diff options
| author |   Mike Pagano <mpagano@gentoo.org> | 2023-06-09 07:31:54 -0400 |
|---|---|---|
| committer | Mike Pagano <mpagano@gentoo.org> | 2023-06-09 07:31:54 -0400 |
| commit | 89a54dd6f39d27b5da17f9e45757ef4d01813d15 (patch) | |
| tree | e536564487ad0dd664af1416c5e6e7f9782bfdf2 | |
| parent | Linux patch 5.4.245 (diff) | |
| download | linux-patches-89a54dd6f39d27b5da17f9e45757ef4d01813d15.tar.gz linux-patches-89a54dd6f39d27b5da17f9e45757ef4d01813d15.tar.bz2 linux-patches-89a54dd6f39d27b5da17f9e45757ef4d01813d15.zip | |
Linux patch 5.4.2465.4-253
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1245_linux-5.4.246.patch | 6800 |
2 files changed, 6804 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 780ca5e9..2f4cc252 100644 --- a/0000_README +++ b/0000_README @@ -1023,6 +1023,10 @@ Patch: 1244_linux-5.4.245.patch From: https://www.kernel.org Desc: Linux 5.4.245 +Patch: 1245_linux-5.4.246.patch +From: https://www.kernel.org +Desc: Linux 5.4.246 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1245_linux-5.4.246.patch b/1245_linux-5.4.246.patch new file mode 100644 index 00000000..59d3fc21 --- /dev/null +++ b/1245_linux-5.4.246.patch @@ -0,0 +1,6800 @@ +diff --git a/Makefile b/Makefile +index c0a1daa41dc04..c2358bb2f2110 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 245 ++SUBLEVEL = 246 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +@@ -783,6 +783,10 @@ endif + KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) + + KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) ++ ++# These result in bogus false positives ++KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer) ++ + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + else +diff --git a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi +index 9314128df1859..639a6b65749f2 100644 +--- a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi +@@ -284,6 +284,88 @@ + slew-rate = <2>; + }; + }; ++ ++ can1_pins_a: can1-0 { ++ pins1 { ++ pinmux = <STM32_PINMUX('A', 12, AF9)>; /* CAN1_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('A', 11, AF9)>; /* CAN1_RX */ ++ bias-pull-up; ++ }; ++ }; ++ ++ can1_pins_b: can1-1 { ++ pins1 { ++ pinmux = <STM32_PINMUX('B', 9, AF9)>; /* CAN1_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('B', 8, AF9)>; /* CAN1_RX */ ++ bias-pull-up; ++ }; ++ }; ++ ++ can1_pins_c: can1-2 { ++ pins1 { ++ pinmux = <STM32_PINMUX('D', 1, AF9)>; /* CAN1_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('D', 0, AF9)>; /* CAN1_RX */ ++ bias-pull-up; ++ ++ }; ++ }; ++ ++ can1_pins_d: can1-3 { ++ pins1 { ++ pinmux = <STM32_PINMUX('H', 13, AF9)>; /* CAN1_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('H', 14, AF9)>; /* CAN1_RX */ ++ bias-pull-up; ++ ++ }; ++ }; ++ ++ can2_pins_a: can2-0 { ++ pins1 { ++ pinmux = <STM32_PINMUX('B', 6, AF9)>; /* CAN2_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('B', 5, AF9)>; /* CAN2_RX */ ++ bias-pull-up; ++ }; ++ }; ++ ++ can2_pins_b: can2-1 { ++ pins1 { ++ pinmux = <STM32_PINMUX('B', 13, AF9)>; /* CAN2_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('B', 12, AF9)>; /* CAN2_RX */ ++ bias-pull-up; ++ }; ++ }; ++ ++ can3_pins_a: can3-0 { ++ pins1 { ++ pinmux = <STM32_PINMUX('A', 15, AF11)>; /* CAN3_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('A', 8, AF11)>; /* CAN3_RX */ ++ bias-pull-up; ++ }; ++ }; ++ ++ can3_pins_b: can3-1 { ++ pins1 { ++ pinmux = <STM32_PINMUX('B', 4, AF11)>; /* CAN3_TX */ ++ }; ++ pins2 { ++ pinmux = <STM32_PINMUX('B', 3, AF11)>; /* CAN3_RX */ ++ bias-pull-up; ++ }; ++ }; + }; + }; + }; +diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c +index 4574e6aea0a52..f321c2aa94e1c 100644 +--- a/arch/arm/kernel/unwind.c ++++ b/arch/arm/kernel/unwind.c +@@ -300,6 +300,29 @@ static int unwind_exec_pop_subset_r0_to_r3(struct unwind_ctrl_block *ctrl, + return URC_OK; + } + ++static unsigned long unwind_decode_uleb128(struct unwind_ctrl_block *ctrl) ++{ ++ unsigned long bytes = 0; ++ unsigned long insn; ++ unsigned long result = 0; ++ ++ /* ++ * unwind_get_byte() will advance `ctrl` one instruction at a time, so ++ * loop until we get an instruction byte where bit 7 is not set. ++ * ++ * Note: This decodes a maximum of 4 bytes to output 28 bits data where ++ * max is 0xfffffff: that will cover a vsp increment of 1073742336, hence ++ * it is sufficient for unwinding the stack. ++ */ ++ do { ++ insn = unwind_get_byte(ctrl); ++ result |= (insn & 0x7f) << (bytes * 7); ++ bytes++; ++ } while (!!(insn & 0x80) && (bytes != sizeof(result))); ++ ++ return result; ++} ++ + /* + * Execute the current unwind instruction. + */ +@@ -353,7 +376,7 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl) + if (ret) + goto error; + } else if (insn == 0xb2) { +- unsigned long uleb128 = unwind_get_byte(ctrl); ++ unsigned long uleb128 = unwind_decode_uleb128(ctrl); + + ctrl->vrs[SP] += 0x204 + (uleb128 << 2); + } else { +diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c +index d96a101e55048..2f305c7ce1cbb 100644 +--- a/arch/arm/mach-sa1100/assabet.c ++++ b/arch/arm/mach-sa1100/assabet.c +@@ -653,7 +653,7 @@ static void __init map_sa1100_gpio_regs( void ) + */ + static void __init get_assabet_scr(void) + { +- unsigned long uninitialized_var(scr), i; ++ unsigned long scr, i; + + GPDR |= 0x3fc; /* Configure GPIO 9:2 as outputs */ + GPSR = 0x3fc; /* Write 0xFF to GPIO 9:2 */ +diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c +index 1fc6c4810a5c3..52ff66f004e42 100644 +--- a/arch/arm/mm/alignment.c ++++ b/arch/arm/mm/alignment.c +@@ -799,7 +799,7 @@ static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst) + static int + do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) + { +- union offset_union uninitialized_var(offset); ++ union offset_union offset; + unsigned long instrptr; + int (*handler)(unsigned long addr, u32 instr, struct pt_regs *regs); + unsigned int type; +diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c +index a8e9c98147a19..af9a6e1fa0d3d 100644 +--- a/arch/arm64/mm/fault.c ++++ b/arch/arm64/mm/fault.c +@@ -403,8 +403,8 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re + } + } + +-#define VM_FAULT_BADMAP 0x010000 +-#define VM_FAULT_BADACCESS 0x020000 ++#define VM_FAULT_BADMAP ((__force vm_fault_t)0x010000) ++#define VM_FAULT_BADACCESS ((__force vm_fault_t)0x020000) + + static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr, + unsigned int mm_flags, unsigned long vm_flags) +diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c +index 968b5f33e725e..1a8e20652e7ce 100644 +--- a/arch/ia64/kernel/process.c ++++ b/arch/ia64/kernel/process.c +@@ -444,7 +444,7 @@ static void + do_copy_task_regs (struct task_struct *task, struct unw_frame_info *info, void *arg) + { + unsigned long mask, sp, nat_bits = 0, ar_rnat, urbs_end, cfm; +- unsigned long uninitialized_var(ip); /* GCC be quiet */ ++ unsigned long ip; + elf_greg_t *dst = arg; + struct pt_regs *pt; + char nat; +diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c +index 41d243c0c6267..93789f31c89a7 100644 +--- a/arch/ia64/mm/discontig.c ++++ b/arch/ia64/mm/discontig.c +@@ -180,7 +180,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node) + void __init setup_per_cpu_areas(void) + { + struct pcpu_alloc_info *ai; +- struct pcpu_group_info *uninitialized_var(gi); ++ struct pcpu_group_info *gi; + unsigned int *cpu_map; + void *base; + unsigned long base_offset; +diff --git a/arch/ia64/mm/tlb.c b/arch/ia64/mm/tlb.c +index 72cc568bc8411..71c19918e3875 100644 +--- a/arch/ia64/mm/tlb.c ++++ b/arch/ia64/mm/tlb.c +@@ -369,7 +369,7 @@ EXPORT_SYMBOL(flush_tlb_range); + + void ia64_tlb_init(void) + { +- ia64_ptce_info_t uninitialized_var(ptce_info); /* GCC be quiet */ ++ ia64_ptce_info_t ptce_info; + u64 tr_pgbits; + long status; + pal_vm_info_1_u_t vm_info_1; +diff --git a/arch/mips/lib/dump_tlb.c b/arch/mips/lib/dump_tlb.c +index 83ed37298e66d..0ba6f746485fe 100644 +--- a/arch/mips/lib/dump_tlb.c ++++ b/arch/mips/lib/dump_tlb.c +@@ -80,7 +80,7 @@ static void dump_tlb(int first, int last) + unsigned int pagemask, guestctl1 = 0, c0, c1, i; + unsigned long asidmask = cpu_asid_mask(¤t_cpu_data); + int asidwidth = DIV_ROUND_UP(ilog2(asidmask) + 1, 4); +- unsigned long uninitialized_var(s_mmid); ++ unsigned long s_mmid; + #ifdef CONFIG_32BIT + bool xpa = cpu_has_xpa && (read_c0_pagegrain() & PG_ELPA); + int pwidth = xpa ? 11 : 8; +diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c +index 090fa653dfa9e..a738999335056 100644 +--- a/arch/mips/mm/init.c ++++ b/arch/mips/mm/init.c +@@ -84,7 +84,7 @@ void setup_zero_pages(void) + static void *__kmap_pgprot(struct page *page, unsigned long addr, pgprot_t prot) + { + enum fixed_addresses idx; +- unsigned int uninitialized_var(old_mmid); ++ unsigned int old_mmid; + unsigned long vaddr, flags, entrylo; + unsigned long old_ctx; + pte_t pte; +diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c +index 60046445122b3..b6104d9413e06 100644 +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -120,7 +120,7 @@ void local_flush_tlb_range(struct vm_area_struct *vma, unsigned long start, + if (size <= (current_cpu_data.tlbsizeftlbsets ? + current_cpu_data.tlbsize / 8 : + current_cpu_data.tlbsize / 2)) { +- unsigned long old_entryhi, uninitialized_var(old_mmid); ++ unsigned long old_entryhi, old_mmid; + int newpid = cpu_asid(cpu, mm); + + old_entryhi = read_c0_entryhi(); +@@ -214,7 +214,7 @@ void local_flush_tlb_page(struct vm_area_struct *vma, unsigned long page) + int cpu = smp_processor_id(); + + if (cpu_context(cpu, vma->vm_mm) != 0) { +- unsigned long uninitialized_var(old_mmid); ++ unsigned long old_mmid; + unsigned long flags, old_entryhi; + int idx; + +@@ -381,7 +381,7 @@ void add_wired_entry(unsigned long entrylo0, unsigned long entrylo1, + #ifdef CONFIG_XPA + panic("Broken for XPA kernels"); + #else +- unsigned int uninitialized_var(old_mmid); ++ unsigned int old_mmid; + unsigned long flags; + unsigned long wired; + unsigned long old_pagemask; +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index 9d73448354698..25f1aaf78026d 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c +@@ -31,7 +31,7 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid, + gva_t eaddr, void *to, void *from, + unsigned long n) + { +- int uninitialized_var(old_pid), old_lpid; ++ int old_pid, old_lpid; + unsigned long quadrant, ret = n; + bool is_load = !!to; + +diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c +index fc98912f42cf6..76a8102bdb987 100644 +--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c ++++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c +@@ -340,7 +340,7 @@ static int mpc52xx_irqhost_map(struct irq_domain *h, unsigned int virq, + { + int l1irq; + int l2irq; +- struct irq_chip *uninitialized_var(irqchip); ++ struct irq_chip *irqchip; + void *hndlr; + int type; + u32 reg; +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 8c51462f13fd1..f0237dfad6e38 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -145,7 +145,7 @@ static int pcpu_sigp_retry(struct pcpu *pcpu, u8 order, u32 parm) + + static inline int pcpu_stopped(struct pcpu *pcpu) + { +- u32 uninitialized_var(status); ++ u32 status; + + if (__pcpu_sigp(pcpu->address, SIGP_SENSE, + 0, &status) != SIGP_CC_STATUS_STORED) +diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h +index ca866f1cca2ef..4d79391bb7873 100644 +--- a/arch/x86/boot/boot.h ++++ b/arch/x86/boot/boot.h +@@ -110,66 +110,78 @@ typedef unsigned int addr_t; + + static inline u8 rdfs8(addr_t addr) + { ++ u8 *ptr = (u8 *)absolute_pointer(addr); + u8 v; +- asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); ++ asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*ptr)); + return v; + } + static inline u16 rdfs16(addr_t addr) + { ++ u16 *ptr = (u16 *)absolute_pointer(addr); + u16 v; +- asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr)); ++ asm volatile("movw %%fs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + static inline u32 rdfs32(addr_t addr) + { ++ u32 *ptr = (u32 *)absolute_pointer(addr); + u32 v; +- asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr)); ++ asm volatile("movl %%fs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + + static inline void wrfs8(u8 v, addr_t addr) + { +- asm volatile("movb %1,%%fs:%0" : "+m" (*(u8 *)addr) : "qi" (v)); ++ u8 *ptr = (u8 *)absolute_pointer(addr); ++ asm volatile("movb %1,%%fs:%0" : "+m" (*ptr) : "qi" (v)); + } + static inline void wrfs16(u16 v, addr_t addr) + { +- asm volatile("movw %1,%%fs:%0" : "+m" (*(u16 *)addr) : "ri" (v)); ++ u16 *ptr = (u16 *)absolute_pointer(addr); ++ asm volatile("movw %1,%%fs:%0" : "+m" (*ptr) : "ri" (v)); + } + static inline void wrfs32(u32 v, addr_t addr) + { +- asm volatile("movl %1,%%fs:%0" : "+m" (*(u32 *)addr) : "ri" (v)); ++ u32 *ptr = (u32 *)absolute_pointer(addr); ++ asm volatile("movl %1,%%fs:%0" : "+m" (*ptr) : "ri" (v)); + } + + static inline u8 rdgs8(addr_t addr) + { ++ u8 *ptr = (u8 *)absolute_pointer(addr); + u8 v; +- asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr)); ++ asm volatile("movb %%gs:%1,%0" : "=q" (v) : "m" (*ptr)); + return v; + } + static inline u16 rdgs16(addr_t addr) + { ++ u16 *ptr = (u16 *)absolute_pointer(addr); + u16 v; +- asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*(u16 *)addr)); ++ asm volatile("movw %%gs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + static inline u32 rdgs32(addr_t addr) + { ++ u32 *ptr = (u32 *)absolute_pointer(addr); + u32 v; +- asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*(u32 *)addr)); ++ asm volatile("movl %%gs:%1,%0" : "=r" (v) : "m" (*ptr)); + return v; + } + + static inline void wrgs8(u8 v, addr_t addr) + { +- asm volatile("movb %1,%%gs:%0" : "+m" (*(u8 *)addr) : "qi" (v)); ++ u8 *ptr = (u8 *)absolute_pointer(addr); ++ asm volatile("movb %1,%%gs:%0" : "+m" (*ptr) : "qi" (v)); + } + static inline void wrgs16(u16 v, addr_t addr) + { +- asm volatile("movw %1,%%gs:%0" : "+m" (*(u16 *)addr) : "ri" (v)); ++ u16 *ptr = (u16 *)absolute_pointer(addr); ++ asm volatile("movw %1,%%gs:%0" : "+m" (*ptr) : "ri" (v)); + } + static inline void wrgs32(u32 v, addr_t addr) + { +- asm volatile("movl %1,%%gs:%0" : "+m" (*(u32 *)addr) : "ri" (v)); ++ u32 *ptr = (u32 *)absolute_pointer(addr); ++ asm volatile("movl %1,%%gs:%0" : "+m" (*ptr) : "ri" (v)); + } + + /* Note: these only return true/false, not a signed return value! */ +diff --git a/arch/x86/boot/main.c b/arch/x86/boot/main.c +index e3add857c2c9d..c421af5a3cdce 100644 +--- a/arch/x86/boot/main.c ++++ b/arch/x86/boot/main.c +@@ -33,7 +33,7 @@ static void copy_boot_params(void) + u16 