + dp83867_config_port_mirroring(phydev); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index ed7e3c70b511..a98c227a4c2e 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -367,8 +367,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id, + mdiodev->device_free = phy_mdio_device_free; + mdiodev->device_remove = phy_mdio_device_remove; + +- dev->speed = 0; +- dev->duplex = -1; ++ dev->speed = SPEED_UNKNOWN; ++ dev->duplex = DUPLEX_UNKNOWN; + dev->pause = 0; + dev->asym_pause = 0; + dev->link = 1; +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 2229284d16f5..7d1d5b30ecc3 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1765,6 +1765,7 @@ static int lan78xx_mdio_init(struct lan78xx_net *dev) + dev->mdiobus->read = lan78xx_mdiobus_read; + dev->mdiobus->write = lan78xx_mdiobus_write; + dev->mdiobus->name = "lan78xx-mdiobus"; ++ dev->mdiobus->parent = &dev->udev->dev; + + snprintf(dev->mdiobus->id, MII_BUS_ID_SIZE, "usb-%03d:%03d", + dev->udev->bus->busnum, dev->udev->devnum); +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index dff34448588f..ea47ad4b2343 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -3627,7 +3627,7 @@ static int ath10k_mac_tx(struct ath10k *ar, + struct ieee80211_vif *vif, + enum ath10k_hw_txrx_mode txmode, + enum ath10k_mac_tx_path txpath, +- struct sk_buff *skb) ++ struct sk_buff *skb, bool noque_offchan) + { + struct ieee80211_hw *hw = ar->hw; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +@@ -3655,10 +3655,10 @@ static int ath10k_mac_tx(struct ath10k *ar, + } + } + +- if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { ++ if (!noque_offchan && info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) { + if (!ath10k_mac_tx_frm_has_freq(ar)) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac queued offchannel skb %pK len %d\n", ++ skb, skb->len); + + skb_queue_tail(&ar->offchan_tx_queue, skb); + ieee80211_queue_work(hw, &ar->offchan_tx_work); +@@ -3720,8 +3720,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + + mutex_lock(&ar->conf_mutex); + +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n", +- skb); ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK len %d\n", ++ skb, skb->len); + + hdr = (struct ieee80211_hdr *)skb->data; + peer_addr = ieee80211_get_DA(hdr); +@@ -3767,7 +3767,7 @@ void ath10k_offchan_tx_work(struct work_struct *work) + txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb); + txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode); + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, true); + if (ret) { + ath10k_warn(ar, "failed to transmit offchannel frame: %d\n", + ret); +@@ -3777,8 +3777,8 @@ void ath10k_offchan_tx_work(struct work_struct *work) + time_left = + wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ); + if (time_left == 0) +- ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n", +- skb); ++ ath10k_warn(ar, "timed out waiting for offchannel skb %pK, len: %d\n", ++ skb, skb->len); + + if (!peer && tmp_peer_created) { + ret = ath10k_peer_delete(ar, vdev_id, peer_addr); +@@ -3957,7 +3957,7 @@ int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (unlikely(ret)) { + ath10k_warn(ar, "failed to push frame: %d\n", ret); + +@@ -4239,7 +4239,7 @@ static void ath10k_mac_op_tx(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->htt.tx_lock); + } + +- ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb); ++ ret = ath10k_mac_tx(ar, vif, txmode, txpath, skb, false); + if (ret) { + ath10k_warn(ar, "failed to transmit frame: %d\n", ret); + if (is_htt) { +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index d4986f626c35..9999c8c40269 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -100,6 +100,8 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + info = IEEE80211_SKB_CB(msdu); + memset(&info->status, 0, sizeof(info->status)); ++ info->status.rates[0].idx = -1; ++ + trace_ath10k_txrx_tx_unref(ar, tx_done->msdu_id); + + if (tx_done->status == HTT_TX_COMPL_STATE_DISCARD) { +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/led.c b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +index 1bbd17ada974..20e16c423990 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/led.c +@@ -185,6 +185,9 @@ void iwl_leds_init(struct iwl_priv *priv) + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/led.c b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +index b27269504a62..072f80c90ce4 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/led.c +@@ -131,6 +131,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm) + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +index c73e4be9bde3..c31303d13069 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +@@ -62,6 +62,7 @@ + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + *****************************************************************************/ ++#include <asm/unaligned.h> + #include <linux/etherdevice.h> + #include <linux/skbuff.h> + #include "iwl-trans.h" +@@ -290,7 +291,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, + rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; + hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); + len = le16_to_cpu(rx_res->byte_count); +- rx_pkt_status = le32_to_cpup((__le32 *) ++ rx_pkt_status = get_unaligned_le32((__le32 *) + (pkt->data + sizeof(*rx_res) + len)); + + /* Dont use dev_alloc_skb(), we'll have enough headroom once +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 39bf85d0ade0..c7f8a29d2606 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1183,6 +1183,10 @@ static int if_sdio_probe(struct sdio_func *func, + + spin_lock_init(&card->lock); + card->workqueue = alloc_workqueue("libertas_sdio", WQ_MEM_RECLAIM, 0); ++ if (unlikely(!card->workqueue)) { ++ ret = -ENOMEM; ++ goto err_queue; ++ } + INIT_WORK(&card->packet_worker, if_sdio_host_to_card_worker); + init_waitqueue_head(&card->pwron_waitq); + +@@ -1234,6 +1238,7 @@ err_activate_card: + lbs_remove_card(priv); + free: + destroy_workqueue(card->workqueue); ++err_queue: + while (card->packets) { + packet = card->packets; + card->packets = card->packets->next; +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 9511f5fe62f4..9d0d790a1319 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -677,8 +677,11 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter) + skb_put(skb, MAX_EVENT_SIZE); + + if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE, +- PCI_DMA_FROMDEVICE)) ++ PCI_DMA_FROMDEVICE)) { ++ kfree_skb(skb); ++ kfree(card->evtbd_ring_vbase); + return -1; ++ } + + buf_pa = MWIFIEX_SKB_DMA_ADDR(skb); + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 95e3993d8a33..a895b6fd6f85 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1349,6 +1349,7 @@ struct rtl8xxxu_fileops { + u8 has_s0s1:1; + u8 has_tx_report:1; + u8 gen2_thermal_meter:1; ++ u8 needs_full_init:1; + u32 adda_1t_init; + u32 adda_1t_path_on; + u32 adda_2t_path_on_a; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +index c4b86a84a721..27e97df996c7 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_8723b.c +@@ -1673,6 +1673,7 @@ struct rtl8xxxu_fileops rtl8723bu_fops = { + .has_s0s1 = 1, + .has_tx_report = 1, + .gen2_thermal_meter = 1, ++ .needs_full_init = 1, + .adda_1t_init = 0x01c00014, + .adda_1t_path_on = 0x01c00014, + .adda_2t_path_on_a = 0x01c00014, +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 91b01ca32e75..b58bf8e2cad2 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -3905,6 +3905,9 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + else + macpower = true; + ++ if (fops->needs_full_init) ++ macpower = false; ++ + ret = fops->power_on(priv); + if (ret < 0) { + dev_warn(dev, "%s: Failed power on\n", __func__); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index 530e80f0ef0b..1ee7f796113b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -1556,6 +1556,8 @@ static bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb) + * This is maybe necessary: + * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb); + */ ++ dev_kfree_skb(skb); ++ + return true; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 2401c8bdb211..93eda23f0123 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1068,8 +1068,10 @@ int rtl_usb_probe(struct usb_interface *intf, + rtlpriv->hw = hw; + rtlpriv->usb_data = kzalloc(RTL_USB_MAX_RX_COUNT * sizeof(u32), + GFP_KERNEL); +- if (!rtlpriv->usb_data) ++ if (!rtlpriv->usb_data) { ++ ieee80211_free_hw(hw); + return -ENOMEM; ++ } + + /* this spin lock must be initialized early */ + spin_lock_init(&rtlpriv->locks.usb_lock); +@@ -1130,6 +1132,7 @@ error_out2: + _rtl_usb_io_handler_release(hw); + usb_put_dev(udev); + complete(&rtlpriv->firmware_loading_complete); ++ kfree(rtlpriv->usb_data); + return -ENODEV; + } + EXPORT_SYMBOL(rtl_usb_probe); +diff --git a/drivers/parport/share.c b/drivers/parport/share.c +index 7b4ee33c1935..15c81cffd2de 100644 +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -230,6 +230,18 @@ static int port_check(struct device *dev, void *dev_drv) + return 0; + } + ++/* ++ * Iterates through all the devices connected to the bus and return 1 ++ * if the device is a parallel port. ++ */ ++ ++static int port_detect(struct device *dev, void *dev_drv) ++{ ++ if (is_parport(dev)) ++ return 1; ++ return 0; ++} ++ + /** + * parport_register_driver - register a parallel port device driver + * @drv: structure describing the driver +@@ -282,6 +294,15 @@ int __parport_register_driver(struct parport_driver *drv, struct module *owner, + if (ret) + return ret; + ++ /* ++ * check if bus has any parallel port registered, if ++ * none is found then load the lowlevel driver. ++ */ ++ ret = bus_for_each_dev(&parport_bus_type, NULL, NULL, ++ port_detect); ++ if (!ret) ++ get_lowlevel_driver(); ++ + mutex_lock(®istration_lock); + if (drv->match_port) + bus_for_each_dev(&parport_bus_type, NULL, drv, +diff --git a/drivers/phy/qualcomm/phy-qcom-usb-hs.c b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +index 2d0c70b5589f..643934a2a70c 100644 +--- a/drivers/phy/qualcomm/phy-qcom-usb-hs.c ++++ b/drivers/phy/qualcomm/phy-qcom-usb-hs.c +@@ -159,8 +159,8 @@ static int qcom_usb_hs_phy_power_on(struct phy *phy) + /* setup initial state */ + qcom_usb_hs_phy_vbus_notifier(&uphy->vbus_notify, state, + uphy->vbus_edev); +- ret = devm_extcon_register_notifier(&ulpi->dev, uphy->vbus_edev, +- EXTCON_USB, &uphy->vbus_notify); ++ ret = extcon_register_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + if (ret) + goto err_ulpi; + } +@@ -181,6 +181,9 @@ static int qcom_usb_hs_phy_power_off(struct phy *phy) + { + struct qcom_usb_hs_phy *uphy = phy_get_drvdata(phy); + ++ if (uphy->vbus_edev) ++ extcon_unregister_notifier(uphy->vbus_edev, EXTCON_USB, ++ &uphy->vbus_notify); + regulator_disable(uphy->v3p3); + regulator_disable(uphy->v1p8); + clk_disable_unprepare(uphy->sleep_clk); +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index c4aa411f5935..3a7c2d6e4d5f 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -40,6 +40,13 @@ struct pinctrl_dt_map { + static void dt_free_map(struct pinctrl_dev *pctldev, + struct pinctrl_map *map, unsigned num_maps) + { ++ int i; ++ ++ for (i = 0; i < num_maps; ++i) { ++ kfree_const(map[i].dev_name); ++ map[i].dev_name = NULL; ++ } ++ + if (pctldev) { + const struct pinctrl_ops *ops = pctldev->desc->pctlops; + if (ops->dt_free_map) +@@ -74,7 +81,13 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Initialize common mapping table entry fields */ + for (i = 0; i < num_maps; i++) { +- map[i].dev_name = dev_name(p->dev); ++ const char *devname; ++ ++ devname = kstrdup_const(dev_name(p->dev), GFP_KERNEL); ++ if (!devname) ++ goto err_free_map; ++ ++ map[i].dev_name = devname; + map[i].name = statename; + if (pctldev) + map[i].ctrl_dev_name = dev_name(pctldev->dev); +@@ -82,10 +95,8 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + + /* Remember the converted mapping table entries */ + dt_map = kzalloc(sizeof(*dt_map), GFP_KERNEL); +- if (!dt_map) { +- dt_free_map(pctldev, map, num_maps); +- return -ENOMEM; +- } ++ if (!dt_map) ++ goto err_free_map; + + dt_map->pctldev = pctldev; + dt_map->map = map; +@@ -93,6 +104,10 @@ static int dt_remember_or_free_map(struct pinctrl *p, const char *statename, + list_add_tail(&dt_map->node, &p->dt_maps); + + return pinctrl_register_map(map, num_maps, false); ++ ++err_free_map: ++ dt_free_map(pctldev, map, num_maps); ++ return -ENOMEM; + } + + struct pinctrl_dev *of_pinctrl_get(struct device_node *np) +diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c +index b78f42abff2f..7385cd81498c 100644 +--- a/drivers/pinctrl/pinctrl-amd.c ++++ b/drivers/pinctrl/pinctrl-amd.c +@@ -509,7 +509,8 @@ static irqreturn_t amd_gpio_irq_handler(int irq, void *dev_id) + irqreturn_t ret = IRQ_NONE; + unsigned int i, irqnr; + unsigned long flags; +- u32 *regs, regval; ++ u32 __iomem *regs; ++ u32 regval; + u64 status, mask; + + /* Read the wake status */ +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 33232041ee86..3eccc9b3ca84 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -1453,7 +1453,7 @@ static const struct pinmux_func pinmux_func_gpios[] = { + GPIO_FN(ET0_ETXD2_A), + GPIO_FN(EX_CS5), GPIO_FN(SD1_CMD_A), GPIO_FN(ATADIR), GPIO_FN(QSSL_B), + GPIO_FN(ET0_ETXD3_A), +- GPIO_FN(RD_WR), GPIO_FN(TCLK1_B), ++ GPIO_FN(RD_WR), GPIO_FN(TCLK0), GPIO_FN(CAN_CLK_B), GPIO_FN(ET0_ETXD4), + GPIO_FN(EX_WAIT0), GPIO_FN(TCLK1_B), + GPIO_FN(EX_WAIT1), GPIO_FN(SD1_DAT0_A), GPIO_FN(DREQ2), + GPIO_FN(CAN1_TX_C), GPIO_FN(ET0_LINK_C), GPIO_FN(ET0_ETXD5_A), +@@ -1949,7 +1949,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + /* IP3_20 [1] */ + FN_EX_WAIT0, FN_TCLK1_B, + /* IP3_19_18 [2] */ +- FN_RD_WR, FN_TCLK1_B, 0, 0, ++ FN_RD_WR, FN_TCLK0, FN_CAN_CLK_B, FN_ET0_ETXD4, + /* IP3_17_15 [3] */ + FN_EX_CS5, FN_SD1_CMD_A, FN_ATADIR, FN_QSSL_B, + FN_ET0_ETXD3_A, 0, 0, 0, +diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c +index d0ffdd5d9199..06a3c1ef8eee 100644 +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -313,7 +313,7 @@ static int __init hp_wmi_bios_2008_later(void) + + static int __init hp_wmi_bios_2009_later(void) + { +- int state = 0; ++ u8 state[128]; + int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, HPWMI_READ, &state, + sizeof(state), sizeof(state)); + if (!ret) +diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c +index 860400d2cd85..a8f2f07239fb 100644 +--- a/drivers/regulator/max8907-regulator.c ++++ b/drivers/regulator/max8907-regulator.c +@@ -299,7 +299,10 @@ static int max8907_regulator_probe(struct platform_device *pdev) + memcpy(pmic->desc, max8907_regulators, sizeof(pmic->desc)); + + /* Backwards compatibility with MAX8907B; SD1 uses different voltages */ +- regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ ret = regmap_read(max8907->regmap_gen, MAX8907_REG_II2RR, &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_II2RR_VERSION_MASK) == + MAX8907_II2RR_VERSION_REV_B) { + pmic->desc[MAX8907_SD1].min_uV = 637500; +@@ -336,14 +339,20 @@ static int max8907_regulator_probe(struct platform_device *pdev) + } + + if (pmic->desc[i].ops == &max8907_ldo_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & MAX8907_MASK_LDO_SEQ) != + MAX8907_MASK_LDO_SEQ) + pmic->desc[i].ops = &max8907_ldo_hwctl_ops; + } else if (pmic->desc[i].ops == &max8907_out5v_ops) { +- regmap_read(config.regmap, pmic->desc[i].enable_reg, ++ ret = regmap_read(config.regmap, pmic->desc[i].enable_reg, + &val); ++ if (ret) ++ return ret; ++ + if ((val & (MAX8907_MASK_OUT5V_VINEN | + MAX8907_MASK_OUT5V_ENSRC)) != + MAX8907_MASK_OUT5V_ENSRC) +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index 7a37090dabbe..2e65b70c7879 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -673,6 +673,8 @@ static int img_spfi_probe(struct platform_device *pdev) + dma_release_channel(spfi->tx_ch); + if (spfi->rx_ch) + dma_release_channel(spfi->rx_ch); ++ spfi->tx_ch = NULL; ++ spfi->rx_ch = NULL; + dev_warn(spfi->dev, "Failed to get DMA channels, falling back to PIO mode\n"); + } else { + master->dma_tx = spfi->tx_ch; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 9bf3e5f945c7..b2245cdce230 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1559,7 +1559,13 @@ pxa2xx_spi_init_pdata(struct platform_device *pdev) + } + + ssp->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(ssp->clk)) ++ return NULL; ++ + ssp->irq = platform_get_irq(pdev, 0); ++ if (ssp->irq < 0) ++ return NULL; ++ + ssp->type = type; + ssp->pdev = pdev; + ssp->port_id = pxa2xx_spi_get_port_id(adev); +diff --git a/drivers/spi/spi-st-ssc4.c b/drivers/spi/spi-st-ssc4.c +index a4e43fc19ece..5df01ffdef46 100644 +--- a/drivers/spi/spi-st-ssc4.c ++++ b/drivers/spi/spi-st-ssc4.c +@@ -385,6 +385,7 @@ static int spi_st_probe(struct platform_device *pdev) + return 0; + + clk_disable: ++ pm_runtime_disable(&pdev->dev); + clk_disable_unprepare(spi_st->clk); + put_master: + spi_master_put(master); +@@ -396,6 +397,8 @@ static int spi_st_remove(struct platform_device *pdev) + struct spi_master *master = platform_get_drvdata(pdev); + struct spi_st *spi_st = spi_master_get_devdata(master); + ++ pm_runtime_disable(&pdev->dev); ++ + clk_disable_unprepare(spi_st->clk); + + pinctrl_pm_select_sleep_state(&pdev->dev); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 9831c1106945..62b074b167a9 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1078,7 +1078,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + ret = clk_enable(tspi->clk); + if (ret < 0) { + dev_err(&pdev->dev, "Clock enable failed %d\n", ret); +- goto exit_free_master; ++ goto exit_clk_unprepare; + } + + spi_irq = platform_get_irq(pdev, 0); +@@ -1151,6 +1151,8 @@ exit_free_irq: + free_irq(spi_irq, tspi); + exit_clk_disable: + clk_disable(tspi->clk); ++exit_clk_unprepare: ++ clk_unprepare(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1164,6 +1166,7 @@ static int tegra_slink_remove(struct platform_device *pdev) + free_irq(tspi->irq, tspi); + + clk_disable(tspi->clk); ++ clk_unprepare(tspi->clk); + + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index c5fe08bc34a0..028725573e63 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -634,6 +634,9 @@ static int spidev_release(struct inode *inode, struct file *filp) + if (dofree) + kfree(spidev); + } ++#ifdef CONFIG_SPI_SLAVE ++ spi_slave_abort(spidev->spi); ++#endif + mutex_unlock(&device_list_lock); + + return 0; +diff --git a/drivers/staging/comedi/drivers/gsc_hpdi.c b/drivers/staging/comedi/drivers/gsc_hpdi.c +index e5b948405fd9..a09631f9d813 100644 +--- a/drivers/staging/comedi/drivers/gsc_hpdi.c ++++ b/drivers/staging/comedi/drivers/gsc_hpdi.c +@@ -632,6 +632,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + dma_alloc_coherent(&pcidev->dev, DMA_BUFFER_SIZE, + &devpriv->dio_buffer_phys_addr[i], + GFP_KERNEL); ++ if (!devpriv->dio_buffer[i]) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA buffer\n"); ++ return -ENOMEM; ++ } + } + /* allocate dma descriptors */ + devpriv->dma_desc = dma_alloc_coherent(&pcidev->dev, +@@ -639,6 +644,11 @@ static int gsc_hpdi_auto_attach(struct comedi_device *dev, + NUM_DMA_DESCRIPTORS, + &devpriv->dma_desc_phys_addr, + GFP_KERNEL); ++ if (!devpriv->dma_desc) { ++ dev_warn(dev->class_dev, ++ "failed to allocate DMA descriptors\n"); ++ return -ENOMEM; ++ } + if (devpriv->dma_desc_phys_addr & 0xf) { + dev_warn(dev->class_dev, + " dma descriptors not quad-word aligned (bug)\n"); +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index 0cbcbad8f074..b81c6dfa5b24 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -780,7 +780,7 @@ struct fb_info *fbtft_framebuffer_alloc(struct fbtft_display *display, + fbdefio->deferred_io = fbtft_deferred_io; + fb_deferred_io_init(info); + +- strncpy(info->fix.id, dev->driver->name, 16); ++ snprintf(info->fix.id, sizeof(info->fix.id), "%s", dev->driver->name); + info->fix.type = FB_TYPE_PACKED_PIXELS; + info->fix.visual = FB_VISUAL_TRUECOLOR; + info->fix.xpanstep = 0; +diff --git a/drivers/staging/rtl8188eu/core/rtw_xmit.c b/drivers/staging/rtl8188eu/core/rtw_xmit.c +index 904b988ecc4e..7c895af1ba31 100644 +--- a/drivers/staging/rtl8188eu/core/rtw_xmit.c ++++ b/drivers/staging/rtl8188eu/core/rtw_xmit.c +@@ -805,7 +805,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, get_bssid(pmlmepriv), ETH_ALEN); + memcpy(pwlanhdr->addr3, pattrib->src, ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else if (check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) || + check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) { +@@ -813,7 +813,7 @@ s32 rtw_make_wlanhdr(struct adapter *padapter, u8 *hdr, struct pkt_attrib *pattr + memcpy(pwlanhdr->addr2, pattrib->src, ETH_ALEN); + memcpy(pwlanhdr->addr3, get_bssid(pmlmepriv), ETH_ALEN); + +- if (psta->qos_option) ++ if (psta && psta->qos_option) + qos_option = true; + } else { + RT_TRACE(_module_rtl871x_xmit_c_, _drv_err_, ("fw_state:%x is not allowed to xmit frame\n", get_fwstate(pmlmepriv))); +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index db3eb7ec5809..fbbd1b59dc11 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1506,7 +1506,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + (tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN); + struct usb_device *udev = priv->udev; + int pend; +- int status; ++ int status, rt = -1; + struct urb *tx_urb = NULL, *tx_urb_zero = NULL; + unsigned int idx_pipe; + +@@ -1650,8 +1650,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + } + if (bSend0Byte) { + tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC); +- if (!tx_urb_zero) +- return -ENOMEM; ++ if (!tx_urb_zero) { ++ rt = -ENOMEM; ++ goto error; ++ } + usb_fill_bulk_urb(tx_urb_zero, udev, + usb_sndbulkpipe(udev, idx_pipe), + &zero, 0, tx_zero_isr, dev); +@@ -1661,7 +1663,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + "Error TX URB for zero byte %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ goto error; + } + } + netif_trans_update(dev); +@@ -1672,7 +1674,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) + RT_TRACE(COMP_ERR, "Error TX URB %d, error %d", + atomic_read(&priv->tx_pending[tcb_desc->queue_index]), + status); +- return -1; ++ ++error: ++ dev_kfree_skb_any(skb); ++ usb_free_urb(tx_urb); ++ usb_free_urb(tx_urb_zero); ++ return rt; + } + + static short rtl8192_usb_initendpoints(struct net_device *dev) +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 62b2a7105f02..4fb4cf8c2f14 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -755,8 +755,15 @@ static int claimintf(struct usb_dev_state *ps, unsigned int ifnum) + intf = usb_ifnum_to_if(dev, ifnum); + if (!intf) + err = -ENOENT; +- else ++ else { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while claiming interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + err = usb_driver_claim_interface(&usbfs_driver, intf, ps); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); ++ } + if (err == 0) + set_bit(ifnum, &ps->ifclaimed); + return err; +@@ -776,7 +783,13 @@ static int releaseintf(struct usb_dev_state *ps, unsigned int ifnum) + if (!intf) + err = -ENOENT; + else if (test_and_clear_bit(ifnum, &ps->ifclaimed)) { ++ unsigned int old_suppress; ++ ++ /* suppress uevents while releasing interface */ ++ old_suppress = dev_get_uevent_suppress(&intf->dev); ++ dev_set_uevent_suppress(&intf->dev, 1); + usb_driver_release_interface(&usbfs_driver, intf); ++ dev_set_uevent_suppress(&intf->dev, old_suppress); + err = 0; + } + return err; +diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c +index 8f3f055c05fa..477ba3842cc4 100644 +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -40,6 +40,10 @@ + + /*-------------------------------------------------------------------------*/ + ++/* PID Codes that are used here, from EHCI specification, Table 3-16. */ ++#define PID_CODE_IN 1 ++#define PID_CODE_SETUP 2 ++ + /* fill a qtd, returning how much of the buffer we were able to queue up */ + + static int +@@ -203,7 +207,7 @@ static int qtd_copy_status ( + int status = -EINPROGRESS; + + /* count IN/OUT bytes, not SETUP (even short packets) */ +- if (likely (QTD_PID (token) != 2)) ++ if (likely(QTD_PID(token) != PID_CODE_SETUP)) + urb->actual_length += length - QTD_LENGTH (token); + + /* don't modify error codes */ +@@ -219,6 +223,13 @@ static int qtd_copy_status ( + if (token & QTD_STS_BABBLE) { + /* FIXME "must" disable babbling device's port too */ + status = -EOVERFLOW; ++ /* ++ * When MMF is active and PID Code is IN, queue is halted. ++ * EHCI Specification, Table 4-13. ++ */ ++ } else if ((token & QTD_STS_MMF) && ++ (QTD_PID(token) == PID_CODE_IN)) { ++ status = -EPROTO; + /* CERR nonzero + halt --> stall */ + } else if (QTD_CERR(token)) { + status = -EPIPE; +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 021a2d320acc..09f228279c01 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -497,7 +497,6 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated) + retval = xhci_resume(xhci, hibernated); + return retval; + } +-#endif /* CONFIG_PM */ + + static void xhci_pci_shutdown(struct usb_hcd *hcd) + { +@@ -510,6 +509,7 @@ static void xhci_pci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) + pci_set_power_state(pdev, PCI_D3hot); + } ++#endif /* CONFIG_PM */ + + /*-------------------------------------------------------------------------*/ + +diff --git a/drivers/usb/renesas_usbhs/common.h b/drivers/usb/renesas_usbhs/common.h +index b8620aa6b72e..8424c165f732 100644 +--- a/drivers/usb/renesas_usbhs/common.h ++++ b/drivers/usb/renesas_usbhs/common.h +@@ -163,11 +163,12 @@ struct usbhs_priv; + #define VBSTS (1 << 7) /* VBUS_0 and VBUSIN_0 Input Status */ + #define VALID (1 << 3) /* USB Request