cl_offset; + }; + const struct old_cmdline * const oldcmd = +- (const struct old_cmdline *)OLD_CL_ADDRESS; ++ absolute_pointer(OLD_CL_ADDRESS); + + BUILD_BUG_ON(sizeof(boot_params) != 4096); + memcpy(&boot_params.hdr, &hdr, sizeof(hdr)); +diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c +index 1daf8f2aa21f5..c205f30147cc1 100644 +--- a/arch/x86/kernel/quirks.c ++++ b/arch/x86/kernel/quirks.c +@@ -95,7 +95,7 @@ static void ich_force_hpet_resume(void) + static void ich_force_enable_hpet(struct pci_dev *dev) + { + u32 val; +- u32 uninitialized_var(rcba); ++ u32 rcba; + int err = 0; + + if (hpet_address || force_hpet_address) +@@ -185,7 +185,7 @@ static void hpet_print_force_info(void) + static void old_ich_force_hpet_resume(void) + { + u32 val; +- u32 uninitialized_var(gen_cntl); ++ u32 gen_cntl; + + if (!force_hpet_address || !cached_dev) + return; +@@ -207,7 +207,7 @@ static void old_ich_force_hpet_resume(void) + static void old_ich_force_enable_hpet(struct pci_dev *dev) + { + u32 val; +- u32 uninitialized_var(gen_cntl); ++ u32 gen_cntl; + + if (hpet_address || force_hpet_address) + return; +@@ -298,7 +298,7 @@ static void vt8237_force_hpet_resume(void) + + static void vt8237_force_enable_hpet(struct pci_dev *dev) + { +- u32 uninitialized_var(val); ++ u32 val; + + if (hpet_address || force_hpet_address) + return; +@@ -429,7 +429,7 @@ static void nvidia_force_hpet_resume(void) + + static void nvidia_force_enable_hpet(struct pci_dev *dev) + { +- u32 uninitialized_var(val); ++ u32 val; + + if (hpet_address || force_hpet_address) + return; +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 5219064cd72bb..711fa0fcd2110 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -477,7 +477,7 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio, + struct scatterlist *sglist, + struct scatterlist **sg) + { +- struct bio_vec uninitialized_var(bvec), bvprv = { NULL }; ++ struct bio_vec bvec, bvprv = { NULL }; + struct bvec_iter iter; + int nsegs = 0; + bool new_bio = false; +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c +index c11d736a8db7e..35de23ff50d6d 100644 +--- a/drivers/acpi/acpi_pad.c ++++ b/drivers/acpi/acpi_pad.c +@@ -88,7 +88,7 @@ static void round_robin_cpu(unsigned int tsk_index) + cpumask_var_t tmp; + int cpu; + unsigned long min_weight = -1; +- unsigned long uninitialized_var(preferred_cpu); ++ unsigned long preferred_cpu; + + if (!alloc_cpumask_var(&tmp, GFP_KERNEL)) + return; +diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c +index 383c7029d3cee..e9c16b7ddd8b0 100644 +--- a/drivers/acpi/thermal.c ++++ b/drivers/acpi/thermal.c +@@ -1153,8 +1153,6 @@ static int acpi_thermal_resume(struct device *dev) + return -EINVAL; + + for (i = 0; i < ACPI_THERMAL_MAX_ACTIVE; i++) { +- if (!(&tz->trips.active[i])) +- break; + if (!tz->trips.active[i].flags.valid) + break; + tz->trips.active[i].flags.enabled = 1; +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 2b247014ba452..42309ceee21e9 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -162,7 +162,7 @@ static ssize_t ata_scsi_park_show(struct device *device, + struct ata_link *link; + struct ata_device *dev; + unsigned long now; +- unsigned int uninitialized_var(msecs); ++ unsigned int msecs; + int rc = 0; + + ap = ata_shost_to_port(sdev->host); +@@ -3036,18 +3036,36 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc) + return 0; + } + +-static struct ata_device *ata_find_dev(struct ata_port *ap, int devno) ++static struct ata_device *ata_find_dev(struct ata_port *ap, unsigned int devno) + { +- if (!sata_pmp_attached(ap)) { +- if (likely(devno >= 0 && +- devno < ata_link_max_devices(&ap->link))) ++ /* ++ * For the non-PMP case, ata_link_max_devices() returns 1 (SATA case), ++ * or 2 (IDE master + slave case). However, the former case includes ++ * libsas hosted devices which are numbered per scsi host, leading ++ * to devno potentially being larger than 0 but with each struct ++ * ata_device having its own struct ata_port and struct ata_link. ++ * To accommodate these, ignore devno and always use device number 0. ++ */ ++ if (likely(!sata_pmp_attached(ap))) { ++ int link_max_devices = ata_link_max_devices(&ap->link); ++ ++ if (link_max_devices == 1) ++ return &ap->link.device[0]; ++ ++ if (devno < link_max_devices) + return &ap->link.device[devno]; +- } else { +- if (likely(devno >= 0 && +- devno < ap->nr_pmp_links)) +- return &ap->pmp_link[devno].device[0]; ++ ++ return NULL; + } + ++ /* ++ * For PMP-attached devices, the device number corresponds to C ++ * (channel) of SCSI [H:C:I:L], indicating the port pmp link ++ * for the device. ++ */ ++ if (devno < ap->nr_pmp_links) ++ return &ap->pmp_link[devno].device[0]; ++ + return NULL; + } + +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c +index 57f97b95a4531..165eebe06e39e 100644 +--- a/drivers/atm/zatm.c ++++ b/drivers/atm/zatm.c +@@ -940,7 +940,7 @@ static int open_tx_first(struct atm_vcc *vcc) + vcc->qos.txtp.max_pcr >= ATM_OC3_PCR); + if (unlimited && zatm_dev->ubr != -1) zatm_vcc->shaper = zatm_dev->ubr; + else { +- int uninitialized_var(pcr); ++ int pcr; + + if (unlimited) vcc->qos.txtp.max_sdu = ATM_MAX_AAL5_PDU; + if ((zatm_vcc->shaper = alloc_shaper(vcc->dev,&pcr, +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 43c0452a8ba91..a69e9797fba21 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1850,6 +1850,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg, + size_t val_count = val_len / val_bytes; + size_t chunk_count, chunk_bytes; + size_t chunk_regs = val_count; ++ size_t max_data = map->max_raw_write - map->format.reg_bytes - ++ map->format.pad_bytes; + int ret, i; + + if (!val_count) +@@ -1857,8 +1859,8 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg, + + if (map->use_single_write) + chunk_regs = 1; +- else if (map->max_raw_write && val_len > map->max_raw_write) +- chunk_regs = map->max_raw_write / val_bytes; ++ else if (map->max_raw_write && val_len > max_data) ++ chunk_regs = max_data / val_bytes; + + chunk_count = val_count / chunk_regs; + chunk_bytes = chunk_regs * val_bytes; +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 52dd517ff5419..43c142ea364b0 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -3426,7 +3426,7 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb) + { + struct nlattr *resource_filter; + struct drbd_resource *resource; +- struct drbd_device *uninitialized_var(device); ++ struct drbd_device *device; + int minor, err, retcode; + struct drbd_genlmsghdr *dh; + struct device_info device_info; +@@ -3515,7 +3515,7 @@ int drbd_adm_dump_connections(struct sk_buff *skb, struct netlink_callback *cb) + { + struct nlattr *resource_filter; + struct drbd_resource *resource = NULL, *next_resource; +- struct drbd_connection *uninitialized_var(connection); ++ struct drbd_connection *connection; + int err = 0, retcode; + struct drbd_genlmsghdr *dh; + struct connection_info connection_info; +@@ -3677,7 +3677,7 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb) + { + struct nlattr *resource_filter; + struct drbd_resource *resource; +- struct drbd_device *uninitialized_var(device); ++ struct drbd_device *device; + struct drbd_peer_device *peer_device = NULL; + int minor, err, retcode; + struct drbd_genlmsghdr *dh; +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 610dc6a36a9de..218aa7e419700 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1609,7 +1609,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd) + return -EIO; + + dir = debugfs_create_dir(nbd_name(nbd), nbd_dbg_dir); +- if (!dir) { ++ if (IS_ERR(dir)) { + dev_err(nbd_to_dev(nbd), "Failed to create debugfs dir for '%s'\n", + nbd_name(nbd)); + return -EIO; +@@ -1635,7 +1635,7 @@ static int nbd_dbg_init(void) + struct dentry *dbg_dir; + + dbg_dir = debugfs_create_dir("nbd", NULL); +- if (!dbg_dir) ++ if (IS_ERR(dbg_dir)) + return -EIO; + + nbd_dbg_dir = dbg_dir; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 0c74daf6e2c9e..8517a231bf5aa 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -2087,7 +2087,7 @@ static int rbd_object_map_update_finish(struct rbd_obj_request *obj_req, + struct rbd_device *rbd_dev = obj_req->img_request->rbd_dev; + struct ceph_osd_data *osd_data; + u64 objno; +- u8 state, new_state, uninitialized_var(current_state); ++ u8 state, new_state, current_state; + bool has_current_state; + void *p; + +diff --git a/drivers/clk/clk-gate.c b/drivers/clk/clk-gate.c +index 1b99fc9627451..289fc4d959ab1 100644 +--- a/drivers/clk/clk-gate.c ++++ b/drivers/clk/clk-gate.c +@@ -56,7 +56,7 @@ static void clk_gate_endisable(struct clk_hw *hw, int enable) + { + struct clk_gate *gate = to_clk_gate(hw); + int set = gate->flags & CLK_GATE_SET_TO_DISABLE ? 1 : 0; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + u32 reg; + + set ^= enable; +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 77a6495bb6b19..3008ab258fa8e 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -1048,7 +1048,7 @@ static bool _trigger(struct pl330_thread *thrd) + return true; + } + +-static bool _start(struct pl330_thread *thrd) ++static bool pl330_start_thread(struct pl330_thread *thrd) + { + switch (_state(thrd)) { + case PL330_STATE_FAULT_COMPLETING: +@@ -1696,7 +1696,7 @@ static int pl330_update(struct pl330_dmac *pl330) + thrd->req_running = -1; + + /* Get going again ASAP */ +- _start(thrd); ++ pl330_start_thread(thrd); + + /* For now, just make a list of callbacks to be done */ + list_add_tail(&descdone->rqd, &pl330->req_done); +@@ -2083,7 +2083,7 @@ static void pl330_tasklet(unsigned long data) + } else { + /* Make sure the PL330 Channel thread is active */ + spin_lock(&pch->thread->dmac->lock); +- _start(pch->thread); ++ pl330_start_thread(pch->thread); + spin_unlock(&pch->thread->dmac->lock); + } + +@@ -2101,7 +2101,7 @@ static void pl330_tasklet(unsigned long data) + if (power_down) { + pch->active = true; + spin_lock(&pch->thread->dmac->lock); +- _start(pch->thread); ++ pl330_start_thread(pch->thread); + spin_unlock(&pch->thread->dmac->lock); + power_down = false; + } +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c +index 522f3addb5bd7..e1fa832f9fd72 100644 +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -1099,7 +1099,7 @@ static void context_tasklet(unsigned long data) + static int context_add_buffer(struct context *ctx) + { + struct descriptor_buffer *desc; +- dma_addr_t uninitialized_var(bus_addr); ++ dma_addr_t bus_addr; + int offset; + + /* +@@ -1289,7 +1289,7 @@ static int at_context_queue_packet(struct context *ctx, + struct fw_packet *packet) + { + struct fw_ohci *ohci = ctx->ohci; +- dma_addr_t d_bus, uninitialized_var(payload_bus); ++ dma_addr_t d_bus, payload_bus; + struct driver_data *driver_data; + struct descriptor *d, *last; + __le32 *header; +@@ -2445,7 +2445,7 @@ static int ohci_set_config_rom(struct fw_card *card, + { + struct fw_ohci *ohci; + __be32 *next_config_rom; +- dma_addr_t uninitialized_var(next_config_rom_bus); ++ dma_addr_t next_config_rom_bus; + + ohci = fw_ohci(card); + +@@ -2933,10 +2933,10 @@ static struct fw_iso_context *ohci_allocate_iso_context(struct fw_card *card, + int type, int channel, size_t header_size) + { + struct fw_ohci *ohci = fw_ohci(card); +- struct iso_context *uninitialized_var(ctx); +- descriptor_callback_t uninitialized_var(callback); +- u64 *uninitialized_var(channels); +- u32 *uninitialized_var(mask), uninitialized_var(regs); ++ struct iso_context *ctx; ++ descriptor_callback_t callback; ++ u64 *channels; ++ u32 *mask, regs; + int index, ret = -EBUSY; + + spin_lock_irq(&ohci->lock); +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 970bc00d2aaf6..a3fc8dd507a7c 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -985,7 +985,7 @@ static void sii8620_set_auto_zone(struct sii8620 *ctx) + + static void sii8620_stop_video(struct sii8620 *ctx) + { +- u8 uninitialized_var(val); ++ u8 val; + + sii8620_write_seq_static(ctx, + REG_TPI_INTR_EN, 0, +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 2dc6dd6230d76..7b27fe16bcbbd 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -2771,7 +2771,7 @@ static int drm_cvt_modes(struct drm_connector *connector, + const u8 empty[3] = { 0, 0, 0 }; + + for (i = 0; i < 4; i++) { +- int uninitialized_var(width), height; ++ int width, height; + cvt = &(timing->data.other_data.data.cvt[i]); + + if (!memcmp(cvt->code, empty, 3)) +@@ -2779,6 +2779,8 @@ static int drm_cvt_modes(struct drm_connector *connector, + + height = (cvt->code[0] + ((cvt->code[1] & 0xf0) << 4) + 1) * 2; + switch (cvt->code[1] & 0x0c) { ++ /* default - because compiler doesn't see that we've enumerated all cases */ ++ default: + case 0x00: + width = height * 4 / 3; + break; +diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +index bfcbb89ff40a4..04220a51d8393 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c +@@ -544,9 +544,9 @@ static unsigned long exynos_dsi_pll_find_pms(struct exynos_dsi *dsi, + unsigned long best_freq = 0; + u32 min_delta = 0xffffffff; + u8 p_min, p_max; +- u8 _p, uninitialized_var(best_p); +- u16 _m, uninitialized_var(best_m); +- u8 _s, uninitialized_var(best_s); ++ u8 _p, best_p; ++ u16 _m, best_m; ++ u8 _s, best_s; + + p_min = DIV_ROUND_UP(fin, (12 * MHZ)); + p_max = fin / (6 * MHZ); +diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c +index 398068b173891..d8b40cc091da7 100644 +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -475,7 +475,7 @@ static struct i915_request * + __unwind_incomplete_requests(struct intel_engine_cs *engine) + { + struct i915_request *rq, *rn, *active = NULL; +- struct list_head *uninitialized_var(pl); ++ struct list_head *pl; + int prio = I915_PRIORITY_INVALID; + + lockdep_assert_held(&engine->active.lock); +diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c +index 62f8a47fda456..dae6b33fc4c4a 100644 +--- a/drivers/gpu/drm/i915/intel_uncore.c ++++ b/drivers/gpu/drm/i915/intel_uncore.c +@@ -1926,7 +1926,7 @@ int __intel_wait_for_register_fw(struct intel_uncore *uncore, + unsigned int slow_timeout_ms, + u32 *out_value) + { +- u32 uninitialized_var(reg_value); ++ u32 reg_value; + #define done (((reg_value = intel_uncore_read_fw(uncore, reg)) & mask) == value) + int ret; + +diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +index 8e2f8410b0ddc..2dfaa9b73c28f 100644 +--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c ++++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +@@ -481,8 +481,8 @@ dw_mipi_dsi_get_lane_mbps(void *priv_data, const struct drm_display_mode *mode, + unsigned long best_freq = 0; + unsigned long fvco_min, fvco_max, fin, fout; + unsigned int min_prediv, max_prediv; +- unsigned int _prediv, uninitialized_var(best_prediv); +- unsigned long _fbdiv, uninitialized_var(best_fbdiv); ++ unsigned int _prediv, best_prediv; ++ unsigned long _fbdiv, best_fbdiv; + unsigned long min_delta = ULONG_MAX; + + dsi->format = format; +diff --git a/drivers/hid/hid-google-hammer.c b/drivers/hid/hid-google-hammer.c +index b6947d7573473..2ebad3ed4e3af 100644 +--- a/drivers/hid/hid-google-hammer.c ++++ b/drivers/hid/hid-google-hammer.c +@@ -473,6 +473,8 @@ static const struct hid_device_id hammer_devices[] = { + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_EEL) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) }, ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_JEWEL) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b883423a89c5d..479516bbb61bf 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -490,6 +490,7 @@ + #define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044 + #define USB_DEVICE_ID_GOOGLE_DON 0x5050 + #define USB_DEVICE_ID_GOOGLE_EEL 0x5057 ++#define USB_DEVICE_ID_GOOGLE_JEWEL 0x5061 + + #define USB_VENDOR_ID_GOTOP 0x08f2 + #define USB_DEVICE_ID_SUPER_Q2 0x007f +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 099f7cccc3a7a..75761939f02bd 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -831,7 +831,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom) + /* Enter report */ + if ((data[1] & 0xfc) == 0xc0) { + /* serial number of the tool */ +- wacom->serial[idx] = ((data[3] & 0x0f) << 28) + ++ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) + + (data[4] << 20) + (data[5] << 12) + + (data[6] << 4) + (data[7] >> 4); + +diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c +index ac3ae14a4c079..74dd378446c13 100644 +--- a/drivers/i2c/busses/i2c-rk3x.c ++++ b/drivers/i2c/busses/i2c-rk3x.c +@@ -418,7 +418,7 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, unsigned int ipd) + { + unsigned int i; + unsigned int len = i2c->msg->len - i2c->processed; +- u32 uninitialized_var(val); ++ u32 val; + u8 byte; + + /* we only care for MBRF here. */ +diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c +index 7d4e5c08f133e..05e18d6581416 100644 +--- a/drivers/ide/ide-acpi.c ++++ b/drivers/ide/ide-acpi.c +@@ -180,7 +180,7 @@ err: + static acpi_handle ide_acpi_hwif_get_handle(ide_hwif_t *hwif) + { + struct device *dev = hwif->gendev.parent; +- acpi_handle uninitialized_var(dev_handle); ++ acpi_handle dev_handle; + u64 pcidevfn; + acpi_handle chan_handle; + int err; +diff --git a/drivers/ide/ide-atapi.c b/drivers/ide/ide-atapi.c +index 775fd34132abb..013ad33fbbc81 100644 +--- a/drivers/ide/ide-atapi.c ++++ b/drivers/ide/ide-atapi.c +@@ -608,7 +608,7 @@ static int ide_delayed_transfer_pc(ide_drive_t *drive) + + static ide_startstop_t ide_transfer_pc(ide_drive_t *drive) + { +- struct ide_atapi_pc *uninitialized_var(pc); ++ struct ide_atapi_pc *pc; + ide_hwif_t *hwif = drive->hwif; + struct request *rq = hwif->rq; + ide_expiry_t *expiry; +diff --git a/drivers/ide/ide-io-std.c b/drivers/ide/ide-io-std.c +index 18c20a7aa0ceb..94bdcf1ea186c 100644 +--- a/drivers/ide/ide-io-std.c ++++ b/drivers/ide/ide-io-std.c +@@ -173,7 +173,7 @@ void ide_input_data(ide_drive_t *drive, struct ide_cmd *cmd, void *buf, + u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0; + + if (io_32bit) { +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + + if ((io_32bit & 2) && !mmio) { + local_irq_save(flags); +@@ -217,7 +217,7 @@ void ide_output_data(ide_drive_t *drive, struct ide_cmd *cmd, void *buf, + u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0; + + if (io_32bit) { +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + + if ((io_32bit & 2) && !mmio) { + local_irq_save(flags); +diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c +index b32a013d827a0..fefe95079e957 100644 +--- a/drivers/ide/ide-io.c ++++ b/drivers/ide/ide-io.c +@@ -614,12 +614,12 @@ static int drive_is_ready(ide_drive_t *drive) + void ide_timer_expiry (struct timer_list *t) + { + ide_hwif_t *hwif = from_timer(hwif, t, timer); +- ide_drive_t *uninitialized_var(drive); ++ ide_drive_t *drive; + ide_handler_t *handler; + unsigned long flags; + int wait = -1; + int plug_device = 0; +- struct request *uninitialized_var(rq_in_flight); ++ struct request *rq_in_flight; + + spin_lock_irqsave(&hwif->lock, flags); + +@@ -772,13 +772,13 @@ irqreturn_t ide_intr (int irq, void *dev_id) + { + ide_hwif_t *hwif = (ide_hwif_t *)dev_id; + struct ide_host *host = hwif->host; +- ide_drive_t *uninitialized_var(drive); ++ ide_drive_t *drive; + ide_handler_t *handler; + unsigned long flags; + ide_startstop_t startstop; + irqreturn_t irq_ret = IRQ_NONE; + int plug_device = 0; +- struct request *uninitialized_var(rq_in_flight); ++ struct request *rq_in_flight; + + if (host->host_flags & IDE_HFLAG_SERIALIZE) { + if (hwif != host->cur_port) +diff --git a/drivers/ide/ide-sysfs.c b/drivers/ide/ide-sysfs.c +index b9dfeb2e8bd66..c08a8a0916e22 100644 +--- a/drivers/ide/ide-sysfs.c ++++ b/drivers/ide/ide-sysfs.c +@@ -131,7 +131,7 @@ static struct device_attribute *ide_port_attrs[] = { + + int ide_sysfs_register_port(ide_hwif_t *hwif) + { +- int i, uninitialized_var(rc); ++ int i, rc; + + for (i = 0; ide_port_attrs[i]; i++) { + rc = device_create_file(hwif->portdev, ide_port_attrs[i]); +diff --git a/drivers/ide/umc8672.c b/drivers/ide/umc8672.c +index 870e235e30af9..cf996f7882927 100644 +--- a/drivers/ide/umc8672.c ++++ b/drivers/ide/umc8672.c +@@ -108,7 +108,7 @@ static void umc_set_speeds(u8 speeds[]) + static void umc_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive) + { + ide_hwif_t *mate = hwif->mate; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + const u8 pio = drive->pio_mode - XFER_PIO_0; + + printk("%s: setting umc8672 to PIO mode%d (speed %d)\n", +diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c +index 01f85bbe6a2e5..e681adaedcf61 100644 +--- a/drivers/iio/adc/mxs-lradc-adc.c ++++ b/drivers/iio/adc/mxs-lradc-adc.c +@@ -760,13 +760,13 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev) + + ret = mxs_lradc_adc_trigger_init(iio); + if (ret) +- goto err_trig; ++ return ret; + + ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time, + &mxs_lradc_adc_trigger_handler, + &mxs_lradc_adc_buffer_ops); + if (ret) +- return ret; ++ goto err_trig; + + adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc]; + +@@ -804,9 +804,9 @@ static int mxs_lradc_adc_probe(struct platform_device *pdev) + + err_dev: + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); +-err_trig: + iio_triggered_buffer_cleanup(iio); ++err_trig: ++ mxs_lradc_adc_trigger_remove(iio); + return ret; + } + +@@ -817,8 +817,8 @@ static int mxs_lradc_adc_remove(struct platform_device *pdev) + + iio_device_unregister(iio); + mxs_lradc_adc_hw_stop(adc); +- mxs_lradc_adc_trigger_remove(iio); + iio_triggered_buffer_cleanup(iio); ++ mxs_lradc_adc_trigger_remove(iio); + + return 0; + } +diff --git a/drivers/iio/dac/Makefile b/drivers/iio/dac/Makefile +index 1369fa1d2f0ee..cd5c30d03d48e 100644 +--- a/drivers/iio/dac/Makefile ++++ b/drivers/iio/dac/Makefile +@@ -16,7 +16,7 @@ obj-$(CONFIG_AD5592R_BASE) += ad5592r-base.o + obj-$(CONFIG_AD5592R) += ad5592r.o + obj-$(CONFIG_AD5593R) += ad5593r.o + obj-$(CONFIG_AD5755) += ad5755.o +-obj-$(CONFIG_AD5755) += ad5758.o ++obj-$(CONFIG_AD5758) += ad5758.o + obj-$(CONFIG_AD5761) += ad5761.o + obj-$(CONFIG_AD5764) += ad5764.o + obj-$(CONFIG_AD5791) += ad5791.o +diff --git a/drivers/iio/dac/mcp4725.c b/drivers/iio/dac/mcp4725.c +index ed455e801e80c..4ed7e90d37f96 100644 +--- a/drivers/iio/dac/mcp4725.c ++++ b/drivers/iio/dac/mcp4725.c +@@ -47,12 +47,18 @@ static int __maybe_unused mcp4725_suspend(struct device *dev) + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + outbuf[0] = (data->powerdown_mode + 1) << 4; + outbuf[1] = 0; + data->powerdown = true; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + + static int __maybe_unused mcp4725_resume(struct device *dev) +@@ -60,13 +66,19 @@ static int __maybe_unused mcp4725_resume(struct device *dev) + struct mcp4725_data *data = iio_priv(i2c_get_clientdata( + to_i2c_client(dev))); + u8 outbuf[2]; ++ int ret; + + /* restore previous DAC value */ + outbuf[0] = (data->dac_value >> 8) & 0xf; + outbuf[1] = data->dac_value & 0xff; + data->powerdown = false; + +- return i2c_master_send(data->client, outbuf, 2); ++ ret = i2c_master_send(data->client, outbuf, 2); ++ if (ret < 0) ++ return ret; ++ else if (ret != 2) ++ return -EIO; ++ return 0; + } + static SIMPLE_DEV_PM_OPS(mcp4725_pm_ops, mcp4725_suspend, mcp4725_resume); + +diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c +index 234623ab38177..6c83f9e54e2ee 100644 +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -8,6 +8,7 @@ + * TODO: Proximity + */ + #include <linux/bitops.h> ++#include <linux/bitfield.h> + #include <linux/i2c.h> + #include <linux/module.h> + #include <linux/pm_runtime.h> +@@ -42,6 +43,7 @@ + #define VCNL4035_ALS_PERS_MASK GENMASK(3, 2) + #define VCNL4035_INT_ALS_IF_H_MASK BIT(12) + #define VCNL4035_INT_ALS_IF_L_MASK BIT(13) ++#define VCNL4035_DEV_ID_MASK GENMASK(7, 0) + + /* Default values */ + #define VCNL4035_MODE_ALS_ENABLE BIT(0) +@@ -415,6 +417,7 @@ static int vcnl4035_init(struct vcnl4035_data *data) + return ret; + } + ++ id = FIELD_GET(VCNL4035_DEV_ID_MASK, id); + if (id != VCNL4035_DEV_ID_VAL) { + dev_err(&data->client->dev, "Wrong id, got %x, expected %x\n", + id, VCNL4035_DEV_ID_VAL); +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 39cbb853f9134..cafdb315aac83 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -1557,7 +1557,7 @@ static int ib_uverbs_open_qp(struct uverbs_attr_bundle *attrs) + struct ib_uverbs_create_qp_resp resp; + struct ib_uqp_object *obj; + struct ib_xrcd *xrcd; +- struct ib_uobject *uninitialized_var(xrcd_uobj); ++ struct ib_uobject *xrcd_uobj; + struct ib_qp *qp; + struct ib_qp_open_attr attr; + int ret; +@@ -3378,7 +3378,7 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs, + struct ib_usrq_object *obj; + struct ib_pd *pd; + struct ib_srq *srq; +- struct ib_uobject *uninitialized_var(xrcd_uobj); ++ struct ib_uobject *xrcd_uobj; + struct ib_srq_init_attr attr; + int ret; + struct ib_device *ib_dev; +diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h +index e55a1666c0cd6..c2805384e832f 100644 +--- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h ++++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h +@@ -104,10 +104,19 @@ struct bnxt_re_sqp_entries { + struct bnxt_re_qp *qp1_qp; + }; + ++#define BNXT_RE_MAX_GSI_SQP_ENTRIES 1024 ++struct bnxt_re_gsi_context { ++ struct bnxt_re_qp *gsi_qp; ++ struct bnxt_re_qp *gsi_sqp; ++ struct bnxt_re_ah *gsi_sah; ++ struct bnxt_re_sqp_entries *sqp_tbl; ++}; ++ + #define BNXT_RE_MIN_MSIX 2 + #define BNXT_RE_MAX_MSIX 9 + #define BNXT_RE_AEQ_IDX 0 + #define BNXT_RE_NQ_IDX 1 ++#define BNXT_RE_GEN_P5_MAX_VF 64 + + struct bnxt_re_dev { + struct ib_device ibdev; +@@ -164,10 +173,7 @@ struct bnxt_re_dev { + u16 cosq[2]; + + /* QP for for handling QP1 packets */ +- u32 sqp_id; +- struct bnxt_re_qp *qp1_sqp; +- struct bnxt_re_ah *sqp_ah; +- struct bnxt_re_sqp_entries sqp_tbl[1024]; ++ struct bnxt_re_gsi_context gsi_ctx; + atomic_t nq_alloc_cnt; + u32 is_virtfn; + u32 num_vfs; +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index dd006b177b544..183f1c3c1f5ef 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -330,7 +330,7 @@ int bnxt_re_del_gid(const struct ib_gid_attr *attr, void **context) + */ + if (ctx->idx == 0 && + rdma_link_local_addr((struct in6_addr *)gid_to_del) && +- ctx->refcnt == 1 && rdev->qp1_sqp) { ++ ctx->refcnt == 1 && rdev->gsi_ctx.gsi_sqp) { + dev_dbg(rdev_to_dev(rdev), + "Trying to delete GID0 while QP1 is alive\n"); + return -EFAULT; +@@ -760,6 +760,49 @@ void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp, + spin_unlock_irqrestore(&qp->scq->cq_lock, flags); + } + ++static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp) ++{ ++ struct bnxt_re_qp *gsi_sqp; ++ struct bnxt_re_ah *gsi_sah; ++ struct bnxt_re_dev *rdev; ++ int rc = 0; ++ ++ rdev = qp->rdev; ++ gsi_sqp = rdev->gsi_ctx.gsi_sqp; ++ gsi_sah = rdev->gsi_ctx.gsi_sah; ++ ++ dev_dbg(rdev_to_dev(rdev), "Destroy the shadow AH\n"); ++ bnxt_qplib_destroy_ah(&rdev->qplib_res, ++ &gsi_sah->qplib_ah, ++ true); ++ bnxt_qplib_clean_qp(&qp->qplib_qp); ++ ++ dev_dbg(rdev_to_dev(rdev), "Destroy the shadow QP\n"); ++ rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &gsi_sqp->qplib_qp); ++ if (rc) { ++ dev_err(rdev_to_dev(rdev), "Destroy Shadow QP failed"); ++ goto fail; ++ } ++ bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp); ++ ++ /* remove from active qp list */ ++ mutex_lock(&rdev->qp_lock); ++ list_del(&gsi_sqp->list); ++ mutex_unlock(&rdev->qp_lock); ++ atomic_dec(&rdev->qp_count); ++ ++ kfree(rdev->gsi_ctx.sqp_tbl); ++ kfree(gsi_sah); ++ kfree(gsi_sqp); ++ rdev->gsi_ctx.gsi_sqp = NULL; ++ rdev->gsi_ctx.gsi_sah = NULL; ++ rdev->gsi_ctx.sqp_tbl = NULL; ++ ++ return 0; ++fail: ++ return rc; ++} ++ + /* Queue Pairs */ + int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) + { +@@ -769,6 +812,7 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) + int rc; + + bnxt_qplib_flush_cqn_wq(&qp->qplib_qp); ++ + rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp); + if (rc) { + dev_err(rdev_to_dev(rdev), "Failed to destroy HW QP"); +@@ -783,40 +827,24 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) + + bnxt_qplib_free_qp_res(&rdev->qplib_res, &qp->qplib_qp); + +- if (ib_qp->qp_type == IB_QPT_GSI && rdev->qp1_sqp) { +- bnxt_qplib_destroy_ah(&rdev->qplib_res, &rdev->sqp_ah->qplib_ah, +- false); +- +- bnxt_qplib_clean_qp(&qp->qplib_qp); +- rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, +- &rdev->qp1_sqp->qplib_qp); +- if (rc) { +- dev_err(rdev_to_dev(rdev), +- "Failed to destroy Shadow QP"); +- return rc; +- } +- bnxt_qplib_free_qp_res(&rdev->qplib_res, +- &rdev->qp1_sqp->qplib_qp); +- mutex_lock(&rdev->qp_lock); +- list_del(&rdev->qp1_sqp->list); +- atomic_dec(&rdev->qp_count); +- mutex_unlock(&rdev->qp_lock); +- +- kfree(rdev->sqp_ah); +- kfree(rdev->qp1_sqp); +- rdev->qp1_sqp = NULL; +- rdev->sqp_ah = NULL; ++ if (ib_qp->qp_type == IB_QPT_GSI && rdev->gsi_ctx.gsi_sqp) { ++ rc = bnxt_re_destroy_gsi_sqp(qp); ++ if (rc) ++ goto sh_fail; + } + +- ib_umem_release(qp->rumem); +- ib_umem_release(qp->sumem); +- + mutex_lock(&rdev->qp_lock); + list_del(&qp->list); +- atomic_dec(&rdev->qp_count); + mutex_unlock(&rdev->qp_lock); ++ atomic_dec(&rdev->qp_count); ++ ++ ib_umem_release(qp->rumem); ++ ib_umem_release(qp->sumem); ++ + kfree(qp); + return 0; ++sh_fail: ++ return rc; + } + + static u8 __from_ib_qp_type(enum ib_qp_type type) +@@ -984,8 +1012,6 @@ static struct bnxt_re_qp *bnxt_re_create_shadow_qp + if (rc) + goto fail; + +- rdev->sqp_id = qp->qplib_qp.id; +- + spin_lock_init(&qp->sq_lock); + INIT_LIST_HEAD(&qp->list); + mutex_lock(&rdev->qp_lock); +@@ -998,205 +1024,375 @@ fail: + return NULL; + } + +-struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd, +- struct ib_qp_init_attr *qp_init_attr, +- struct ib_udata *udata) ++static int bnxt_re_init_rq_attr(struct bnxt_re_qp *qp, ++ struct ib_qp_init_attr *init_attr) + { +- struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd); +- struct bnxt_re_dev *rdev = pd->rdev; +- struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr; +- struct bnxt_re_qp *qp; +- struct bnxt_re_cq *cq; +- struct bnxt_re_srq *srq; +- int rc, entries; ++ struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_qplib_qp *qplqp; ++ struct bnxt_re_dev *rdev; ++ int entries; + +- if ((qp_init_attr->cap.max_send_wr > dev_attr->max_qp_wqes) || +- (qp_init_attr->cap.max_recv_wr > dev_attr->max_qp_wqes) || +- (qp_init_attr->cap.max_send_sge > dev_attr->max_qp_sges) || +- (qp_init_attr->cap.max_recv_sge > dev_attr->max_qp_sges) || +- (qp_init_attr->cap.max_inline_data > dev_attr->max_inline_data)) +- return ERR_PTR(-EINVAL); ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; ++ dev_attr = &rdev->dev_attr; + +- qp = kzalloc(sizeof(*qp), GFP_KERNEL); +- if (!qp) +- return ERR_PTR(-ENOMEM); ++ if (init_attr->srq) { ++ struct bnxt_re_srq *srq; + +- qp->rdev = rdev; +- ether_addr_copy(qp->qplib_qp.smac, rdev->netdev->dev_addr); +- qp->qplib_qp.pd = &pd->qplib_pd; +- qp->qplib_qp.qp_handle = (u64)(unsigned long)(&qp->qplib_qp); +- qp->qplib_qp.type = __from_ib_qp_type(qp_init_attr->qp_type); ++ srq = container_of(init_attr->srq, struct bnxt_re_srq, ib_srq); ++ if (!srq) { ++ dev_err(rdev_to_dev(rdev), "SRQ not found"); ++ return -EINVAL; ++ } ++ qplqp->srq = &srq->qplib_srq; ++ qplqp->rq.max_wqe = 0; ++ } else { ++ /* Allocate 1 more than what's provided so posting max doesn't ++ * mean empty. ++ */ ++ entries = roundup_pow_of_two(init_attr->cap.max_recv_wr + 1); ++ qplqp->rq.max_wqe = min_t(u32, entries, ++ dev_attr->max_qp_wqes + 1); + +- if (qp_init_attr->qp_type == IB_QPT_GSI && +- bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx)) +- qp->qplib_qp.type = CMDQ_CREATE_QP_TYPE_GSI; +- if (qp->qplib_qp.type == IB_QPT_MAX) { ++ qplqp->rq.q_full_delta = qplqp->rq.max_wqe - ++ init_attr->cap.max_recv_wr; ++ qplqp->rq.max_sge = init_attr->cap.max_recv_sge; ++ if (qplqp->rq.max_sge > dev_attr->max_qp_sges) ++ qplqp->rq.max_sge = dev_attr->max_qp_sges; ++ } ++ ++ return 0; ++} ++ ++static void bnxt_re_adjust_gsi_rq_attr(struct bnxt_re_qp *qp) ++{ ++ struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_qplib_qp *qplqp; ++ struct bnxt_re_dev *rdev; ++ ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; ++ dev_attr = &rdev->dev_attr; ++ ++ qplqp->rq.max_sge = dev_attr->max_qp_sges; ++ if (qplqp->rq.max_sge > dev_attr->max_qp_sges) ++ qplqp->rq.max_sge = dev_attr->max_qp_sges; ++} ++ ++static void bnxt_re_init_sq_attr(struct bnxt_re_qp *qp, ++ struct ib_qp_init_attr *init_attr, ++ struct ib_udata *udata) ++{ ++ struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_qplib_qp *qplqp; ++ struct bnxt_re_dev *rdev; ++ int entries; ++ ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; ++ dev_attr = &rdev->dev_attr; ++ ++ qplqp->sq.max_sge = init_attr->cap.max_send_sge; ++ if (qplqp->sq.max_sge > dev_attr->max_qp_sges) ++ qplqp->sq.max_sge = dev_attr->max_qp_sges; ++ /* ++ * Change the SQ depth if user has requested minimum using ++ * configfs. Only supported for kernel consumers ++ */ ++ entries = init_attr->cap.max_send_wr; ++ /* Allocate 128 + 1 more than what's provided */ ++ entries = roundup_pow_of_two(entries + BNXT_QPLIB_RESERVED_QP_WRS + 1); ++ qplqp->sq.max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + ++ BNXT_QPLIB_RESERVED_QP_WRS + 1); ++ qplqp->sq.q_full_delta = BNXT_QPLIB_RESERVED_QP_WRS + 1; ++ /* ++ * Reserving one slot for Phantom WQE. Application can ++ * post one extra entry in this case. But allowing this to avoid ++ * unexpected Queue full condition ++ */ ++ qplqp->sq.q_full_delta -= 1; ++} ++ ++static void bnxt_re_adjust_gsi_sq_attr(struct bnxt_re_qp *qp, ++ struct ib_qp_init_attr *init_attr) ++{ ++ struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_qplib_qp *qplqp; ++ struct bnxt_re_dev *rdev; ++ int entries; ++ ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; ++ dev_attr = &rdev->dev_attr; ++ ++ entries = roundup_pow_of_two(init_attr->cap.max_send_wr + 1); ++ qplqp->sq.max_wqe = min_t(u32, entries, dev_attr->max_qp_wqes + 1); ++ qplqp->sq.q_full_delta = qplqp->sq.max_wqe - ++ init_attr->cap.max_send_wr; ++ qplqp->sq.max_sge++; /* Need one extra sge to put UD header */ ++ if (qplqp->sq.max_sge > dev_attr->max_qp_sges) ++ qplqp->sq.max_sge = dev_attr->max_qp_sges; ++} ++ ++static int bnxt_re_init_qp_type(struct bnxt_re_dev *rdev, ++ struct ib_qp_init_attr *init_attr) ++{ ++ struct bnxt_qplib_chip_ctx *chip_ctx; ++ int qptype; ++ ++ chip_ctx = &rdev->chip_ctx; ++ ++ qptype = __from_ib_qp_type(init_attr->qp_type); ++ if (qptype == IB_QPT_MAX) { + dev_err(rdev_to_dev(rdev), "QP type 0x%x not supported", +- qp->qplib_qp.type); +- rc = -EINVAL; +- goto fail; ++ qptype); ++ qptype = -EINVAL; ++ goto out; + } + +- qp->qplib_qp.max_inline_data = qp_init_attr->cap.max_inline_data; +- qp->qplib_qp.sig_type = ((qp_init_attr->sq_sig_type == +- IB_SIGNAL_ALL_WR) ? true : false); ++ if (bnxt_qplib_is_chip_gen_p5(chip_ctx) && ++ init_attr->qp_type == IB_QPT_GSI) ++ qptype = CMDQ_CREATE_QP_TYPE_GSI; ++out: ++ return qptype; ++} + +- qp->qplib_qp.sq.max_sge = qp_init_attr->cap.max_send_sge; +- if (qp->qplib_qp.sq.max_sge > dev_attr->max_qp_sges) +- qp->qplib_qp.sq.max_sge = dev_attr->max_qp_sges; ++static int bnxt_re_init_qp_attr(struct bnxt_re_qp *qp, struct bnxt_re_pd *pd, ++ struct ib_qp_init_attr *init_attr, ++ struct ib_udata *udata) ++{ ++ struct bnxt_qplib_dev_attr *dev_attr; ++ struct bnxt_qplib_qp *qplqp; ++ struct bnxt_re_dev *rdev; ++ struct bnxt_re_cq *cq; ++ int rc = 0, qptype; ++ ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; ++ dev_attr = &rdev->dev_attr; ++ ++ /* Setup misc params */ ++ ether_addr_copy(qplqp->smac, rdev->netdev->dev_addr); ++ qplqp->pd = &pd->qplib_pd; ++ qplqp->qp_handle = (u64)qplqp; ++ qplqp->max_inline_data = init_attr->cap.max_inline_data; ++ qplqp->sig_type = ((init_attr->sq_sig_type == IB_SIGNAL_ALL_WR) ? ++ true : false); ++ qptype = bnxt_re_init_qp_type(rdev, init_attr); ++ if (qptype < 0) { ++ rc = qptype; ++ goto out; ++ } ++ qplqp->type = (u8)qptype; ++ ++ if (init_attr->qp_type == IB_QPT_RC) { ++ qplqp->max_rd_atomic = dev_attr->max_qp_rd_atom; ++ qplqp->max_dest_rd_atomic = dev_attr->max_qp_init_rd_atom; ++ } ++ qplqp->mtu = ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu)); ++ qplqp->dpi = &rdev->dpi_privileged; /* Doorbell page */ ++ if (init_attr->create_flags) ++ dev_dbg(rdev_to_dev(rdev), ++ "QP create flags 0x%x not supported", ++ init_attr->create_flags); + +- if (qp_init_attr->send_cq) { +- cq = container_of(qp_init_attr->send_cq, struct bnxt_re_cq, +- ib_cq); ++ /* Setup CQs */ ++ if (init_attr->send_cq) { ++ cq = container_of(init_attr->send_cq, struct bnxt_re_cq, ib_cq); + if (!cq) { + dev_err(rdev_to_dev(rdev), "Send CQ not found"); + rc = -EINVAL; +- goto fail; ++ goto out; + } +- qp->qplib_qp.scq = &cq->qplib_cq; ++ qplqp->scq = &cq->qplib_cq; + qp->scq = cq; + } + +- if (qp_init_attr->recv_cq) { +- cq = container_of(qp_init_attr->recv_cq, struct bnxt_re_cq, +- ib_cq); ++ if (init_attr->recv_cq) { ++ cq = container_of(init_attr->recv_cq, struct bnxt_re_cq, ib_cq); + if (!cq) { + dev_err(rdev_to_dev(rdev), "Receive CQ not found"); + rc = -EINVAL; +- goto fail; ++ goto out; + } +- qp->qplib_qp.rcq = &cq->qplib_cq; ++ qplqp->rcq = &cq->qplib_cq; + qp->rcq = cq; + } + +- if (qp_init_attr->srq) { +- srq = container_of(qp_init_attr->srq, struct bnxt_re_srq, +- ib_srq); +- if (!srq) { +- dev_err(rdev_to_dev(rdev), "SRQ not found"); +- rc = -EINVAL; +- goto fail; +- } +- qp->qplib_qp.srq = &srq->qplib_srq; +- qp->qplib_qp.rq.max_wqe = 0; +- } else { +- /* Allocate 1 more than what's provided so posting max doesn't +- * mean empty +- */ +- entries = roundup_pow_of_two(qp_init_attr->cap.max_recv_wr + 1); +- qp->qplib_qp.rq.max_wqe = min_t(u32, entries, +- dev_attr->max_qp_wqes + 1); ++ /* Setup RQ/SRQ */ ++ rc = bnxt_re_init_rq_attr(qp, init_attr); ++ if (rc) ++ goto out; ++ if (init_attr->qp_type == IB_QPT_GSI) ++ bnxt_re_adjust_gsi_rq_attr(qp); ++ ++ /* Setup SQ */ ++ bnxt_re_init_sq_attr(qp, init_attr, udata); ++ if (init_attr->qp_type == IB_QPT_GSI) ++ bnxt_re_adjust_gsi_sq_attr(qp, init_attr); ++ ++ if (udata) /* This will update DPI and qp_handle */ ++ rc = bnxt_re_init_user_qp(rdev, pd, qp, udata); ++out: ++ return rc; ++} ++ ++static int bnxt_re_create_shadow_gsi(struct bnxt_re_qp *qp, ++ struct bnxt_re_pd *pd) ++{ ++ struct bnxt_re_sqp_entries *sqp_tbl = NULL; ++ struct bnxt_re_dev *rdev; ++ struct bnxt_re_qp *sqp; ++ struct bnxt_re_ah *sah; ++ int rc = 0; + +- qp->qplib_qp.rq.q_full_delta = qp->qplib_qp.rq.max_wqe - +- qp_init_attr->cap.max_recv_wr; ++ rdev = qp->rdev; ++ /* Create a shadow QP to handle the QP1 traffic */ ++ sqp_tbl = kzalloc(sizeof(*sqp_tbl) * BNXT_RE_MAX_GSI_SQP_ENTRIES, ++ GFP_KERNEL); ++ if (!sqp_tbl) ++ return -ENOMEM; ++ rdev->gsi_ctx.sqp_tbl = sqp_tbl; + +- qp->qplib_qp.rq.max_sge = qp_init_attr->cap.max_recv_sge; +- if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges) +- qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges; ++ sqp = bnxt_re_create_shadow_qp(pd, &rdev->qplib_res, &qp->qplib_qp); ++ if (!sqp) { ++ rc = -ENODEV; ++ dev_err(rdev_to_dev(rdev), ++ "Failed to create Shadow QP for QP1"); ++ goto out; + } ++ rdev->gsi_ctx.gsi_sqp = sqp; + +- qp->qplib_qp.mtu = ib_mtu_enum_to_int(iboe_get_mtu(rdev->netdev->mtu)); ++ sqp->rcq = qp->rcq; ++ sqp->scq = qp->scq; ++ sah = bnxt_re_create_shadow_qp_ah(pd, &rdev->qplib_res, ++ &qp->qplib_qp); ++ if (!sah) { ++ bnxt_qplib_destroy_qp(&rdev->qplib_res, ++ &sqp->qplib_qp); ++ rc = -ENODEV; ++ dev_err(rdev_to_dev(rdev), ++ "Failed to create AH entry for ShadowQP"); ++ goto out; ++ } ++ rdev->gsi_ctx.gsi_sah = sah; + +- if (qp_init_attr->qp_type == IB_QPT_GSI && +- !(bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx))) { +- /* Allocate 1 more than what's provided */ +- entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + 1); +- qp->qplib_qp.sq.max_wqe = min_t(u32, entries, +- dev_attr->max_qp_wqes + 1); +- qp->qplib_qp.sq.q_full_delta = qp->qplib_qp.sq.max_wqe - +- qp_init_attr->cap.max_send_wr; +- qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges; +- if (qp->qplib_qp.rq.max_sge > dev_attr->max_qp_sges) +- qp->qplib_qp.rq.max_sge = dev_attr->max_qp_sges; +- qp->qplib_qp.sq.max_sge++; +- if (qp->qplib_qp.sq.max_sge > dev_attr->max_qp_sges) +- qp->qplib_qp.sq.max_sge = dev_attr->max_qp_sges; +- +- qp->qplib_qp.rq_hdr_buf_size = +- BNXT_QPLIB_MAX_QP1_RQ_HDR_SIZE_V2; +- +- qp->qplib_qp.sq_hdr_buf_size = +- BNXT_QPLIB_MAX_QP1_SQ_HDR_SIZE_V2; +- qp->qplib_qp.dpi = &rdev->dpi_privileged; +- rc = bnxt_qplib_create_qp1(&rdev->qplib_res, &qp->qplib_qp); +- if (rc) { +- dev_err(rdev_to_dev(rdev), "Failed to create HW QP1"); +- goto fail; +- } +- /* Create a shadow QP to handle the QP1 traffic */ +- rdev->qp1_sqp = bnxt_re_create_shadow_qp(pd, &rdev->qplib_res, +- &qp->qplib_qp); +- if (!rdev->qp1_sqp) { +- rc = -EINVAL; +- dev_err(rdev_to_dev(rdev), +- "Failed to create Shadow QP for QP1"); +- goto qp_destroy; +- } +- rdev->sqp_ah = bnxt_re_create_shadow_qp_ah(pd, &rdev->qplib_res, +- &qp->qplib_qp); +- if (!rdev->sqp_ah) { +- bnxt_qplib_destroy_qp(&rdev->qplib_res, +- &rdev->qp1_sqp->qplib_qp); +- rc = -EINVAL; +- dev_err(rdev_to_dev(rdev), +- "Failed to create AH entry for ShadowQP"); +- goto qp_destroy; +- } ++ return 0; ++out: ++ kfree(sqp_tbl); ++ return rc; ++} + +- } else { +- /* Allocate 128 + 1 more than what's provided */ +- entries = roundup_pow_of_two(qp_init_attr->cap.max_send_wr + +- BNXT_QPLIB_RESERVED_QP_WRS + 1); +- qp->qplib_qp.sq.max_wqe = min_t(u32, entries, +- dev_attr->max_qp_wqes + +- BNXT_QPLIB_RESERVED_QP_WRS + 1); +- qp->qplib_qp.sq.q_full_delta = BNXT_QPLIB_RESERVED_QP_WRS + 1; ++static int bnxt_re_create_gsi_qp(struct bnxt_re_qp *qp, struct bnxt_re_pd *pd, ++ struct ib_qp_init_attr *init_attr) ++{ ++ struct bnxt_re_dev *rdev; ++ struct bnxt_qplib_qp *qplqp; ++ int rc = 0; + +- /* +- * Reserving one slot for Phantom WQE. Application can +- * post one extra entry in this case. But allowing this to avoid +- * unexpected Queue full condition +- */ ++ rdev = qp->rdev; ++ qplqp = &qp->qplib_qp; + +- qp->qplib_qp.sq.q_full_delta -= 1; ++ qplqp->rq_hdr_buf_size = BNXT_QPLIB_MAX_QP1_RQ_HDR_SIZE_V2; ++ qplqp->sq_hdr_buf_size = BNXT_QPLIB_MAX_QP1_SQ_HDR_SIZE_V2; + +- qp->qplib_qp.max_rd_atomic = dev_attr->max_qp_rd_atom; +- qp->qplib_qp.max_dest_rd_atomic = dev_attr->max_qp_init_rd_atom; +- if (udata) { +- rc = bnxt_re_init_user_qp(rdev, pd, qp, udata); +- if (rc) +- goto fail; +- } else { +- qp->qplib_qp.dpi = &rdev->dpi_privileged; +- } ++ rc = bnxt_qplib_create_qp1(&rdev->qplib_res, qplqp); ++ if (rc) { ++ dev_err(rdev_to_dev(rdev), "create HW QP1 failed!"); ++ goto out; ++ } ++ ++ rc = bnxt_re_create_shadow_gsi(qp, pd); ++out: ++ return rc; ++} ++ ++static bool bnxt_re_test_qp_limits(struct bnxt_re_dev *rdev, ++ struct ib_qp_init_attr *init_attr, ++ struct bnxt_qplib_dev_attr *dev_attr) ++{ ++ bool rc = true; ++ ++ if (init_attr->cap.max_send_wr > dev_attr->max_qp_wqes || ++ init_attr->cap.max_recv_wr > dev_attr->max_qp_wqes || ++ init_attr->cap.max_send_sge > dev_attr->max_qp_sges || ++ init_attr->cap.max_recv_sge > dev_attr->max_qp_sges || ++ init_attr->cap.max_inline_data > dev_attr->max_inline_data) { ++ dev_err(rdev_to_dev(rdev), ++ "Create QP failed - max exceeded! 