Receive */ + +-#define DVSQ_MASK (0x3 << 4) /* Device State */ ++#define DVSQ_MASK (0x7 << 4) /* Device State */ + #define POWER_STATE (0 << 4) + #define DEFAULT_STATE (1 << 4) + #define ADDRESS_STATE (2 << 4) + #define CONFIGURATION_STATE (3 << 4) ++#define SUSPENDED_STATE (4 << 4) + + #define CTSQ_MASK (0x7) /* Control Transfer Stage */ + #define IDLE_SETUP_STAGE 0 /* Idle stage or setup stage */ +diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c +index 0dedb0d91dcc..b27f2135b66d 100644 +--- a/drivers/usb/renesas_usbhs/mod_gadget.c ++++ b/drivers/usb/renesas_usbhs/mod_gadget.c +@@ -465,12 +465,18 @@ static int usbhsg_irq_dev_state(struct usbhs_priv *priv, + { + struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); + struct device *dev = usbhsg_gpriv_to_dev(gpriv); ++ int state = usbhs_status_get_device_state(irq_state); + + gpriv->gadget.speed = usbhs_bus_get_speed(priv); + +- dev_dbg(dev, "state = %x : speed : %d\n", +- usbhs_status_get_device_state(irq_state), +- gpriv->gadget.speed); ++ dev_dbg(dev, "state = %x : speed : %d\n", state, gpriv->gadget.speed); ++ ++ if (gpriv->gadget.speed != USB_SPEED_UNKNOWN && ++ (state & SUSPENDED_STATE)) { ++ if (gpriv->driver && gpriv->driver->suspend) ++ gpriv->driver->suspend(&gpriv->gadget); ++ usb_gadget_set_state(&gpriv->gadget, USB_STATE_SUSPENDED); ++ } + + return 0; + } +diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c +index da03451328cd..cd01f1e278ee 100644 +--- a/drivers/usb/usbip/usbip_common.c ++++ b/drivers/usb/usbip/usbip_common.c +@@ -742,6 +742,9 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb) + + copy -= recv; + ret += recv; ++ ++ if (!copy) ++ break; + } + + if (ret != size) +diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c +index 3f998b605f03..c13dd526b996 100644 +--- a/drivers/usb/usbip/vhci_rx.c ++++ b/drivers/usb/usbip/vhci_rx.c +@@ -91,16 +91,21 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, + usbip_pack_pdu(pdu, urb, USBIP_RET_SUBMIT, 0); + + /* recv transfer buffer */ +- if (usbip_recv_xbuff(ud, urb) < 0) +- return; ++ if (usbip_recv_xbuff(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* recv iso_packet_descriptor */ +- if (usbip_recv_iso(ud, urb) < 0) +- return; ++ if (usbip_recv_iso(ud, urb) < 0) { ++ urb->status = -EPROTO; ++ goto error; ++ } + + /* restore the padding in iso packets */ + usbip_pad_iso(ud, urb); + ++error: + if (usbip_dbg_flag_vhci_rx) + usbip_dump_urb(urb); + +diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c +index e00c8a9fd5bb..72d7589072f5 100644 +--- a/fs/btrfs/async-thread.c ++++ b/fs/btrfs/async-thread.c +@@ -265,16 +265,17 @@ out: + } + } + +-static void run_ordered_work(struct __btrfs_workqueue *wq) ++static void run_ordered_work(struct __btrfs_workqueue *wq, ++ struct btrfs_work *self) + { + struct list_head *list = &wq->ordered_list; + struct btrfs_work *work; + spinlock_t *lock = &wq->list_lock; + unsigned long flags; ++ void *wtag; ++ bool free_self = false; + + while (1) { +- void *wtag; +- + spin_lock_irqsave(lock, flags); + if (list_empty(list)) + break; +@@ -300,16 +301,47 @@ static void run_ordered_work(struct __btrfs_workqueue *wq) + list_del(&work->ordered_list); + spin_unlock_irqrestore(lock, flags); + +- /* +- * We don't want to call the ordered free functions with the +- * lock held though. Save the work as tag for the trace event, +- * because the callback could free the structure. +- */ +- wtag = work; +- work->ordered_free(work); +- trace_btrfs_all_work_done(wq->fs_info, wtag); ++ if (work == self) { ++ /* ++ * This is the work item that the worker is currently ++ * executing. ++ * ++ * The kernel workqueue code guarantees non-reentrancy ++ * of work items. I.e., if a work item with the same ++ * address and work function is queued twice, the second ++ * execution is blocked until the first one finishes. A ++ * work item may be freed and recycled with the same ++ * work function; the workqueue code assumes that the ++ * original work item cannot depend on the recycled work ++ * item in that case (see find_worker_executing_work()). ++ * ++ * Note that the work of one Btrfs filesystem may depend ++ * on the work of another Btrfs filesystem via, e.g., a ++ * loop device. Therefore, we must not allow the current ++ * work item to be recycled until we are really done, ++ * otherwise we break the above assumption and can ++ * deadlock. ++ */ ++ free_self = true; ++ } else { ++ /* ++ * We don't want to call the ordered free functions with ++ * the lock held though. Save the work as tag for the ++ * trace event, because the callback could free the ++ * structure. ++ */ ++ wtag = work; ++ work->ordered_free(work); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + spin_unlock_irqrestore(lock, flags); ++ ++ if (free_self) { ++ wtag = self; ++ self->ordered_free(self); ++ trace_btrfs_all_work_done(wq->fs_info, wtag); ++ } + } + + static void normal_work_helper(struct btrfs_work *work) +@@ -337,7 +369,7 @@ static void normal_work_helper(struct btrfs_work *work) + work->func(work); + if (need_order) { + set_bit(WORK_DONE_BIT, &work->flags); +- run_ordered_work(wq); ++ run_ordered_work(wq, work); + } + if (!need_order) + trace_btrfs_all_work_done(wq->fs_info, wtag); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index d2263caff307..740ef428acdd 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -427,7 +427,7 @@ void btrfs_put_tree_mod_seq(struct btrfs_fs_info *fs_info, + for (node = rb_first(tm_root); node; node = next) { + next = rb_next(node); + tm = rb_entry(node, struct tree_mod_elem, node); +- if (tm->seq > min_seq) ++ if (tm->seq >= min_seq) + continue; + rb_erase(node, tm_root); + kfree(tm); +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 813834552aa1..a8ea56218d6b 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1679,8 +1679,8 @@ static void end_workqueue_fn(struct btrfs_work *work) + bio->bi_status = end_io_wq->status; + bio->bi_private = end_io_wq->private; + bio->bi_end_io = end_io_wq->end_io; +- kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + bio_endio(bio); ++ kmem_cache_free(btrfs_end_io_wq_cache, end_io_wq); + } + + static int cleaner_kthread(void *arg) +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 4cc534584665..fced434bbddc 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4949,12 +4949,14 @@ struct extent_buffer *alloc_test_extent_buffer(struct btrfs_fs_info *fs_info, + return eb; + eb = alloc_dummy_extent_buffer(fs_info, start); + if (!eb) +- return NULL; ++ return ERR_PTR(-ENOMEM); + eb->fs_info = fs_info; + again: + ret = radix_tree_preload(GFP_NOFS); +- if (ret) ++ if (ret) { ++ exists = ERR_PTR(ret); + goto free_eb; ++ } + spin_lock(&fs_info->buffer_lock); + ret = radix_tree_insert(&fs_info->buffer_radix, + start >> PAGE_SHIFT, eb); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 739f45b04b52..f2dc517768f0 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5729,7 +5729,6 @@ static void inode_tree_add(struct inode *inode) + + static void inode_tree_del(struct inode *inode) + { +- struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + struct btrfs_root *root = BTRFS_I(inode)->root; + int empty = 0; + +@@ -5742,7 +5741,6 @@ static void inode_tree_del(struct inode *inode) + spin_unlock(&root->inode_lock); + + if (empty && btrfs_root_refs(&root->root_item) == 0) { +- synchronize_srcu(&fs_info->subvol_srcu); + spin_lock(&root->inode_lock); + empty = RB_EMPTY_ROOT(&root->inode_tree); + spin_unlock(&root->inode_lock); +@@ -9820,9 +9818,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, + return -EXDEV; + + /* close the race window with snapshot create/destroy ioctl */ +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) +- down_read(&fs_info->subvol_sem); +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (old_ino == BTRFS_FIRST_FREE_OBJECTID || ++ new_ino == BTRFS_FIRST_FREE_OBJECTID) + down_read(&fs_info->subvol_sem); + + /* +@@ -10014,9 +10011,8 @@ out_fail: + ret2 = btrfs_end_transaction(trans); + ret = ret ? ret : ret2; + out_notrans: +- if (new_ino == BTRFS_FIRST_FREE_OBJECTID) +- up_read(&fs_info->subvol_sem); +- if (old_ino == BTRFS_FIRST_FREE_OBJECTID) ++ if (new_ino == BTRFS_FIRST_FREE_OBJECTID || ++ old_ino == BTRFS_FIRST_FREE_OBJECTID) + up_read(&fs_info->subvol_sem); + + return ret; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index dd3b4820ac30..e82b4f3f490c 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -580,12 +580,18 @@ static noinline int create_subvol(struct inode *dir, + + btrfs_i_size_write(BTRFS_I(dir), dir->i_size + namelen * 2); + ret = btrfs_update_inode(trans, root, dir); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_add_root_ref(trans, fs_info, + objectid, root->root_key.objectid, + btrfs_ino(BTRFS_I(dir)), index, name, namelen); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_uuid_tree_add(trans, fs_info, root_item->uuid, + BTRFS_UUID_KEY_SUBVOL, objectid); +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index 3a4e15b39cc1..440c0d5d2050 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -734,21 +734,19 @@ static int reada_start_machine_dev(struct btrfs_device *dev) + static void reada_start_machine_worker(struct btrfs_work *work) + { + struct reada_machine_work *rmw; +- struct btrfs_fs_info *fs_info; + int old_ioprio; + + rmw = container_of(work, struct reada_machine_work, work); +- fs_info = rmw->fs_info; +- +- kfree(rmw); + + old_ioprio = IOPRIO_PRIO_VALUE(task_nice_ioclass(current), + task_nice_ioprio(current)); + set_task_ioprio(current, BTRFS_IOPRIO_READA); +- __reada_start_machine(fs_info); ++ __reada_start_machine(rmw->fs_info); + set_task_ioprio(current, old_ioprio); + +- atomic_dec(&fs_info->reada_works_cnt); ++ atomic_dec(&rmw->fs_info->reada_works_cnt); ++ ++ kfree(rmw); + } + + static void __reada_start_machine(struct btrfs_fs_info *fs_info) +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 9fa6db6a6f7d..d4c00edd16d2 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4587,6 +4587,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) + fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); ++ list_add_tail(&reloc_root->root_list, &reloc_roots); + goto out_free; + } + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 61192c536e6c..2ebae9773978 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2421,14 +2421,13 @@ static void scrub_missing_raid56_worker(struct btrfs_work *work) + scrub_write_block_to_dev_replace(sblock); + } + +- scrub_block_put(sblock); +- + if (sctx->is_dev_replace && sctx->flush_all_writes) { + mutex_lock(&sctx->wr_lock); + scrub_wr_submit(sctx); + mutex_unlock(&sctx->wr_lock); + } + ++ scrub_block_put(sblock); + scrub_pending_bio_dec(sctx); + } + +diff --git a/fs/btrfs/tests/free-space-tree-tests.c b/fs/btrfs/tests/free-space-tree-tests.c +index 8444a018cca2..f6c783e959b7 100644 +--- a/fs/btrfs/tests/free-space-tree-tests.c ++++ b/fs/btrfs/tests/free-space-tree-tests.c +@@ -475,9 +475,9 @@ static int run_test(test_func_t test_func, int bitmaps, u32 sectorsize, + root->fs_info->tree_root = root; + + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { +- test_msg("Couldn't allocate dummy buffer\n"); +- ret = -ENOMEM; ++ if (IS_ERR(root->node)) { ++ test_msg("couldn't allocate dummy buffer\n"); ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c +index 578fd045e859..eb72cf280546 100644 +--- a/fs/btrfs/tests/qgroup-tests.c ++++ b/fs/btrfs/tests/qgroup-tests.c +@@ -487,9 +487,9 @@ int btrfs_test_qgroups(u32 sectorsize, u32 nodesize) + * *cough*backref walking code*cough* + */ + root->node = alloc_test_extent_buffer(root->fs_info, nodesize); +- if (!root->node) { ++ if (IS_ERR(root->node)) { + test_msg("Couldn't allocate dummy buffer\n"); +- ret = -ENOMEM; ++ ret = PTR_ERR(root->node); + goto out; + } + btrfs_set_header_level(root->node, 0); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index e35301e5fe8e..98c397eb054c 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6018,9 +6018,28 @@ again: + wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key); + if (IS_ERR(wc.replay_dest)) { + ret = PTR_ERR(wc.replay_dest); ++ ++ /* ++ * We didn't find the subvol, likely because it was ++ * deleted. This is ok, simply skip this log and go to ++ * the next one. ++ * ++ * We need to exclude the root because we can't have ++ * other log replays overwriting this log as we'll read ++ * it back in a few more times. This will keep our ++ * block from being modified, and we'll just bail for ++ * each subsequent pass. ++ */ ++ if (ret == -ENOENT) ++ ret = btrfs_pin_extent_for_log_replay(fs_info, ++ log->node->start, ++ log->node->len); + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); + kfree(log); ++ ++ if (!ret) ++ goto next; + btrfs_handle_fs_error(fs_info, ret, + "Couldn't read target root for tree log recovery."); + goto error; +@@ -6052,7 +6071,6 @@ again: + &root->highest_objectid); + } + +- key.offset = found_key.offset - 1; + wc.replay_dest->log_root = NULL; + free_extent_buffer(log->node); + free_extent_buffer(log->commit_root); +@@ -6060,9 +6078,10 @@ again: + + if (ret) + goto error; +- ++next: + if (found_key.offset == 0) + break; ++ key.offset = found_key.offset - 1; + } + btrfs_release_path(path); + +diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c +index 726f928238d0..331f3a1ad23b 100644 +--- a/fs/btrfs/uuid-tree.c ++++ b/fs/btrfs/uuid-tree.c +@@ -336,6 +336,8 @@ again_search_slot: + } + if (ret < 0 && ret != -ENOENT) + goto out; ++ key.offset++; ++ goto again_search_slot; + } + item_size -= sizeof(subid_le); + offset += sizeof(subid_le); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 446b6c375b6f..c17855fead7b 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -76,6 +76,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + error_msg = "rec_len is too small for name_len"; + else if (unlikely(((char *) de - buf) + rlen > size)) + error_msg = "directory entry overrun"; ++ else if (unlikely(((char *) de - buf) + rlen > ++ size - EXT4_DIR_REC_LEN(1) && ++ ((char *) de - buf) + rlen != size)) { ++ error_msg = "directory entry too close to block end"; ++ } + else if (unlikely(le32_to_cpu(de->inode) > + le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) + error_msg = "inode out of bounds"; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 11bc4c69bf16..c2920cbfa3bf 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5874,7 +5874,7 @@ int ext4_expand_extra_isize(struct inode *inode, + error = ext4_journal_get_write_access(handle, iloc->bh); + if (error) { + brelse(iloc->bh); +- goto out_stop; ++ goto out_unlock; + } + + error = __ext4_expand_extra_isize(inode, new_extra_isize, iloc, +@@ -5884,8 +5884,8 @@ int ext4_expand_extra_isize(struct inode *inode, + if (!error) + error = rc; + ++out_unlock: + ext4_write_unlock_xattr(inode, &no_expand); +-out_stop: + ext4_journal_stop(handle); + return error; + } +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index b4e0c270def4..0b5c36bd5418 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2702,7 +2702,7 @@ bool ext4_empty_dir(struct inode *inode) + { + unsigned int offset; + struct buffer_head *bh; +- struct ext4_dir_entry_2 *de, *de1; ++ struct ext4_dir_entry_2 *de; + struct super_block *sb; + + if (ext4_has_inline_data(inode)) { +@@ -2727,19 +2727,25 @@ bool ext4_empty_dir(struct inode *inode) + return true; + + de = (struct ext4_dir_entry_2 *) bh->b_data; +- de1 = ext4_next_entry(de, sb->s_blocksize); +- if (le32_to_cpu(de->inode) != inode->i_ino || +- le32_to_cpu(de1->inode) == 0 || +- strcmp(".", de->name) || strcmp("..", de1->name)) { +- ext4_warning_inode(inode, "directory missing '.' and/or '..'"); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ 0) || ++ le32_to_cpu(de->inode) != inode->i_ino || strcmp(".", de->name)) { ++ ext4_warning_inode(inode, "directory missing '.'"); ++ brelse(bh); ++ return true; ++ } ++ offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); ++ de = ext4_next_entry(de, sb->s_blocksize); ++ if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, ++ offset) || ++ le32_to_cpu(de->inode) == 0 || strcmp("..", de->name)) { ++ ext4_warning_inode(inode, "directory missing '..'"); + brelse(bh); + return true; + } +- offset = ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize) + +- ext4_rec_len_from_disk(de1->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de1, sb->s_blocksize); ++ offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); + while (offset < inode->i_size) { +- if ((void *) de >= (void *) (bh->b_data+sb->s_blocksize)) { ++ if (!