0x%x/0x%x 0x%x/0x%x 0x%x/0x%x 0x%x/0x%x 0x%x/0x%x", ++ init_attr->cap.max_send_wr, dev_attr->max_qp_wqes, ++ init_attr->cap.max_recv_wr, dev_attr->max_qp_wqes, ++ init_attr->cap.max_send_sge, dev_attr->max_qp_sges, ++ init_attr->cap.max_recv_sge, dev_attr->max_qp_sges, ++ init_attr->cap.max_inline_data, ++ dev_attr->max_inline_data); ++ rc = false; ++ } ++ return rc; ++} ++ ++struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd, ++ struct ib_qp_init_attr *qp_init_attr, ++ struct ib_udata *udata) ++{ ++ struct bnxt_re_pd *pd = container_of(ib_pd, struct bnxt_re_pd, ib_pd); ++ struct bnxt_re_dev *rdev = pd->rdev; ++ struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr; ++ struct bnxt_re_qp *qp; ++ int rc; + ++ rc = bnxt_re_test_qp_limits(rdev, qp_init_attr, dev_attr); ++ if (!rc) { ++ rc = -EINVAL; ++ goto exit; ++ } ++ ++ qp = kzalloc(sizeof(*qp), GFP_KERNEL); ++ if (!qp) { ++ rc = -ENOMEM; ++ goto exit; ++ } ++ qp->rdev = rdev; ++ rc = bnxt_re_init_qp_attr(qp, pd, qp_init_attr, udata); ++ if (rc) ++ goto fail; ++ ++ if (qp_init_attr->qp_type == IB_QPT_GSI && ++ !(bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx))) { ++ rc = bnxt_re_create_gsi_qp(qp, pd, qp_init_attr); ++ if (rc == -ENODEV) ++ goto qp_destroy; ++ if (rc) ++ goto fail; ++ } else { + rc = bnxt_qplib_create_qp(&rdev->qplib_res, &qp->qplib_qp); + if (rc) { + dev_err(rdev_to_dev(rdev), "Failed to create HW QP"); + goto free_umem; + } ++ if (udata) { ++ struct bnxt_re_qp_resp resp; ++ ++ resp.qpid = qp->qplib_qp.id; ++ resp.rsvd = 0; ++ rc = ib_copy_to_udata(udata, &resp, sizeof(resp)); ++ if (rc) { ++ dev_err(rdev_to_dev(rdev), "Failed to copy QP udata"); ++ goto qp_destroy; ++ } ++ } + } + + qp->ib_qp.qp_num = qp->qplib_qp.id; ++ if (qp_init_attr->qp_type == IB_QPT_GSI) ++ rdev->gsi_ctx.gsi_qp = qp; + spin_lock_init(&qp->sq_lock); + spin_lock_init(&qp->rq_lock); +- +- if (udata) { +- struct bnxt_re_qp_resp resp; +- +- resp.qpid = qp->ib_qp.qp_num; +- resp.rsvd = 0; +- rc = ib_copy_to_udata(udata, &resp, sizeof(resp)); +- if (rc) { +- dev_err(rdev_to_dev(rdev), "Failed to copy QP udata"); +- goto qp_destroy; +- } +- } + INIT_LIST_HEAD(&qp->list); + mutex_lock(&rdev->qp_lock); + list_add_tail(&qp->list, &rdev->qp_list); +- atomic_inc(&rdev->qp_count); + mutex_unlock(&rdev->qp_lock); ++ atomic_inc(&rdev->qp_count); + + return &qp->ib_qp; + qp_destroy: +@@ -1206,6 +1402,7 @@ free_umem: + ib_umem_release(qp->sumem); + fail: + kfree(qp); ++exit: + return ERR_PTR(rc); + } + +@@ -1504,7 +1701,7 @@ static int bnxt_re_modify_shadow_qp(struct bnxt_re_dev *rdev, + struct bnxt_re_qp *qp1_qp, + int qp_attr_mask) + { +- struct bnxt_re_qp *qp = rdev->qp1_sqp; ++ struct bnxt_re_qp *qp = rdev->gsi_ctx.gsi_sqp; + int rc = 0; + + if (qp_attr_mask & IB_QP_STATE) { +@@ -1768,7 +1965,7 @@ int bnxt_re_modify_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + dev_err(rdev_to_dev(rdev), "Failed to modify HW QP"); + return rc; + } +- if (ib_qp->qp_type == IB_QPT_GSI && rdev->qp1_sqp) ++ if (ib_qp->qp_type == IB_QPT_GSI && rdev->gsi_ctx.gsi_sqp) + rc = bnxt_re_modify_shadow_qp(rdev, qp, qp_attr_mask); + return rc; + } +@@ -2013,9 +2210,12 @@ static int bnxt_re_build_qp1_shadow_qp_recv(struct bnxt_re_qp *qp, + struct bnxt_qplib_swqe *wqe, + int payload_size) + { ++ struct bnxt_re_sqp_entries *sqp_entry; + struct bnxt_qplib_sge ref, sge; ++ struct bnxt_re_dev *rdev; + u32 rq_prod_index; +- struct bnxt_re_sqp_entries *sqp_entry; ++ ++ rdev = qp->rdev; + + rq_prod_index = bnxt_qplib_get_rq_prod_index(&qp->qplib_qp); + +@@ -2030,7 +2230,7 @@ static int bnxt_re_build_qp1_shadow_qp_recv(struct bnxt_re_qp *qp, + ref.lkey = wqe->sg_list[0].lkey; + ref.size = wqe->sg_list[0].size; + +- sqp_entry = &qp->rdev->sqp_tbl[rq_prod_index]; ++ sqp_entry = &rdev->gsi_ctx.sqp_tbl[rq_prod_index]; + + /* SGE 1 */ + wqe->sg_list[0].addr = sge.addr; +@@ -2850,12 +3050,13 @@ static bool bnxt_re_is_loopback_packet(struct bnxt_re_dev *rdev, + return rc; + } + +-static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *qp1_qp, ++static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *gsi_qp, + struct bnxt_qplib_cqe *cqe) + { +- struct bnxt_re_dev *rdev = qp1_qp->rdev; ++ struct bnxt_re_dev *rdev = gsi_qp->rdev; + struct bnxt_re_sqp_entries *sqp_entry = NULL; +- struct bnxt_re_qp *qp = rdev->qp1_sqp; ++ struct bnxt_re_qp *gsi_sqp = rdev->gsi_ctx.gsi_sqp; ++ struct bnxt_re_ah *gsi_sah; + struct ib_send_wr *swr; + struct ib_ud_wr udwr; + struct ib_recv_wr rwr; +@@ -2878,19 +3079,19 @@ static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *qp1_qp, + swr = &udwr.wr; + tbl_idx = cqe->wr_id; + +- rq_hdr_buf = qp1_qp->qplib_qp.rq_hdr_buf + +- (tbl_idx * qp1_qp->qplib_qp.rq_hdr_buf_size); +- rq_hdr_buf_map = bnxt_qplib_get_qp_buf_from_index(&qp1_qp->qplib_qp, ++ rq_hdr_buf = gsi_qp->qplib_qp.rq_hdr_buf + ++ (tbl_idx * gsi_qp->qplib_qp.rq_hdr_buf_size); ++ rq_hdr_buf_map = bnxt_qplib_get_qp_buf_from_index(&gsi_qp->qplib_qp, + tbl_idx); + + /* Shadow QP header buffer */ +- shrq_hdr_buf_map = bnxt_qplib_get_qp_buf_from_index(&qp->qplib_qp, ++ shrq_hdr_buf_map = bnxt_qplib_get_qp_buf_from_index(&gsi_qp->qplib_qp, + tbl_idx); +- sqp_entry = &rdev->sqp_tbl[tbl_idx]; ++ sqp_entry = &rdev->gsi_ctx.sqp_tbl[tbl_idx]; + + /* Store this cqe */ + memcpy(&sqp_entry->cqe, cqe, sizeof(struct bnxt_qplib_cqe)); +- sqp_entry->qp1_qp = qp1_qp; ++ sqp_entry->qp1_qp = gsi_qp; + + /* Find packet type from the cqe */ + +@@ -2944,7 +3145,7 @@ static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *qp1_qp, + rwr.wr_id = tbl_idx; + rwr.next = NULL; + +- rc = bnxt_re_post_recv_shadow_qp(rdev, qp, &rwr); ++ rc = bnxt_re_post_recv_shadow_qp(rdev, gsi_sqp, &rwr); + if (rc) { + dev_err(rdev_to_dev(rdev), + "Failed to post Rx buffers to shadow QP"); +@@ -2956,15 +3157,13 @@ static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *qp1_qp, + swr->wr_id = tbl_idx; + swr->opcode = IB_WR_SEND; + swr->next = NULL; +- +- udwr.ah = &rdev->sqp_ah->ib_ah; +- udwr.remote_qpn = rdev->qp1_sqp->qplib_qp.id; +- udwr.remote_qkey = rdev->qp1_sqp->qplib_qp.qkey; ++ gsi_sah = rdev->gsi_ctx.gsi_sah; ++ udwr.ah = &gsi_sah->ib_ah; ++ udwr.remote_qpn = gsi_sqp->qplib_qp.id; ++ udwr.remote_qkey = gsi_sqp->qplib_qp.qkey; + + /* post data received in the send queue */ +- rc = bnxt_re_post_send_shadow_qp(rdev, qp, swr); +- +- return 0; ++ return bnxt_re_post_send_shadow_qp(rdev, gsi_sqp, swr); + } + + static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc, +@@ -3029,12 +3228,12 @@ static void bnxt_re_process_res_rc_wc(struct ib_wc *wc, + wc->opcode = IB_WC_RECV_RDMA_WITH_IMM; + } + +-static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp, ++static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *gsi_sqp, + struct ib_wc *wc, + struct bnxt_qplib_cqe *cqe) + { +- struct bnxt_re_dev *rdev = qp->rdev; +- struct bnxt_re_qp *qp1_qp = NULL; ++ struct bnxt_re_dev *rdev = gsi_sqp->rdev; ++ struct bnxt_re_qp *gsi_qp = NULL; + struct bnxt_qplib_cqe *orig_cqe = NULL; + struct bnxt_re_sqp_entries *sqp_entry = NULL; + int nw_type; +@@ -3044,13 +3243,13 @@ static void bnxt_re_process_res_shadow_qp_wc(struct bnxt_re_qp *qp, + + tbl_idx = cqe->wr_id; + +- sqp_entry = &rdev->sqp_tbl[tbl_idx]; +- qp1_qp = sqp_entry->qp1_qp; ++ sqp_entry = &rdev->gsi_ctx.sqp_tbl[tbl_idx]; ++ gsi_qp = sqp_entry->qp1_qp; + orig_cqe = &sqp_entry->cqe; + + wc->wr_id = sqp_entry->wrid; + wc->byte_len = orig_cqe->length; +- wc->qp = &qp1_qp->ib_qp; ++ wc->qp = &gsi_qp->ib_qp; + + wc->ex.imm_data = orig_cqe->immdata; + wc->src_qp = orig_cqe->src_qp; +@@ -3137,7 +3336,7 @@ static int send_phantom_wqe(struct bnxt_re_qp *qp) + int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + { + struct bnxt_re_cq *cq = container_of(ib_cq, struct bnxt_re_cq, ib_cq); +- struct bnxt_re_qp *qp; ++ struct bnxt_re_qp *qp, *sh_qp; + struct bnxt_qplib_cqe *cqe; + int i, ncqe, budget; + struct bnxt_qplib_q *sq; +@@ -3201,8 +3400,9 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + + switch (cqe->opcode) { + case CQ_BASE_CQE_TYPE_REQ: +- if (qp->rdev->qp1_sqp && qp->qplib_qp.id == +- qp->rdev->qp1_sqp->qplib_qp.id) { ++ sh_qp = qp->rdev->gsi_ctx.gsi_sqp; ++ if (sh_qp && ++ qp->qplib_qp.id == sh_qp->qplib_qp.id) { + /* Handle this completion with + * the stored completion + */ +@@ -3228,7 +3428,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + * stored in the table + */ + tbl_idx = cqe->wr_id; +- sqp_entry = &cq->rdev->sqp_tbl[tbl_idx]; ++ sqp_entry = &cq->rdev->gsi_ctx.sqp_tbl[tbl_idx]; + wc->wr_id = sqp_entry->wrid; + bnxt_re_process_res_rawqp1_wc(wc, cqe); + break; +@@ -3236,8 +3436,9 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc) + bnxt_re_process_res_rc_wc(wc, cqe); + break; + case CQ_BASE_CQE_TYPE_RES_UD: +- if (qp->rdev->qp1_sqp && qp->qplib_qp.id == +- qp->rdev->qp1_sqp->qplib_qp.id) { ++ sh_qp = qp->rdev->gsi_ctx.gsi_sqp; ++ if (sh_qp && ++ qp->qplib_qp.id == sh_qp->qplib_qp.id) { + /* Handle this completion with + * the stored completion + */ +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index cfe5f47d9890e..a40bc23196bf7 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -119,61 +119,76 @@ static void bnxt_re_get_sriov_func_type(struct bnxt_re_dev *rdev) + * reserved for the function. The driver may choose to allocate fewer + * resources than the firmware maximum. + */ +-static void bnxt_re_set_resource_limits(struct bnxt_re_dev *rdev) ++static void bnxt_re_limit_pf_res(struct bnxt_re_dev *rdev) + { +- u32 vf_qps = 0, vf_srqs = 0, vf_cqs = 0, vf_mrws = 0, vf_gids = 0; +- u32 i; +- u32 vf_pct; +- u32 num_vfs; +- struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr; ++ struct bnxt_qplib_dev_attr *attr; ++ struct bnxt_qplib_ctx *ctx; ++ int i; + +- rdev->qplib_ctx.qpc_count = min_t(u32, BNXT_RE_MAX_QPC_COUNT, +- dev_attr->max_qp); ++ attr = &rdev->dev_attr; ++ ctx = &rdev->qplib_ctx; + +- rdev->qplib_ctx.mrw_count = BNXT_RE_MAX_MRW_COUNT_256K; ++ ctx->qpc_count = min_t(u32, BNXT_RE_MAX_QPC_COUNT, ++ attr->max_qp); ++ ctx->mrw_count = BNXT_RE_MAX_MRW_COUNT_256K; + /* Use max_mr from fw since max_mrw does not get set */ +- rdev->qplib_ctx.mrw_count = min_t(u32, rdev->qplib_ctx.mrw_count, +- dev_attr->max_mr); +- rdev->qplib_ctx.srqc_count = min_t(u32, BNXT_RE_MAX_SRQC_COUNT, +- dev_attr->max_srq); +- rdev->qplib_ctx.cq_count = min_t(u32, BNXT_RE_MAX_CQ_COUNT, +- dev_attr->max_cq); +- +- for (i = 0; i < MAX_TQM_ALLOC_REQ; i++) +- rdev->qplib_ctx.tqm_count[i] = +- rdev->dev_attr.tqm_alloc_reqs[i]; +- +- if (rdev->num_vfs) { +- /* +- * Reserve a set of resources for the PF. Divide the remaining +- * resources among the VFs +- */ +- vf_pct = 100 - BNXT_RE_PCT_RSVD_FOR_PF; +- num_vfs = 100 * rdev->num_vfs; +- vf_qps = (rdev->qplib_ctx.qpc_count * vf_pct) / num_vfs; +- vf_srqs = (rdev->qplib_ctx.srqc_count * vf_pct) / num_vfs; +- vf_cqs = (rdev->qplib_ctx.cq_count * vf_pct) / num_vfs; +- /* +- * The driver allows many more MRs than other resources. If the +- * firmware does also, then reserve a fixed amount for the PF +- * and divide the rest among VFs. VFs may use many MRs for NFS +- * mounts, ISER, NVME applications, etc. If the firmware +- * severely restricts the number of MRs, then let PF have +- * half and divide the rest among VFs, as for the other +- * resource types. +- */ +- if (rdev->qplib_ctx.mrw_count < BNXT_RE_MAX_MRW_COUNT_64K) +- vf_mrws = rdev->qplib_ctx.mrw_count * vf_pct / num_vfs; +- else +- vf_mrws = (rdev->qplib_ctx.mrw_count - +- BNXT_RE_RESVD_MR_FOR_PF) / rdev->num_vfs; +- vf_gids = BNXT_RE_MAX_GID_PER_VF; ++ ctx->mrw_count = min_t(u32, ctx->mrw_count, attr->max_mr); ++ ctx->srqc_count = min_t(u32, BNXT_RE_MAX_SRQC_COUNT, ++ attr->max_srq); ++ ctx->cq_count = min_t(u32, BNXT_RE_MAX_CQ_COUNT, attr->max_cq); ++ if (!bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx)) ++ for (i = 0; i < MAX_TQM_ALLOC_REQ; i++) ++ rdev->qplib_ctx.tqm_count[i] = ++ rdev->dev_attr.tqm_alloc_reqs[i]; ++} ++ ++static void bnxt_re_limit_vf_res(struct bnxt_qplib_ctx *qplib_ctx, u32 num_vf) ++{ ++ struct bnxt_qplib_vf_res *vf_res; ++ u32 mrws = 0; ++ u32 vf_pct; ++ u32 nvfs; ++ ++ vf_res = &qplib_ctx->vf_res; ++ /* ++ * Reserve a set of resources for the PF. Divide the remaining ++ * resources among the VFs ++ */ ++ vf_pct = 100 - BNXT_RE_PCT_RSVD_FOR_PF; ++ nvfs = num_vf; ++ num_vf = 100 * num_vf; ++ vf_res->max_qp_per_vf = (qplib_ctx->qpc_count * vf_pct) / num_vf; ++ vf_res->max_srq_per_vf = (qplib_ctx->srqc_count * vf_pct) / num_vf; ++ vf_res->max_cq_per_vf = (qplib_ctx->cq_count * vf_pct) / num_vf; ++ /* ++ * The driver allows many more MRs than other resources. If the ++ * firmware does also, then reserve a fixed amount for the PF and ++ * divide the rest among VFs. VFs may use many MRs for NFS ++ * mounts, ISER, NVME applications, etc. If the firmware severely ++ * restricts the number of MRs, then let PF have half and divide ++ * the rest among VFs, as for the other resource types. ++ */ ++ if (qplib_ctx->mrw_count < BNXT_RE_MAX_MRW_COUNT_64K) { ++ mrws = qplib_ctx->mrw_count * vf_pct; ++ nvfs = num_vf; ++ } else { ++ mrws = qplib_ctx->mrw_count - BNXT_RE_RESVD_MR_FOR_PF; + } +- rdev->qplib_ctx.vf_res.max_mrw_per_vf = vf_mrws; +- rdev->qplib_ctx.vf_res.max_gid_per_vf = vf_gids; +- rdev->qplib_ctx.vf_res.max_qp_per_vf = vf_qps; +- rdev->qplib_ctx.vf_res.max_srq_per_vf = vf_srqs; +- rdev->qplib_ctx.vf_res.max_cq_per_vf = vf_cqs; ++ vf_res->max_mrw_per_vf = (mrws / nvfs); ++ vf_res->max_gid_per_vf = BNXT_RE_MAX_GID_PER_VF; ++} ++ ++static void bnxt_re_set_resource_limits(struct bnxt_re_dev *rdev) ++{ ++ u32 num_vfs; ++ ++ memset(&rdev->qplib_ctx.vf_res, 0, sizeof(struct bnxt_qplib_vf_res)); ++ bnxt_re_limit_pf_res(rdev); ++ ++ num_vfs = bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx) ? ++ BNXT_RE_GEN_P5_MAX_VF : rdev->num_vfs; ++ if (num_vfs) ++ bnxt_re_limit_vf_res(&rdev->qplib_ctx, num_vfs); + } + + /* for handling bnxt_en callbacks later */ +@@ -193,9 +208,11 @@ static void bnxt_re_sriov_config(void *p, int num_vfs) + return; + + rdev->num_vfs = num_vfs; +- bnxt_re_set_resource_limits(rdev); +- bnxt_qplib_set_func_resources(&rdev->qplib_res, &rdev->rcfw, +- &rdev->qplib_ctx); ++ if (!bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx)) { ++ bnxt_re_set_resource_limits(rdev); ++ bnxt_qplib_set_func_resources(&rdev->qplib_res, &rdev->rcfw, ++ &rdev->qplib_ctx); ++ } + } + + static void bnxt_re_shutdown(void *p) +@@ -897,10 +914,14 @@ static int bnxt_re_cqn_handler(struct bnxt_qplib_nq *nq, + return 0; + } + ++#define BNXT_RE_GEN_P5_PF_NQ_DB 0x10000 ++#define BNXT_RE_GEN_P5_VF_NQ_DB 0x4000 + static u32 bnxt_re_get_nqdb_offset(struct bnxt_re_dev *rdev, u16 indx) + { + return bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx) ? +- 0x10000 : rdev->msix_entries[indx].db_offset; ++ (rdev->is_virtfn ? BNXT_RE_GEN_P5_VF_NQ_DB : ++ BNXT_RE_GEN_P5_PF_NQ_DB) : ++ rdev->msix_entries[indx].db_offset; + } + + static void bnxt_re_cleanup_res(struct bnxt_re_dev *rdev) +@@ -1106,7 +1127,8 @@ static int bnxt_re_query_hwrm_pri2cos(struct bnxt_re_dev *rdev, u8 dir, + static bool bnxt_re_is_qp1_or_shadow_qp(struct bnxt_re_dev *rdev, + struct bnxt_re_qp *qp) + { +- return (qp->ib_qp.qp_type == IB_QPT_GSI) || (qp == rdev->qp1_sqp); ++ return (qp->ib_qp.qp_type == IB_QPT_GSI) || ++ (qp == rdev->gsi_ctx.gsi_sqp); + } + + static void bnxt_re_dev_stop(struct bnxt_re_dev *rdev) +@@ -1410,8 +1432,8 @@ static int bnxt_re_ib_reg(struct bnxt_re_dev *rdev) + rdev->is_virtfn); + if (rc) + goto disable_rcfw; +- if (!rdev->is_virtfn) +- bnxt_re_set_resource_limits(rdev); ++ ++ bnxt_re_set_resource_limits(rdev); + + rc = bnxt_qplib_alloc_ctx(rdev->en_dev->pdev, &rdev->qplib_ctx, 0, + bnxt_qplib_is_chip_gen_p5(&rdev->chip_ctx)); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 60c8f76aab33d..5cdfa84faf85e 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -494,8 +494,10 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + * shall setup this area for VF. Skipping the + * HW programming + */ +- if (is_virtfn || bnxt_qplib_is_chip_gen_p5(rcfw->res->cctx)) ++ if (is_virtfn) + goto skip_ctx_setup; ++ if (bnxt_qplib_is_chip_gen_p5(rcfw->res->cctx)) ++ goto config_vf_res; + + level = ctx->qpc_tbl.level; + req.qpc_pg_size_qpc_lvl = (level << CMDQ_INITIALIZE_FW_QPC_LVL_SFT) | +@@ -540,6 +542,7 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + req.number_of_srq = cpu_to_le32(ctx->srqc_tbl.max_elements); + req.number_of_cq = cpu_to_le32(ctx->cq_tbl.max_elements); + ++config_vf_res: + req.max_qp_per_vf = cpu_to_le32(ctx->vf_res.max_qp_per_vf); + req.max_mrw_per_vf = cpu_to_le32(ctx->vf_res.max_mrw_per_vf); + req.max_srq_per_vf = cpu_to_le32(ctx->vf_res.max_srq_per_vf); +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 535ee41ee4214..e163c09547ebd 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3282,7 +3282,7 @@ static int get_lladdr(struct net_device *dev, struct in6_addr *addr, + + static int pick_local_ip6addrs(struct c4iw_dev *dev, struct iw_cm_id *cm_id) + { +- struct in6_addr uninitialized_var(addr); ++ struct in6_addr addr; + struct sockaddr_in6 *la6 = (struct sockaddr_in6 *)&cm_id->m_local_addr; + struct sockaddr_in6 *ra6 = (struct sockaddr_in6 *)&cm_id->m_remote_addr; + +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index 16b74591a68db..a3595b8a4bcf9 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -754,7 +754,7 @@ skip_cqe: + static int __c4iw_poll_cq_one(struct c4iw_cq *chp, struct c4iw_qp *qhp, + struct ib_wc *wc, struct c4iw_srq *srq) + { +- struct t4_cqe uninitialized_var(cqe); ++ struct t4_cqe cqe; + struct t4_wq *wq = qhp ? &qhp->wq : NULL; + u32 credit = 0; + u8 cqe_flushed; +diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c +index 17f1e59ab12ee..559b24ca52050 100644 +--- a/drivers/infiniband/hw/efa/efa_verbs.c ++++ b/drivers/infiniband/hw/efa/efa_verbs.c +@@ -1231,7 +1231,7 @@ static int pbl_continuous_initialize(struct efa_dev *dev, + */ + static int pbl_indirect_initialize(struct efa_dev *dev, struct pbl_context *pbl) + { +- u32 size_in_pages = DIV_ROUND_UP(pbl->pbl_buf_size_in_bytes, PAGE_SIZE); ++ u32 size_in_pages = DIV_ROUND_UP(pbl->pbl_buf_size_in_bytes, EFA_CHUNK_PAYLOAD_SIZE); + struct scatterlist *sgl; + int sg_dma_cnt, err; + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 4523eb85ec698..02caf9a439cf1 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -3547,11 +3547,11 @@ static int _mlx4_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, + int nreq; + int err = 0; + unsigned ind; +- int uninitialized_var(size); +- unsigned uninitialized_var(seglen); ++ int size; ++ unsigned seglen; + __be32 dummy; + __be32 *lso_wqe; +- __be32 uninitialized_var(lso_hdr_sz); ++ __be32 lso_hdr_sz; + __be32 blh; + int i; + struct mlx4_ib_dev *mdev = to_mdev(ibqp->device); +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 23ce0126b268e..7f659c240c99c 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -916,8 +916,8 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct mlx5_ib_dev *dev = to_mdev(ibdev); + struct mlx5_ib_cq *cq = to_mcq(ibcq); + u32 out[MLX5_ST_SZ_DW(create_cq_out)]; +- int uninitialized_var(index); +- int uninitialized_var(inlen); ++ int index; ++ int inlen; + u32 *cqb = NULL; + void *cqc; + int cqe_size; +@@ -1237,7 +1237,7 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata) + __be64 *pas; + int page_shift; + int inlen; +- int uninitialized_var(cqe_size); ++ int cqe_size; + unsigned long flags; + + if (!MLX5_CAP_GEN(dev->mdev, cq_resize)) { +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 747f42855b7bd..26cc7bbcdfe6a 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -2556,7 +2556,7 @@ static ssize_t devx_async_event_read(struct file *filp, char __user *buf, + { + struct devx_async_event_file *ev_file = filp->private_data; + struct devx_event_subscription *event_sub; +- struct devx_async_event_data *uninitialized_var(event); ++ struct devx_async_event_data *event; + int ret = 0; + size_t eventsz; + bool omit_data; +diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c +index d04c245359eb0..c6e95d0d760ab 100644 +--- a/drivers/infiniband/hw/mthca/mthca_qp.c ++++ b/drivers/infiniband/hw/mthca/mthca_qp.c +@@ -1639,8 +1639,8 @@ int mthca_tavor_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, + * without initializing f0 and size0, and they are in fact + * never used uninitialized. + */ +- int uninitialized_var(size0); +- u32 uninitialized_var(f0); ++ int size0; ++ u32 f0; + int ind; + u8 op0 = 0; + +@@ -1835,7 +1835,7 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, const struct ib_recv_wr *wr, + * without initializing size0, and it is in fact never used + * uninitialized. + */ +- int uninitialized_var(size0); ++ int size0; + int ind; + void *wqe; + void *prev_wqe; +@@ -1943,8 +1943,8 @@ int mthca_arbel_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr, + * without initializing f0 and size0, and they are in fact + * never used uninitialized. + */ +- int uninitialized_var(size0); +- u32 uninitialized_var(f0); ++ int size0; ++ u32 f0; + int ind; + u8 op0 = 0; + +diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c +index e9647ebff1871..1e4770094415d 100644 +--- a/drivers/input/serio/serio_raw.c ++++ b/drivers/input/serio/serio_raw.c +@@ -159,7 +159,7 @@ static ssize_t serio_raw_read(struct file *file, char __user *buffer, + { + struct serio_raw_client *client = file->private_data; + struct serio_raw *serio_raw = client->serio_raw; +- char uninitialized_var(c); ++ char c; + ssize_t read = 0; + int error; + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index b79309928d786..a30aac41af426 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -4420,8 +4420,7 @@ int amd_iommu_activate_guest_mode(void *data) + struct amd_ir_data *ir_data = (struct amd_ir_data *)data; + struct irte_ga *entry = (struct irte_ga *) ir_data->entry; + +- if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || +- !entry || entry->lo.fields_vapic.guest_mode) ++ if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || !entry) + return 0; + + entry->lo.val = 0; +diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c +index 96f37d9d4d93c..67a8c08d82105 100644 +--- a/drivers/iommu/rockchip-iommu.c ++++ b/drivers/iommu/rockchip-iommu.c +@@ -1230,18 +1230,20 @@ static int rk_iommu_probe(struct platform_device *pdev) + for (i = 0; i < iommu->num_irq; i++) { + int irq = platform_get_irq(pdev, i); + +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ err = irq; ++ goto err_pm_disable; ++ } + + err = devm_request_irq(iommu->dev, irq, rk_iommu_irq, + IRQF_SHARED, dev_name(dev), iommu); +- if (err) { +- pm_runtime_disable(dev); +- goto err_remove_sysfs; +- } ++ if (err) ++ goto err_pm_disable; + } + + return 0; ++err_pm_disable: ++ pm_runtime_disable(dev); + err_remove_sysfs: + iommu_device_sysfs_remove(&iommu->iommu); + err_put_group: +diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c +index 4555d678fadda..abcee58e851c2 100644 +--- a/drivers/mailbox/mailbox-test.c ++++ b/drivers/mailbox/mailbox-test.c +@@ -12,6 +12,7 @@ + #include <linux/kernel.h> + #include <linux/mailbox_client.h> + #include <linux/module.h> ++#include <linux/mutex.h> + #include <linux/of.h> + #include <linux/platform_device.h> + #include <linux/poll.h> +@@ -38,6 +39,7 @@ struct mbox_test_device { + char *signal; + char *message; + spinlock_t lock; ++ struct mutex mutex; + wait_queue_head_t waitq; + struct fasync_struct *async_queue; + struct dentry *root_debugfs_dir; +@@ -95,6 +97,7 @@ static ssize_t mbox_test_message_write(struct file *filp, + size_t count, loff_t *ppos) + { + struct mbox_test_device *tdev = filp->private_data; ++ char *message; + void *data; + int ret; + +@@ -110,10 +113,13 @@ static ssize_t mbox_test_message_write(struct file *filp, + return -EINVAL; + } + +- tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL); +- if (!tdev->message) ++ message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL); ++ if (!message) + return -ENOMEM; + ++ mutex_lock(&tdev->mutex); ++ ++ tdev->message = message; + ret = copy_from_user(tdev->message, userbuf, count); + if (ret) { + ret = -EFAULT; +@@ -144,6 +150,8 @@ out: + kfree(tdev->message); + tdev->signal = NULL; + ++ mutex_unlock(&tdev->mutex); ++ + return ret < 0 ? ret : count; + } + +@@ -392,6 +400,7 @@ static int mbox_test_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, tdev); + + spin_lock_init(&tdev->lock); ++ mutex_init(&tdev->mutex); + + if (tdev->rx_channel) { + tdev->rx_buffer = devm_kzalloc(&pdev->dev, +diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c +index 81ffc59d05c90..4312007d2d34b 100644 +--- a/drivers/md/dm-io.c ++++ b/drivers/md/dm-io.c +@@ -306,7 +306,7 @@ static void do_region(int op, int op_flags, unsigned region, + struct request_queue *q = bdev_get_queue(where->bdev); + unsigned short logical_block_size = queue_logical_block_size(q); + sector_t num_sectors; +- unsigned int uninitialized_var(special_cmd_max_sectors); ++ unsigned int special_cmd_max_sectors; + + /* + * Reject unsupported discard and write same requests. +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 477e616a21c74..8e787677a8104 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1848,7 +1848,7 @@ static int ctl_ioctl(struct file *file, uint command, struct dm_ioctl __user *us + int ioctl_flags; + int param_flags; + unsigned int cmd; +- struct dm_ioctl *uninitialized_var(param); ++ struct dm_ioctl *param; + ioctl_fn fn = NULL; + size_t input_param_size; + struct dm_ioctl param_kernel; +diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c +index 963d3774c93e2..247089c2be256 100644 +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -613,7 +613,7 @@ static int persistent_read_metadata(struct dm_exception_store *store, + chunk_t old, chunk_t new), + void *callback_context) + { +- int r, uninitialized_var(new_snapshot); ++ int r, new_snapshot; + struct pstore *ps = get_info(store); + + /* +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 81bc36a43b32d..8b05d938aa989 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -668,7 +668,7 @@ static int validate_hardware_logical_block_alignment(struct dm_table *table, + */ + unsigned short remaining = 0; + +- struct dm_target *uninitialized_var(ti); ++ struct dm_target *ti; + struct queue_limits ti_limits; + unsigned i; + +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 113ba084fab45..f3d60c4b34b8c 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2599,7 +2599,7 @@ static void raid5_end_write_request(struct bio *bi) + struct stripe_head *sh = bi->bi_private; + struct r5conf *conf = sh->raid_conf; + int disks = sh->disks, i; +- struct md_rdev *uninitialized_var(rdev); ++ struct md_rdev *rdev; + sector_t first_bad; + int bad_sectors; + int replacement = 0; +diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c +index fd476536d32ed..dec036e0336cb 100644 +--- a/drivers/media/dvb-core/dvb_ca_en50221.c ++++ b/drivers/media/dvb-core/dvb_ca_en50221.c +@@ -151,6 +151,12 @@ struct dvb_ca_private { + + /* mutex serializing ioctls */ + struct mutex ioctl_mutex; ++ ++ /* A mutex used when a device is disconnected */ ++ struct mutex remove_mutex; ++ ++ /* Whether the device is disconnected */ ++ int exit; + }; + + static void dvb_ca_private_free(struct dvb_ca_private *ca) +@@ -187,7 +193,7 @@ static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca); + static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot, + u8 *ebuf, int ecount); + static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, +- u8 *ebuf, int ecount); ++ u8 *ebuf, int ecount, int size_write_flag); + + /** + * Safely find needle in haystack. +@@ -370,7 +376,7 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot) + ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10); + if (ret) + return ret; +- ret = dvb_ca_en50221_write_data(ca, slot, buf, 2); ++ ret = dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_SW); + if (ret != 2) + return -EIO; + ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN); +@@ -778,11 +784,13 @@ exit: + * @buf: The data in this buffer is treated as a complete link-level packet to + * be written. + * @bytes_write: Size of ebuf. ++ * @size_write_flag: A flag on Command Register which says whether the link size ++ * information will be writen or not. + * + * return: Number of bytes written, or < 0 on error. + */ + static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, +- u8 *buf, int bytes_write) ++ u8 *buf, int bytes_write, int size_write_flag) + { + struct dvb_ca_slot *sl = &ca->slot_info[slot]; + int status; +@@ -817,7 +825,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, + + /* OK, set HC bit */ + status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, +- IRQEN | CMDREG_HC); ++ IRQEN | CMDREG_HC | size_write_flag); + if (status) + goto exit; + +@@ -1505,7 +1513,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file, + + mutex_lock(&sl->slot_lock); + status = dvb_ca_en50221_write_data(ca, slot, fragbuf, +- fraglen + 2); ++ fraglen + 2, 0); + mutex_unlock(&sl->slot_lock); + if (status == (fraglen + 2)) { + written = 1; +@@ -1706,12 +1714,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) + + dprintk("%s\n", __func__); + +- if (!try_module_get(ca->pub->owner)) ++ mutex_lock(&ca->remove_mutex); ++ ++ if (ca->exit) { ++ mutex_unlock(&ca->remove_mutex); ++ return -ENODEV; ++ } ++ ++ if (!try_module_get(ca->pub->owner)) { ++ mutex_unlock(&ca->remove_mutex); + return -EIO; ++ } + + err = dvb_generic_open(inode, file); + if (err < 0) { + module_put(ca->pub->owner); ++ mutex_unlock(&ca->remove_mutex); + return err; + } + +@@ -1736,6 +1754,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) + + dvb_ca_private_get(ca); + ++ mutex_unlock(&ca->remove_mutex); + return 0; + } + +@@ -1755,6 +1774,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) + + dprintk("%s\n", __func__); + ++ mutex_lock(&ca->remove_mutex); ++ + /* mark the CA device as closed */ + ca->open = 0; + dvb_ca_en50221_thread_update_delay(ca); +@@ -1765,6 +1786,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) + + dvb_ca_private_put(ca); + ++ if (dvbdev->users == 1 && ca->exit == 1) { ++ mutex_unlock(&ca->remove_mutex); ++ wake_up(&dvbdev->wait_queue); ++ } else { ++ mutex_unlock(&ca->remove_mutex); ++ } ++ + return err; + } + +@@ -1888,6 +1916,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, + } + + mutex_init(&ca->ioctl_mutex); ++ mutex_init(&ca->remove_mutex); + + if (signal_pending(current)) { + ret = -EINTR; +@@ -1930,6 +1959,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) + + dprintk("%s\n", __func__); + ++ mutex_lock(&ca->remove_mutex); ++ ca->exit = 1; ++ mutex_unlock(&ca->remove_mutex); ++ ++ if (ca->dvbdev->users < 1) ++ wait_event(ca->dvbdev->wait_queue, ++ ca->dvbdev->users == 1); ++ + /* shutdown the thread if there was one */ + kthread_stop(ca->thread); + +diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c +index 39a2c6ccf31d7..9904a170faeff 100644 +--- a/drivers/media/dvb-core/dvb_demux.c ++++ b/drivers/media/dvb-core/dvb_demux.c +@@ -125,12 +125,12 @@ static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed, + + cc = buf[3] & 0x0f; + ccok = ((feed->cc + 1) & 0x0f) == cc; +- feed->cc = cc; + if (!ccok) { + set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED); + dprintk_sect_loss("missed packet: %d instead of %d!