(offset & (sb->s_blocksize - 1))) { + unsigned int lblock; + brelse(bh); + lblock = offset >> EXT4_BLOCK_SIZE_BITS(sb); +@@ -2750,12 +2756,11 @@ bool ext4_empty_dir(struct inode *inode) + } + if (IS_ERR(bh)) + return true; +- de = (struct ext4_dir_entry_2 *) bh->b_data; + } ++ de = (struct ext4_dir_entry_2 *) (bh->b_data + ++ (offset & (sb->s_blocksize - 1))); + if (ext4_check_dir_entry(inode, NULL, de, bh, + bh->b_data, bh->b_size, offset)) { +- de = (struct ext4_dir_entry_2 *)(bh->b_data + +- sb->s_blocksize); + offset = (offset | (sb->s_blocksize - 1)) + 1; + continue; + } +@@ -2764,7 +2769,6 @@ bool ext4_empty_dir(struct inode *inode) + return false; + } + offset += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); +- de = ext4_next_entry(de, sb->s_blocksize); + } + brelse(bh); + return true; +diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h +index d55abb75f29a..eec6cba204ea 100644 +--- a/include/drm/drm_dp_mst_helper.h ++++ b/include/drm/drm_dp_mst_helper.h +@@ -313,7 +313,7 @@ struct drm_dp_resource_status_notify { + + struct drm_dp_query_payload_ack_reply { + u8 port_number; +- u8 allocated_pbn; ++ u16 allocated_pbn; + }; + + struct drm_dp_sideband_msg_req_body { +diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h +index 4de703d9e21f..5e1e50b8f8c4 100644 +--- a/include/linux/miscdevice.h ++++ b/include/linux/miscdevice.h +@@ -56,6 +56,7 @@ + #define UHID_MINOR 239 + #define USERIO_MINOR 240 + #define VHOST_VSOCK_MINOR 241 ++#define RFKILL_MINOR 242 + #define MISC_DYNAMIC_MINOR 255 + + struct device; +diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h +index 1c2e8d6b7274..6db347b58644 100644 +--- a/include/linux/mod_devicetable.h ++++ b/include/linux/mod_devicetable.h +@@ -519,9 +519,9 @@ struct platform_device_id { + #define MDIO_NAME_SIZE 32 + #define MDIO_MODULE_PREFIX "mdio:" + +-#define MDIO_ID_FMT "%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d%d" ++#define MDIO_ID_FMT "%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u" + #define MDIO_ID_ARGS(_id) \ +- (_id)>>31, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ ++ ((_id)>>31) & 1, ((_id)>>30) & 1, ((_id)>>29) & 1, ((_id)>>28) & 1, \ + ((_id)>>27) & 1, ((_id)>>26) & 1, ((_id)>>25) & 1, ((_id)>>24) & 1, \ + ((_id)>>23) & 1, ((_id)>>22) & 1, ((_id)>>21) & 1, ((_id)>>20) & 1, \ + ((_id)>>19) & 1, ((_id)>>18) & 1, ((_id)>>17) & 1, ((_id)>>16) & 1, \ +diff --git a/include/net/dst.h b/include/net/dst.h +index 2acd670fc86b..fe230dd62c28 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -110,7 +110,7 @@ struct dst_entry { + struct dst_metrics { + u32 metrics[RTAX_MAX]; + refcount_t refcnt; +-}; ++} __aligned(4); /* Low pointer bits contain DST_METRICS_FLAGS */ + extern const struct dst_metrics dst_default_metrics; + + u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); +diff --git a/include/trace/events/wbt.h b/include/trace/events/wbt.h +index b048694070e2..37342a13c9cb 100644 +--- a/include/trace/events/wbt.h ++++ b/include/trace/events/wbt.h +@@ -33,7 +33,8 @@ TRACE_EVENT(wbt_stat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->rmean = stat[0].mean; + __entry->rmin = stat[0].min; + __entry->rmax = stat[0].max; +@@ -67,7 +68,8 @@ TRACE_EVENT(wbt_lat, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->lat = div_u64(lat, 1000); + ), + +@@ -103,7 +105,8 @@ TRACE_EVENT(wbt_step, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->msg = msg; + __entry->step = step; + __entry->window = div_u64(window, 1000); +@@ -138,7 +141,8 @@ TRACE_EVENT(wbt_timer, + ), + + TP_fast_assign( +- strncpy(__entry->name, dev_name(bdi->dev), 32); ++ strlcpy(__entry->name, dev_name(bdi->dev), ++ ARRAY_SIZE(__entry->name)); + __entry->status = status; + __entry->step = step; + __entry->inflight = inflight; +diff --git a/include/uapi/linux/cec-funcs.h b/include/uapi/linux/cec-funcs.h +index 28e8a2a86e16..2a114f7a24d4 100644 +--- a/include/uapi/linux/cec-funcs.h ++++ b/include/uapi/linux/cec-funcs.h +@@ -952,7 +952,8 @@ static inline void cec_msg_give_deck_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_DECK_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_DECK_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_DECK_STATUS : 0; + } + + static inline void cec_ops_give_deck_status(const struct cec_msg *msg, +@@ -1056,7 +1057,8 @@ static inline void cec_msg_give_tuner_device_status(struct cec_msg *msg, + msg->len = 3; + msg->msg[1] = CEC_MSG_GIVE_TUNER_DEVICE_STATUS; + msg->msg[2] = status_req; +- msg->reply = reply ? CEC_MSG_TUNER_DEVICE_STATUS : 0; ++ msg->reply = (reply && status_req != CEC_OP_STATUS_REQ_OFF) ? ++ CEC_MSG_TUNER_DEVICE_STATUS : 0; + } + + static inline void cec_ops_give_tuner_device_status(const struct cec_msg *msg, +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 6bc679cd3481..ff80a9d41ce1 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -802,8 +802,8 @@ static int hci_init4_req(struct hci_request *req, unsigned long opt) + if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { + struct hci_cp_le_write_def_data_len cp; + +- cp.tx_len = hdev->le_max_tx_len; +- cp.tx_time = hdev->le_max_tx_time; ++ cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); ++ cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); + hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp); + } + +@@ -4215,7 +4215,14 @@ static void hci_rx_work(struct work_struct *work) + hci_send_to_sock(hdev, skb); + } + +- if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index b73ac149de34..759329bec399 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1095,6 +1095,14 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + + instance_flags = get_adv_instance_flags(hdev, instance); + ++ /* If instance already has the flags set skip adding it once ++ * again. ++ */ ++ if (adv_instance && eir_get_data(adv_instance->adv_data, ++ adv_instance->adv_data_len, EIR_FLAGS, ++ NULL)) ++ goto skip_flags; ++ + /* The Add Advertising command allows userspace to set both the general + * and limited discoverable flags. + */ +@@ -1127,6 +1135,7 @@ static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) + } + } + ++skip_flags: + if (adv_instance) { + memcpy(ptr, adv_instance->adv_data, + adv_instance->adv_data_len); +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index b18466cf466c..fbe7354aeac7 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -856,7 +856,8 @@ static void __ieee80211_tx_status(struct ieee80211_hw *hw, + I802_DEBUG_INC(local->dot11FailedCount); + } + +- if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) && ++ if ((ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) && ++ ieee80211_has_pm(fc) && + ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) && + !(info->flags & IEEE80211_TX_CTL_INJECTED) && + local->ps_sdata && !(local->scanning)) { +diff --git a/net/nfc/nci/uart.c b/net/nfc/nci/uart.c +index 8d104c1db628..6f5addb5225c 100644 +--- a/net/nfc/nci/uart.c ++++ b/net/nfc/nci/uart.c +@@ -348,7 +348,7 @@ static int nci_uart_default_recv_buf(struct nci_uart *nu, const u8 *data, + nu->rx_packet_len = -1; + nu->rx_skb = nci_skb_alloc(nu->ndev, + NCI_MAX_PACKET_SIZE, +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!nu->rx_skb) + return -ENOMEM; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 1f86bf0d1649..4e1058159b08 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -593,7 +593,8 @@ static int prb_calc_retire_blk_tmo(struct packet_sock *po, + msec = 1; + div = ecmd.base.speed / 1000; + } +- } ++ } else ++ return DEFAULT_PRB_RETIRE_TOV; + + mbits = (blk_size_in_bytes * 8) / (1024 * 1024); + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index 2064c3a35ef8..99a2e55b01cf 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -1312,10 +1312,12 @@ static const struct file_operations rfkill_fops = { + .llseek = no_llseek, + }; + ++#define RFKILL_NAME "rfkill" ++ + static struct miscdevice rfkill_miscdev = { +- .name = "rfkill", + .fops = &rfkill_fops, +- .minor = MISC_DYNAMIC_MINOR, ++ .name = RFKILL_NAME, ++ .minor = RFKILL_MINOR, + }; + + static int __init rfkill_init(void) +@@ -1367,3 +1369,6 @@ static void __exit rfkill_exit(void) + class_unregister(&rfkill_class); + } + module_exit(rfkill_exit); ++ ++MODULE_ALIAS_MISCDEV(RFKILL_MINOR); ++MODULE_ALIAS("devname:" RFKILL_NAME); +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index 01f88e9abbc6..bf39f317953a 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -253,6 +253,7 @@ static void sctp_v4_from_skb(union sctp_addr *addr, struct sk_buff *skb, + sa->sin_port = sh->dest; + sa->sin_addr.s_addr = ip_hdr(skb)->daddr; + } ++ memset(sa->sin_zero, 0, sizeof(sa->sin_zero)); + } + + /* Initialize an sctp_addr from a socket. */ +@@ -261,6 +262,7 @@ static void sctp_v4_from_sk(union sctp_addr *addr, struct sock *sk) + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = 0; + addr->v4.sin_addr.s_addr = inet_sk(sk)->inet_rcv_saddr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize sk->sk_rcv_saddr from sctp_addr. */ +@@ -283,6 +285,7 @@ static void sctp_v4_from_addr_param(union sctp_addr *addr, + addr->v4.sin_family = AF_INET; + addr->v4.sin_port = port; + addr->v4.sin_addr.s_addr = param->v4.addr.s_addr; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Initialize an address parameter from a sctp_addr and return the length +@@ -307,6 +310,7 @@ static void sctp_v4_dst_saddr(union sctp_addr *saddr, struct flowi4 *fl4, + saddr->v4.sin_family = AF_INET; + saddr->v4.sin_port = port; + saddr->v4.sin_addr.s_addr = fl4->saddr; ++ memset(saddr->v4.sin_zero, 0, sizeof(saddr->v4.sin_zero)); + } + + /* Compare two addresses exactly. */ +@@ -329,6 +333,7 @@ static void sctp_v4_inaddr_any(union sctp_addr *addr, __be16 port) + addr->v4.sin_family = AF_INET; + addr->v4.sin_addr.s_addr = htonl(INADDR_ANY); + addr->v4.sin_port = port; ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + } + + /* Is this a wildcard address? */ +diff --git a/samples/bpf/cgroup_helpers.c b/samples/bpf/cgroup_helpers.c +index 09afaddfc9ba..b5c09cd6c7bd 100644 +--- a/samples/bpf/cgroup_helpers.c ++++ b/samples/bpf/cgroup_helpers.c +@@ -43,7 +43,7 @@ + */ + int setup_cgroup_environment(void) + { +- char cgroup_workdir[PATH_MAX + 1]; ++ char cgroup_workdir[PATH_MAX - 24]; + + format_cgroup_path(cgroup_workdir, ""); + +diff --git a/samples/pktgen/functions.sh b/samples/pktgen/functions.sh +index 205e4cde4601..065a7e296ee3 100644 +--- a/samples/pktgen/functions.sh ++++ b/samples/pktgen/functions.sh +@@ -5,6 +5,8 @@ + # Author: Jesper Dangaaard Brouer + # License: GPL + ++set -o errexit ++ + ## -- General shell logging cmds -- + function err() { + local exitcode=$1 +@@ -58,6 +60,7 @@ function pg_set() { + function proc_cmd() { + local result + local proc_file=$1 ++ local status=0 + # after shift, the remaining args are contained in $@ + shift + local proc_ctrl=${PROC_DIR}/$proc_file +@@ -73,13 +76,13 @@ function proc_cmd() { + echo "cmd: $@ > $proc_ctrl" + fi + # Quoting of "$@" is important for space expansion +- echo "$@" > "$proc_ctrl" +- local status=$? ++ echo "$@" > "$proc_ctrl" || status=$? + +- result=$(grep "Result: OK:" $proc_ctrl) +- # Due to pgctrl, cannot use exit code $? from grep +- if [[ "$result" == "" ]]; then +- grep "Result:" $proc_ctrl >&2 ++ if [[ "$proc_file" != "pgctrl" ]]; then ++ result=$(grep "Result: OK:" $proc_ctrl) || true ++ if [[ "$result" == "" ]]; then ++ grep "Result:" $proc_ctrl >&2 ++ fi + fi + if (( $status != 0 )); then + err 5 "Write error($status) occurred cmd: \"$@ > $proc_ctrl\"" +@@ -105,6 +108,8 @@ function pgset() { + fi + } + ++[[ $EUID -eq 0 ]] && trap 'pg_ctrl "reset"' EXIT ++ + ## -- General shell tricks -- + + function root_check_run_with_sudo() { +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 182e4afd21eb..14b1ee29509d 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -720,6 +720,10 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + while (runtime->boundary * 2 <= LONG_MAX - runtime->buffer_size) + runtime->boundary *= 2; + ++ /* clear the buffer for avoiding possible kernel info leaks */ ++ if (runtime->dma_area && !substream->ops->copy_user) ++ memset(runtime->dma_area, 0, runtime->dma_bytes); ++ + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); + +diff --git a/sound/core/timer.c b/sound/core/timer.c +index c60dfd52e8a6..22589a073423 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -88,6 +88,9 @@ static LIST_HEAD(snd_timer_slave_list); + /* lock for slave active lists */ + static DEFINE_SPINLOCK(slave_active_lock); + ++#define MAX_SLAVE_INSTANCES 1000 ++static int num_slaves; ++ + static DEFINE_MUTEX(register_mutex); + + static int snd_timer_free(struct snd_timer *timer); +@@ -266,6 +269,10 @@ int snd_timer_open(struct snd_timer_instance **ti, + err = -EINVAL; + goto unlock; + } ++ if (num_slaves >= MAX_SLAVE_INSTANCES) { ++ err = -EBUSY; ++ goto unlock; ++ } + timeri = snd_timer_instance_new(owner, NULL); + if (!timeri) { + err = -ENOMEM; +@@ -275,6 +282,7 @@ int snd_timer_open(struct snd_timer_instance **ti, + timeri->slave_id = tid->device; + timeri->flags |= SNDRV_TIMER_IFLG_SLAVE; + list_add_tail(&timeri->open_list, &snd_timer_slave_list); ++ num_slaves++; + err = snd_timer_check_slave(timeri); + if (err < 0) { + snd_timer_close_locked(timeri, &card_dev_to_put); +@@ -364,6 +372,8 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri, + struct snd_timer_instance *slave, *tmp; + + list_del(&timeri->open_list); ++ if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) ++ num_slaves--; + + /* force to stop the timer */ + snd_timer_stop(timeri); +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 9876d8dc2ede..92f5f452bee2 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1300,13 +1300,14 @@ struct scp_msg { + + static void dspio_clear_response_queue(struct hda_codec *codec) + { ++ unsigned long timeout = jiffies + msecs_to_jiffies(1000); + unsigned int dummy = 0; +- int status = -1; ++ int status; + + /* clear all from the response queue */ + do { + status = dspio_read(codec, &dummy); +- } while (status == 0); ++ } while (status == 0 && time_before(jiffies, timeout)); + } + + static int dspio_get_response_data(struct hda_codec *codec) +@@ -4424,12 +4425,14 @@ static void ca0132_process_dsp_response(struct hda_codec *codec, + struct ca0132_spec *spec = codec->spec; + + codec_dbg(codec, "ca0132_process_dsp_response\n"); ++ snd_hda_power_up_pm(codec); + if (spec->wait_scp) { + if (dspio_get_response_data(codec) >= 0) + spec->wait_scp = 0; + } + + dspio_clear_response_queue(codec); ++ snd_hda_power_down_pm(codec); + } + + static void hp_callback(struct hda_codec *codec, struct hda_jack_callback *cb) +diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c +index 1cd20b88a3a9..82ee8f4b965b 100644 +--- a/sound/soc/codecs/rt5677.c ++++ b/sound/soc/codecs/rt5677.c +@@ -297,6 +297,7 @@ static bool rt5677_volatile_register(struct device *dev, unsigned int reg) + case RT5677_I2C_MASTER_CTRL7: + case RT5677_I2C_MASTER_CTRL8: + case RT5677_HAP_GENE_CTRL2: ++ case RT5677_PWR_ANLG2: /* Modified by DSP firmware */ + case RT5677_PWR_DSP_ST: + case RT5677_PRIV_DATA: + case RT5677_ASRC_22: +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 41cb1fefbd42..405196283688 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -422,6 +422,9 @@ static int kabylake_dmic_startup(struct snd_pcm_substream *substream) + snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS, + dmic_constraints); + ++ runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE; ++ snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16); ++ + return snd_pcm_hw_constraint_list(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, &constraints_rates); + } +diff --git a/tools/lib/subcmd/Makefile b/tools/lib/subcmd/Makefile +index 5b2cd5e58df0..5dbb0dde208c 100644 +--- a/tools/lib/subcmd/Makefile ++++ b/tools/lib/subcmd/Makefile +@@ -28,7 +28,9 @@ ifeq ($(DEBUG),0) + endif + endif + +-ifeq ($(CC_NO_CLANG), 0) ++ifeq ($(DEBUG),1) ++ CFLAGS += -O0 ++else ifeq ($(CC_NO_CLANG), 0) + CFLAGS += -O3 + else + CFLAGS += -O6 +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 5e10ba796a6f..569bceff5f51 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1492,8 +1492,10 @@ static int copy_filter_type(struct event_filter *filter, + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1502,8 +1504,11 @@ static int copy_filter_type(struct event_filter *filter, + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + +diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +index e0b85930dd77..0a0e9112f284 100644 +--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt ++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt +@@ -333,7 +333,7 @@ AVXcode: 1 + 06: CLTS + 07: SYSRET (o64) + 08: INVD +-09: WBINVD ++09: WBINVD | WBNOINVD (F3) + 0a: + 0b: UD2 (1B) + 0c: +@@ -364,7 +364,7 @@ AVXcode: 1 + # a ModR/M byte. + 1a: BNDCL Gv,Ev (F3) | BNDCU Gv,Ev (F2) | BNDMOV Gv,Ev (66) | BNDLDX Gv,Ev + 1b: BNDCN Gv,Ev (F2) | BNDMOV Ev,Gv (66) | BNDMK Gv,Ev (F3) | BNDSTX Ev,Gv +-1c: ++1c: Grp20 (1A),(1C) + 1d: + 1e: + 1f: NOP Ev +@@ -792,6 +792,8 @@ f3: Grp17 (1A) + f5: BZHI Gy,Ey,By (v) | PEXT Gy,By,Ey (F3),(v) | PDEP Gy,By,Ey (F2),(v) + f6: ADCX Gy,Ey (66) | ADOX Gy,Ey (F3) | MULX By,Gy,rDX,Ey (F2),(v) + f7: BEXTR Gy,Ey,By (v) | SHLX Gy,Ey,By (66),(v) | SARX Gy,Ey,By (F3),(v) | SHRX Gy,Ey,By (F2),(v) ++f8: MOVDIR64B Gv,Mdqq (66) | ENQCMD Gv,Mdqq (F2) | ENQCMDS Gv,Mdqq (F3) ++f9: MOVDIRI My,Gy + EndTable + + Table: 3-byte opcode 2 (0x0f 0x3a) +@@ -943,9 +945,9 @@ GrpTable: Grp6 + EndTable + + GrpTable: Grp7 +-0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) +-1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) +-2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) ++0: SGDT Ms | VMCALL (001),(11B) | VMLAUNCH (010),(11B) | VMRESUME (011),(11B) | VMXOFF (100),(11B) | PCONFIG (101),(11B) | ENCLV (000),(11B) ++1: SIDT Ms | MONITOR (000),(11B) | MWAIT (001),(11B) | CLAC (010),(11B) | STAC (011),(11B) | ENCLS (111),(11B) ++2: LGDT Ms | XGETBV (000),(11B) | XSETBV (001),(11B) | VMFUNC (100),(11B) | XEND (101)(11B) | XTEST (110)(11B) | ENCLU (111),(11B) + 3: LIDT Ms + 4: SMSW Mw/Rv + 5: rdpkru (110),(11B) | wrpkru (111),(11B) +@@ -1020,7 +1022,7 @@ GrpTable: Grp15 + 3: vstmxcsr Md (v1) | WRGSBASE Ry (F3),(11B) + 4: XSAVE | ptwrite Ey (F3),(11B) + 5: XRSTOR | lfence (11B) +-6: XSAVEOPT | clwb (66) | mfence (11B) ++6: XSAVEOPT | clwb (66) | mfence (11B) | TPAUSE Rd (66),(11B) | UMONITOR Rv (F3),(11B) | UMWAIT Rd (F2),(11B) + 7: clflush | clflushopt (66) | sfence (11B) + EndTable + +@@ -1051,6 +1053,10 @@ GrpTable: Grp19 + 6: vscatterpf1qps/d Wx (66),(ev) + EndTable + ++GrpTable: Grp20 ++0: cldemote Mb ++EndTable ++ + # AMD's Prefetch Group + GrpTable: GrpP + 0: PREFETCH +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 4ddb0726eebc..fd4dd12b8f9d 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -342,6 +342,13 @@ static int report__setup_sample_type(struct report *rep) + PERF_SAMPLE_BRANCH_ANY)) + rep->nonany_branch_mode = true; + ++#ifndef HAVE_LIBUNWIND_SUPPORT ++ if (dwarf_callchain_users) { ++ ui__warning("Please install libunwind development packages " ++ "during the perf build.\n"); ++ } ++#endif ++ + return 0; + } + +diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c +index 89c8e1604ca7..94fe5464bc6f 100644 +--- a/tools/perf/tests/task-exit.c ++++ b/tools/perf/tests/task-exit.c +@@ -104,6 +104,7 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused + if (perf_evlist__mmap(evlist, 128, true) < 0) { + pr_debug("failed to mmap events: %d (%s)\n", errno, + str_error_r(errno, sbuf, sizeof(sbuf))); ++ err = -1; + goto out_delete_evlist; + } + +diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c +index f5acda13dcfa..289ef63208fb 100644 +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -320,21 +320,51 @@ bool die_is_func_def(Dwarf_Die *dw_die) + dwarf_attr(dw_die, DW_AT_declaration, &attr) == NULL); + } + ++/** ++ * die_entrypc - Returns entry PC (the lowest address) of a DIE ++ * @dw_die: a DIE ++ * @addr: where to store entry PC ++ * ++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address ++ * range, we have to use this to retrieve the lowest address from the address ++ * range attribute. ++ */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) ++{ ++ Dwarf_Addr base, end; ++ ++ if (!addr) ++ return -EINVAL; ++ ++ if (dwarf_entrypc(dw_die, addr) == 0) ++ return 0; ++ ++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; ++} ++ + /** + * die_is_func_instance - Ensure that this DIE is an instance of a subprogram + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure +@@ -611,6 +641,9 @@ static int __die_walk_instances_cb(Dwarf_Die *inst, void *data) + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; +@@ -682,15 +715,14 @@ static int __die_walk_funclines_cb(Dwarf_Die *in_die, void *data) + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; + } ++ if (!lw->recursive) ++ return DIE_FIND_CB_SIBLING; + } +- if (!lw->recursive) +- /* Don't need to search recursively */ +- return DIE_FIND_CB_SIBLING; + + if (addr) { + fname = dwarf_decl_file(in_die); +@@ -723,7 +755,7 @@ static int __die_walk_funclines(Dwarf_Die *sp_die, bool recursive, + /* Handle function declaration line */ + fname = dwarf_decl_file(sp_die); + if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && +- dwarf_entrypc(sp_die, &addr) == 0) { ++ die_entrypc(sp_die, &addr) == 0) { + lw.retval = callback(fname, lineno, addr, data); + if (lw.retval != 0) + goto done; +@@ -737,6 +769,10 @@ static int __die_walk_culines_cb(Dwarf_Die *sp_die, void *data) + { + struct __line_walk_param *lw = data; + ++ /* ++ * Since inlined function can include another inlined function in ++ * the same file, we need to walk in it recursively. ++ */ + lw->retval = __die_walk_funclines(sp_die, true, lw->callback, lw->data); + if (lw->retval != 0) + return DWARF_CB_ABORT; +@@ -761,11 +797,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -796,6 +833,12 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* +@@ -805,13 +848,21 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + +@@ -826,8 +877,9 @@ int die_walk_lines(Dwarf_Die *rt_die, line_walk_callback_t callback, void *data) + */ + if (rt_die != cu_die) + /* +- * Don't need walk functions recursively, because nested +- * inlined functions don't have lines of the specified DIE. ++ * Don't need walk inlined functions recursively, because ++ * inner inlined functions don't have the lines of the ++ * specified function. + */ + ret = __die_walk_funclines(rt_die, false, callback, data); + else { +@@ -1002,7 +1054,7 @@ static int die_get_var_innermost_scope(Dwarf_Die *sp_die, Dwarf_Die *vr_die, + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +@@ -1065,7 +1117,7 @@ int die_get_var_range(Dwarf_Die *sp_die, Dwarf_Die *vr_die, struct strbuf *buf) + bool first = true; + const char *name; + +- ret = dwarf_entrypc(sp_die, &entry); ++ ret = die_entrypc(sp_die, &entry); + if (ret) + return ret; + +diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h +index 8ac53bf1ec4e..ee15fac4e1d0 100644 +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -41,6 +41,9 @@ int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, + /* Get DW_AT_linkage_name (should be NULL for C binary) */ + const char *die_get_linkage_name(Dwarf_Die *dw_die); + ++/* Get the lowest PC in DIE (including range list) */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); ++ + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + bool die_is_func_def(Dwarf_Die *dw_die); + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 29e2bb304168..096c52f296d7 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -1253,8 +1253,15 @@ static int __parse_events_add_pmu(struct parse_events_state *parse_state, + if (get_config_terms(head_config, &config_terms)) + return -ENOMEM; + +- if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) ++ if (perf_pmu__config(pmu, &attr, head_config, parse_state->error)) { ++ struct perf_evsel_config_term *pos, *tmp; ++ ++ list_for_each_entry_safe(pos, tmp, &config_terms, list) { ++ list_del_init(&pos->list); ++ free(pos); ++ } + return -EINVAL; ++ } + + evsel = __add_event(list, &parse_state->idx, &attr, + get_config_name(head_config), pmu, +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index a5731de0e5eb..30a5e92b67bd 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -767,6 +767,16 @@ static int find_best_scope_cb(Dwarf_Die *fn_die, void *data) + return 0; + } + ++/* Return innermost DIE */ ++static int find_inner_scope_cb(Dwarf_Die *fn_die, void *data) ++{ ++ struct find_scope_param *fsp = data; ++ ++ memcpy(fsp->die_mem, fn_die, sizeof(Dwarf_Die)); ++ fsp->found = true; ++ return 1; ++} ++ + /* Find an appropriate scope fits to given conditions */ + static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + { +@@ -778,8 +788,13 @@ static Dwarf_Die *find_best_scope(struct probe_finder *pf, Dwarf_Die *die_mem) + .die_mem = die_mem, + .found = false, + }; ++ int ret; + +- cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, &fsp); ++ ret = cu_walk_functions_at(&pf->cu_die, pf->addr, find_best_scope_cb, ++ &fsp); ++ if (!ret && !fsp.found) ++ cu_walk_functions_at(&pf->cu_die, pf->addr, ++ find_inner_scope_cb, &fsp); + + return fsp.found ? die_mem : NULL; + } +@@ -953,7 +968,7 @@ static int probe_point_inline_cb(Dwarf_Die *in_die, void *data) + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; +@@ -1005,7 +1020,7 @@ static int probe_point_search_cb(Dwarf_Die *sp_die, void *data) + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", +@@ -1417,6 +1432,18 @@ error: + return DIE_FIND_CB_END; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1427,6 +1454,14 @@ static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); +@@ -1570,7 +1605,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1587,7 +1622,7 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. +diff --git a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +index f794d6bbb7e9..3e4ff4a1cdf4 100644 +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_CSTATE_COUNT] = { + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent, |