\n", + cc, (feed->cc + 1) & 0x0f); + } ++ feed->cc = cc; + + if (buf[1] & 0x40) // PUSI ? + feed->peslen = 0xfffa; +@@ -310,7 +310,6 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed, + + cc = buf[3] & 0x0f; + ccok = ((feed->cc + 1) & 0x0f) == cc; +- feed->cc = cc; + + if (buf[3] & 0x20) { + /* adaption field present, check for discontinuity_indicator */ +@@ -346,6 +345,7 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed, + feed->pusi_seen = false; + dvb_dmx_swfilter_section_new(feed); + } ++ feed->cc = cc; + + if (buf[1] & 0x40) { + /* PUSI=1 (is set), section boundary is here */ +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index b04638321b75b..ad3e42a4eaf73 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -292,14 +292,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, + } + + if (events->eventw == events->eventr) { +- int ret; ++ struct wait_queue_entry wait; ++ int ret = 0; + + if (flags & O_NONBLOCK) + return -EWOULDBLOCK; + +- ret = wait_event_interruptible(events->wait_queue, +- dvb_frontend_test_event(fepriv, events)); +- ++ init_waitqueue_entry(&wait, current); ++ add_wait_queue(&events->wait_queue, &wait); ++ while (!dvb_frontend_test_event(fepriv, events)) { ++ wait_woken(&wait, TASK_INTERRUPTIBLE, 0); ++ if (signal_pending(current)) { ++ ret = -ERESTARTSYS; ++ break; ++ } ++ } ++ remove_wait_queue(&events->wait_queue, &wait); + if (ret < 0) + return ret; + } +diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c +index 9fed06ba88efb..ccaaabaaeb571 100644 +--- a/drivers/media/dvb-core/dvb_net.c ++++ b/drivers/media/dvb-core/dvb_net.c +@@ -1564,15 +1564,43 @@ static long dvb_net_ioctl(struct file *file, + return dvb_usercopy(file, cmd, arg, dvb_net_do_ioctl); + } + ++static int locked_dvb_net_open(struct inode *inode, struct file *file) ++{ ++ struct dvb_device *dvbdev = file->private_data; ++ struct dvb_net *dvbnet = dvbdev->priv; ++ int ret; ++ ++ if (mutex_lock_interruptible(&dvbnet->remove_mutex)) ++ return -ERESTARTSYS; ++ ++ if (dvbnet->exit) { ++ mutex_unlock(&dvbnet->remove_mutex); ++ return -ENODEV; ++ } ++ ++ ret = dvb_generic_open(inode, file); ++ ++ mutex_unlock(&dvbnet->remove_mutex); ++ ++ return ret; ++} ++ + static int dvb_net_close(struct inode *inode, struct file *file) + { + struct dvb_device *dvbdev = file->private_data; + struct dvb_net *dvbnet = dvbdev->priv; + ++ mutex_lock(&dvbnet->remove_mutex); ++ + dvb_generic_release(inode, file); + +- if(dvbdev->users == 1 && dvbnet->exit == 1) ++ if (dvbdev->users == 1 && dvbnet->exit == 1) { ++ mutex_unlock(&dvbnet->remove_mutex); + wake_up(&dvbdev->wait_queue); ++ } else { ++ mutex_unlock(&dvbnet->remove_mutex); ++ } ++ + return 0; + } + +@@ -1580,7 +1608,7 @@ static int dvb_net_close(struct inode *inode, struct file *file) + static const struct file_operations dvb_net_fops = { + .owner = THIS_MODULE, + .unlocked_ioctl = dvb_net_ioctl, +- .open = dvb_generic_open, ++ .open = locked_dvb_net_open, + .release = dvb_net_close, + .llseek = noop_llseek, + }; +@@ -1599,10 +1627,13 @@ void dvb_net_release (struct dvb_net *dvbnet) + { + int i; + ++ mutex_lock(&dvbnet->remove_mutex); + dvbnet->exit = 1; ++ mutex_unlock(&dvbnet->remove_mutex); ++ + if (dvbnet->dvbdev->users < 1) + wait_event(dvbnet->dvbdev->wait_queue, +- dvbnet->dvbdev->users==1); ++ dvbnet->dvbdev->users == 1); + + dvb_unregister_device(dvbnet->dvbdev); + +@@ -1621,6 +1652,7 @@ int dvb_net_init (struct dvb_adapter *adap, struct dvb_net *dvbnet, + int i; + + mutex_init(&dvbnet->ioctl_mutex); ++ mutex_init(&dvbnet->remove_mutex); + dvbnet->demux = dmx; + + for (i=0; i<DVB_NET_DEVICES_MAX; i++) +diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c +index fff212c0bf3b5..05894deb8a19a 100644 +--- a/drivers/media/dvb-frontends/mn88443x.c ++++ b/drivers/media/dvb-frontends/mn88443x.c +@@ -800,7 +800,7 @@ MODULE_DEVICE_TABLE(i2c, mn88443x_i2c_id); + static struct i2c_driver mn88443x_driver = { + .driver = { + .name = "mn88443x", +- .of_match_table = of_match_ptr(mn88443x_of_match), ++ .of_match_table = mn88443x_of_match, + }, + .probe = mn88443x_probe, + .remove = mn88443x_remove, +diff --git a/drivers/media/dvb-frontends/rtl2832.c b/drivers/media/dvb-frontends/rtl2832.c +index 6ec2774213909..e5bffaaeed38a 100644 +--- a/drivers/media/dvb-frontends/rtl2832.c ++++ b/drivers/media/dvb-frontends/rtl2832.c +@@ -640,7 +640,7 @@ static int rtl2832_read_status(struct dvb_frontend *fe, enum fe_status *status) + struct i2c_client *client = dev->client; + struct dtv_frontend_properties *c = &fe->dtv_property_cache; + int ret; +- u32 uninitialized_var(tmp); ++ u32 tmp; + u8 u8tmp, buf[2]; + u16 u16tmp; + +diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +index 129acf595410d..478247e13637e 100644 +--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c ++++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +@@ -887,12 +887,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, + ndev->lmmio0, (u32)pci_resource_len(pci_dev, 0), + ndev->lmmio1, (u32)pci_resource_len(pci_dev, 1), + pci_dev->irq); +- if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED, +- "netup_unidvb", pci_dev) < 0) { +- dev_err(&pci_dev->dev, +- "%s(): can't get IRQ %d\n", __func__, pci_dev->irq); +- goto irq_request_err; +- } ++ + ndev->dma_size = 2 * 188 * + NETUP_DMA_BLOCKS_COUNT * NETUP_DMA_PACKETS_COUNT; + ndev->dma_virt = dma_alloc_coherent(&pci_dev->dev, +@@ -933,6 +928,14 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, + dev_err(&pci_dev->dev, "netup_unidvb: DMA setup failed\n"); + goto dma_setup_err; + } ++ ++ if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED, ++ "netup_unidvb", pci_dev) < 0) { ++ dev_err(&pci_dev->dev, ++ "%s(): can't get IRQ %d\n", __func__, pci_dev->irq); ++ goto dma_setup_err; ++ } ++ + dev_info(&pci_dev->dev, + "netup_unidvb: device has been initialized\n"); + return 0; +@@ -951,8 +954,6 @@ spi_setup_err: + dma_free_coherent(&pci_dev->dev, ndev->dma_size, + ndev->dma_virt, ndev->dma_phys); + dma_alloc_err: +- free_irq(pci_dev->irq, pci_dev); +-irq_request_err: + iounmap(ndev->lmmio1); + pci_bar1_error: + iounmap(ndev->lmmio0); +diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c +index e5f6360801082..5d6b7aaee2953 100644 +--- a/drivers/media/platform/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/rcar-vin/rcar-dma.c +@@ -638,6 +638,7 @@ static int rvin_setup(struct rvin_dev *vin) + vnmc = VNMC_IM_FULL | VNMC_FOC; + break; + case V4L2_FIELD_NONE: ++ case V4L2_FIELD_ALTERNATE: + vnmc = VNMC_IM_ODD_EVEN; + progressive = true; + break; +diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c +index 85bbdd4ecdbba..e48faf942830c 100644 +--- a/drivers/media/tuners/qt1010.c ++++ b/drivers/media/tuners/qt1010.c +@@ -215,7 +215,7 @@ static int qt1010_set_params(struct dvb_frontend *fe) + static int qt1010_init_meas1(struct qt1010_priv *priv, + u8 oper, u8 reg, u8 reg_init_val, u8 *retval) + { +- u8 i, val1, uninitialized_var(val2); ++ u8 i, val1, val2; + int err; + + qt1010_i2c_oper_t i2c_data[] = { +@@ -250,7 +250,7 @@ static int qt1010_init_meas1(struct qt1010_priv *priv, + static int qt1010_init_meas2(struct qt1010_priv *priv, + u8 reg_init_val, u8 *retval) + { +- u8 i, uninitialized_var(val); ++ u8 i, val; + int err; + qt1010_i2c_oper_t i2c_data[] = { + { QT1010_WR, 0x07, reg_init_val }, +diff --git a/drivers/media/usb/dvb-usb-v2/ce6230.c b/drivers/media/usb/dvb-usb-v2/ce6230.c +index 44540de1a2066..d3b5cb4a24daf 100644 +--- a/drivers/media/usb/dvb-usb-v2/ce6230.c ++++ b/drivers/media/usb/dvb-usb-v2/ce6230.c +@@ -101,6 +101,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap, + if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { + if (msg[i].addr == + ce6230_zl10353_config.demod_address) { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + req.cmd = DEMOD_READ; + req.value = msg[i].addr >> 1; + req.index = msg[i].buf[0]; +@@ -117,6 +121,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap, + } else { + if (msg[i].addr == + ce6230_zl10353_config.demod_address) { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + req.cmd = DEMOD_WRITE; + req.value = msg[i].addr >> 1; + req.index = msg[i].buf[0]; +diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c +index e30305876840f..1191e32407c77 100644 +--- a/drivers/media/usb/dvb-usb-v2/ec168.c ++++ b/drivers/media/usb/dvb-usb-v2/ec168.c +@@ -115,6 +115,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + while (i < num) { + if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { + if (msg[i].addr == ec168_ec100_config.demod_address) { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + req.cmd = READ_DEMOD; + req.value = 0; + req.index = 0xff00 + msg[i].buf[0]; /* reg */ +@@ -131,6 +135,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + } + } else { + if (msg[i].addr == ec168_ec100_config.demod_address) { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + req.cmd = WRITE_DEMOD; + req.value = msg[i].buf[1]; /* val */ + req.index = 0xff00 + msg[i].buf[0]; /* reg */ +@@ -139,6 +147,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = ec168_ctrl_msg(d, &req); + i += 1; + } else { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + req.cmd = WRITE_I2C; + req.value = msg[i].buf[0]; /* val */ + req.index = 0x0100 + msg[i].addr; /* I2C addr */ +diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +index 0fe71437601e7..ec9bbd8c89ad3 100644 +--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c ++++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c +@@ -176,6 +176,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } else if (msg[0].addr == 0x10) { ++ if (msg[0].len < 1 || msg[1].len < 1) { ++ ret = -EOPNOTSUPP; ++ goto err_mutex_unlock; ++ } + /* method 1 - integrated demod */ + if (msg[0].buf[0] == 0x00) { + /* return demod page from driver cache */ +@@ -189,6 +193,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = rtl28xxu_ctrl_msg(d, &req); + } + } else if (msg[0].len < 2) { ++ if (msg[0].len < 1) { ++ ret = -EOPNOTSUPP; ++ goto err_mutex_unlock; ++ } + /* method 2 - old I2C */ + req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1); + req.index = CMD_I2C_RD; +@@ -217,8 +225,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = -EOPNOTSUPP; + goto err_mutex_unlock; + } else if (msg[0].addr == 0x10) { ++ if (msg[0].len < 1) { ++ ret = -EOPNOTSUPP; ++ goto err_mutex_unlock; ++ } + /* method 1 - integrated demod */ + if (msg[0].buf[0] == 0x00) { ++ if (msg[0].len < 2) { ++ ret = -EOPNOTSUPP; ++ goto err_mutex_unlock; ++ } + /* save demod page for later demod access */ + dev->page = msg[0].buf[1]; + ret = 0; +@@ -231,6 +247,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], + ret = rtl28xxu_ctrl_msg(d, &req); + } + } else if ((msg[0].len < 23) && (!dev->new_i2c_write)) { ++ if (msg[0].len < 1) { ++ ret = -EOPNOTSUPP; ++ goto err_mutex_unlock; ++ } + /* method 2 - old I2C */ + req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1); + req.index = CMD_I2C_WR; +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index ffc0db67d4d68..2b56393d10008 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -988,6 +988,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n + /* write/read request */ + if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) { + req = 0xB9; ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff)); + value = msg[i].addr + (msg[i].len << 8); + length = msg[i + 1].len + 6; +@@ -1001,6 +1005,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n + + /* demod 16bit addr */ + req = 0xBD; ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff)); + value = msg[i].addr + (2 << 8); + length = msg[i].len - 2; +@@ -1026,6 +1034,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n + } else { + + req = 0xBD; ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + index = msg[i].buf[0] & 0x00FF; + value = msg[i].addr + (1 << 8); + length = msg[i].len - 1; +diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c +index 99a39339d45d5..cf5ec8c1f6773 100644 +--- a/drivers/media/usb/dvb-usb/digitv.c ++++ b/drivers/media/usb/dvb-usb/digitv.c +@@ -63,6 +63,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num + warn("more than 2 i2c messages at a time is not handled yet. TODO."); + + for (i = 0; i < num; i++) { ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + /* write/read request */ + if (i+1 < num && (msg[i+1].flags & I2C_M_RD)) { + if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0, +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index 8493ebb377c4d..f8f589ebab74b 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -946,7 +946,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6]) + for (i = 0; i < 6; i++) { + obuf[1] = 0xf0 + i; + if (i2c_transfer(&d->i2c_adap, msg, 2) != 2) +- break; ++ return -1; + else + mac[i] = ibuf[0]; + } +diff --git a/drivers/media/usb/gspca/vicam.c b/drivers/media/usb/gspca/vicam.c +index 179b2ec3df57c..d98343fd33fe3 100644 +--- a/drivers/media/usb/gspca/vicam.c ++++ b/drivers/media/usb/gspca/vicam.c +@@ -225,7 +225,7 @@ static int sd_init(struct gspca_dev *gspca_dev) + { + int ret; + const struct ihex_binrec *rec; +- const struct firmware *uninitialized_var(fw); ++ const struct firmware *fw; + u8 *firmware_buf; + + ret = request_ihex_firmware(&fw, VICAM_FIRMWARE, +diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c +index 3198f9624b7c0..46bb0ccaafc1f 100644 +--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c ++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c +@@ -1551,8 +1551,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec) + dvb_dmx_release(&dec->demux); + if (dec->fe) { + dvb_unregister_frontend(dec->fe); +- if (dec->fe->ops.release) +- dec->fe->ops.release(dec->fe); ++ dvb_frontend_detach(dec->fe); + } + dvb_unregister_adapter(&dec->adapter); + } +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index e676a9ef6f0d6..6dff8e2fadbac 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -797,9 +797,9 @@ static void uvc_video_stats_decode(struct uvc_streaming *stream, + unsigned int header_size; + bool has_pts = false; + bool has_scr = false; +- u16 uninitialized_var(scr_sof); +- u32 uninitialized_var(scr_stc); +- u32 uninitialized_var(pts); ++ u16 scr_sof; ++ u32 scr_stc; ++ u32 pts; + + if (stream->stats.stream.nb_frames == 0 && + stream->stats.frame.nb_packets == 0) +@@ -1862,7 +1862,7 @@ static int uvc_video_start_transfer(struct uvc_streaming *stream, + struct usb_host_endpoint *best_ep = NULL; + unsigned int best_psize = UINT_MAX; + unsigned int bandwidth; +- unsigned int uninitialized_var(altsetting); ++ unsigned int altsetting; + int intfnum = stream->intfnum; + + /* Isochronous endpoint, select the alternate setting. */ +diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c +index 74d6686b35f77..672671a122151 100644 +--- a/drivers/memstick/host/jmb38x_ms.c ++++ b/drivers/memstick/host/jmb38x_ms.c +@@ -314,7 +314,7 @@ static int jmb38x_ms_transfer_data(struct jmb38x_ms_host *host) + } + + while (length) { +- unsigned int uninitialized_var(p_off); ++ unsigned int p_off; + + if (host->req->long_data) { + pg = nth_page(sg_page(&host->req->sg), +diff --git a/drivers/memstick/host/tifm_ms.c b/drivers/memstick/host/tifm_ms.c +index 5b966b54d6e91..fc35c74044298 100644 +--- a/drivers/memstick/host/tifm_ms.c ++++ b/drivers/memstick/host/tifm_ms.c +@@ -198,7 +198,7 @@ static unsigned int tifm_ms_transfer_data(struct tifm_ms *host) + host->block_pos); + + while (length) { +- unsigned int uninitialized_var(p_off); ++ unsigned int p_off; + + if (host->req->long_data) { + pg = nth_page(sg_page(&host->req->sg), +diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c +index 19840ad58a5fb..10fec109bbd33 100644 +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1484,8 +1484,10 @@ static void fastrpc_notify_users(struct fastrpc_user *user) + struct fastrpc_invoke_ctx *ctx; + + spin_lock(&user->lock); +- list_for_each_entry(ctx, &user->pending, node) ++ list_for_each_entry(ctx, &user->pending, node) { ++ ctx->retval = -EPIPE; + complete(&ctx->work); ++ } + spin_unlock(&user->lock); + } + +@@ -1495,7 +1497,9 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) + struct fastrpc_user *user; + unsigned long flags; + ++ /* No invocations past this point */ + spin_lock_irqsave(&cctx->lock, flags); ++ cctx->rpdev = NULL; + list_for_each_entry(user, &cctx->users, user) + fastrpc_notify_users(user); + spin_unlock_irqrestore(&cctx->lock, flags); +@@ -1503,7 +1507,6 @@ static void fastrpc_rpmsg_remove(struct rpmsg_device *rpdev) + misc_deregister(&cctx->miscdev); + of_platform_depopulate(&rpdev->dev); + +- cctx->rpdev = NULL; + fastrpc_channel_ctx_put(cctx); + } + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 115feb9aa2364..ae3cbf792d7b1 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -476,7 +476,7 @@ static void sdhci_read_block_pio(struct sdhci_host *host) + { + unsigned long flags; + size_t blksize, len, chunk; +- u32 uninitialized_var(scratch); ++ u32 scratch; + u8 *buf; + + DBG("PIO reading\n"); +diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c +index 58cc3c94f579b..5e9d4c9c01860 100644 +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -1715,6 +1715,9 @@ static void construct_request_response(struct vub300_mmc_host *vub300, + int bytes = 3 & less_cmd; + int words = less_cmd >> 2; + u8 *r = vub300->resp.response.command_response; ++ ++ if (!resp_len) ++ return; + if (bytes == 3) { + cmd->resp[words] = (r[1 + (words << 2)] << 24) + | (r[2 + (words << 2)] << 16) +diff --git a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h +index 2cda439b5e11b..017868f59f222 100644 +--- a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h ++++ b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h +@@ -36,25 +36,25 @@ int ingenic_ecc_correct(struct ingenic_ecc *ecc, + void ingenic_ecc_release(struct ingenic_ecc *ecc); + struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np); + #else /* CONFIG_MTD_NAND_INGENIC_ECC */ +-int ingenic_ecc_calculate(struct ingenic_ecc *ecc, ++static inline int ingenic_ecc_calculate(struct ingenic_ecc *ecc, + struct ingenic_ecc_params *params, + const u8 *buf, u8 *ecc_code) + { + return -ENODEV; + } + +-int ingenic_ecc_correct(struct ingenic_ecc *ecc, ++static inline int ingenic_ecc_correct(struct ingenic_ecc *ecc, + struct ingenic_ecc_params *params, u8 *buf, + u8 *ecc_code) + { + return -ENODEV; + } + +-void ingenic_ecc_release(struct ingenic_ecc *ecc) ++static inline void ingenic_ecc_release(struct ingenic_ecc *ecc) + { + } + +-struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np) ++static inline struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np) + { + return ERR_PTR(-ENODEV); + } +diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c +index 36cb0db02bbb0..c49a3e105b427 100644 +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -2401,6 +2401,12 @@ static int marvell_nfc_setup_data_interface(struct nand_chip *chip, int chipnr, + NDTR1_WAIT_MODE; + } + ++ /* ++ * Reset nfc->selected_chip so the next command will cause the timing ++ * registers to be updated in marvell_nfc_select_target(). ++ */ ++ nfc->selected_chip = NULL; ++ + return 0; + } + +@@ -2828,10 +2834,6 @@ static int marvell_nfc_init(struct marvell_nfc *nfc) + regmap_update_bits(sysctrl_base, GENCONF_CLK_GATING_CTRL, + GENCONF_CLK_GATING_CTRL_ND_GATE, + GENCONF_CLK_GATING_CTRL_ND_GATE); +- +- regmap_update_bits(sysctrl_base, GENCONF_ND_CLK_CTRL, +- GENCONF_ND_CLK_CTRL_EN, +- GENCONF_ND_CLK_CTRL_EN); + } + + /* Configure the DMA if appropriate */ +diff --git a/drivers/mtd/nand/raw/nand_ecc.c b/drivers/mtd/nand/raw/nand_ecc.c +index 09fdced659f5d..b6a46b1b77814 100644 +--- a/drivers/mtd/nand/raw/nand_ecc.c ++++ b/drivers/mtd/nand/raw/nand_ecc.c +@@ -131,7 +131,7 @@ void __nand_calculate_ecc(const unsigned char *buf, unsigned int eccsize, + /* rp0..rp15..rp17 are the various accumulated parities (per byte) */ + uint32_t rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7; + uint32_t rp8, rp9, rp10, rp11, rp12, rp13, rp14, rp15, rp16; +- uint32_t uninitialized_var(rp17); /* to make compiler happy */ ++ uint32_t rp17; + uint32_t par; /* the cumulative parity for all data */ + uint32_t tmppar; /* the cumulative parity for this iteration; + for rp12, rp14 and rp16 at the end of the +diff --git a/drivers/mtd/nand/raw/s3c2410.c b/drivers/mtd/nand/raw/s3c2410.c +index 0009c1820e217..93dbe35dd30b3 100644 +--- a/drivers/mtd/nand/raw/s3c2410.c ++++ b/drivers/mtd/nand/raw/s3c2410.c +@@ -291,7 +291,7 @@ static int s3c2410_nand_setrate(struct s3c2410_nand_info *info) + int tacls_max = (info->cpu_type == TYPE_S3C2412) ? 8 : 4; + int tacls, twrph0, twrph1; + unsigned long clkrate = clk_get_rate(info->clk); +- unsigned long uninitialized_var(set), cfg, uninitialized_var(mask); ++ unsigned long set, cfg, mask; + unsigned long flags; + + /* calculate the timing information for the controller */ +diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c +index 8fd61767af831..26116694c821b 100644 +--- a/drivers/mtd/parsers/afs.c ++++ b/drivers/mtd/parsers/afs.c +@@ -126,8 +126,8 @@ static int afs_parse_v1_partition(struct mtd_info *mtd, + * Static checks cannot see that we bail out if we have an error + * reading the footer. + */ +- u_int uninitialized_var(iis_ptr); +- u_int uninitialized_var(img_ptr); ++ u_int iis_ptr; ++ u_int img_ptr; + u_int ptr; + size_t sz; + int ret; +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 3243bca19b8b2..b4cdf2351cac9 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -599,7 +599,7 @@ int ubi_eba_read_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum, + int err, pnum, scrub = 0, vol_id = vol->vol_id; + struct ubi_vid_io_buf *vidb; + struct ubi_vid_hdr *vid_hdr; +- uint32_t uninitialized_var(crc); ++ uint32_t crc; + + err = leb_read_lock(ubi, vol_id, lnum); + if (err) +diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c +index a761092e6ac97..f929db893957e 100644 +--- a/drivers/net/can/janz-ican3.c ++++ b/drivers/net/can/janz-ican3.c +@@ -1451,7 +1451,7 @@ static int ican3_napi(struct napi_struct *napi, int budget) + + /* process all communication messages */ + while (true) { +- struct ican3_msg uninitialized_var(msg); ++ struct ican3_msg msg; + ret = ican3_recv_msg(mod, &msg); + if (ret) + break; +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 3a8a49b7ec3d9..393ee145ae066 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -5096,7 +5096,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) + goto out; + } + if (chip->reset) +- usleep_range(1000, 2000); ++ usleep_range(10000, 20000); + + err = mv88e6xxx_detect(chip); + if (err) +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 7840eb4cdb8da..d291976d8b761 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1312,7 +1312,7 @@ static enum xgbe_mode xgbe_phy_status_aneg(struct xgbe_prv_data *pdata) + return pdata->phy_if.phy_impl.an_outcome(pdata); + } + +-static void xgbe_phy_status_result(struct xgbe_prv_data *pdata) ++static bool xgbe_phy_status_result(struct xgbe_prv_data *pdata) + { + struct ethtool_link_ksettings *lks = &pdata->phy.lks; + enum xgbe_mode mode; +@@ -1347,8 +1347,13 @@ static void xgbe_phy_status_result(struct xgbe_prv_data *pdata) + + pdata->phy.duplex = DUPLEX_FULL; + +- if (xgbe_set_mode(pdata, mode) && pdata->an_again) ++ if (!xgbe_set_mode(pdata, mode)) ++ return false; ++ ++ if (pdata->an_again) + xgbe_phy_reconfig_aneg(pdata); ++ ++ return true; + } + + static void xgbe_phy_status(struct xgbe_prv_data *pdata) +@@ -1378,7 +1383,8 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata) + return; + } + +- xgbe_phy_status_result(pdata); ++ if (xgbe_phy_status_result(pdata)) ++ return; + + if (test_bit(XGBE_LINK_INIT, &pdata->dev_state)) + clear_bit(XGBE_LINK_INIT, &pdata->dev_state); +diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c +index c3f67d8e10933..2cb3471208523 100644 +--- a/drivers/net/ethernet/broadcom/bnx2.c ++++ b/drivers/net/ethernet/broadcom/bnx2.c +@@ -1461,7 +1461,7 @@ bnx2_test_and_disable_2g5(struct bnx2 *bp) + static void + bnx2_enable_forced_2g5(struct bnx2 *bp) + { +- u32 uninitialized_var(bmcr); ++ u32 bmcr; + int err; + + if (!(bp->phy_flags & BNX2_PHY_FLAG_2_5G_CAPABLE)) +@@ -1505,7 +1505,7 @@ bnx2_enable_forced_2g5(struct bnx2 *bp) + static void + bnx2_disable_forced_2g5(struct bnx2 *bp) + { +- u32 uninitialized_var(bmcr); ++ u32 bmcr; + int err; + + if (!(bp->phy_flags & BNX2_PHY_FLAG_2_5G_CAPABLE)) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h +index 066765fbef069..0a59a09ef82f4 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init.h +@@ -296,7 +296,6 @@ static inline void bnx2x_dcb_config_qm(struct bnx2x *bp, enum cos_mode mode, + * possible, the driver should only write the valid vnics into the internal + * ram according to the appropriate port mode. + */ +-#define BITS_TO_BYTES(x) ((x)/8) + + /* CMNG constants, as derived from system spec calculations */ + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +index fcf5fef7c195d..58d48d76c1b8a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +@@ -480,7 +480,7 @@ static void poll_trace(struct mlx5_fw_tracer *tracer, + (u64)timestamp_low; + break; + default: +- if (tracer_event->event_id >= tracer->str_db.first_string_trace || ++ if (tracer_event->event_id >= tracer->str_db.first_string_trace && + tracer_event->event_id <= tracer->str_db.first_string_trace + + tracer->str_db.num_string_trace) { + tracer_event->type = TRACER_EVENT_TYPE_STRING; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index 7f7693b709d72..05ff66c231851 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -504,8 +504,8 @@ static int req_pages_handler(struct notifier_block *nb, + + int mlx5_satisfy_startup_pages(struct mlx5_core_dev *dev, int boot) + { +- u16 uninitialized_var(func_id); +- s32 uninitialized_var(npages); ++ u16 func_id; ++ s32 npages; + int err; + + err = mlx5_cmd_query_pages(dev, &func_id, &npages, boot); +diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c +index 496052a6b9b86..00e698935f4e2 100644 +--- a/drivers/net/ethernet/neterion/s2io.c ++++ b/drivers/net/ethernet/neterion/s2io.c +@@ -7287,7 +7287,7 @@ static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp) + int ring_no = ring_data->ring_no; + u16 l3_csum, l4_csum; + unsigned long long err = rxdp->Control_1 & RXD_T_CODE; +- struct lro *uninitialized_var(lro); ++ struct lro *lro; + u8 err_mask; + struct swStat *swstats = &sp->mac_control.stats_info->sw_stat; + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 11616aca0e6a1..2fa68592210d7 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -3770,7 +3770,7 @@ static int ql3xxx_probe(struct pci_dev *pdev, + struct net_device *ndev = NULL; + struct ql3_adapter *qdev = NULL; + static int cards_found; +- int uninitialized_var(pci_using_dac), err; ++ int pci_using_dac, err; + + err = pci_enable_device(pdev); + if (err) { +diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c +index ecaa9beee76eb..ed9af678bcfbb 100644 +--- a/drivers/net/ethernet/sun/cassini.c ++++ b/drivers/net/ethernet/sun/cassini.c +@@ -1337,7 +1337,7 @@ static void cas_init_rx_dma(struct cas *cp) + writel(val, cp->regs + REG_RX_PAGE_SIZE); + + /* enable the header parser if desired */ +- if (CAS_HP_FIRMWARE == cas_prog_null) ++ if (&CAS_HP_FIRMWARE[0] == &cas_prog_null[0]) + return; + + val = CAS_BASE(HP_CFG_NUM_CPU, CAS_NCPUS > 63 ? 0 : CAS_NCPUS); +@@ -2291,7 +2291,7 @@ static int cas_rx_ringN(struct cas *cp, int ring, int budget) + drops = 0; + while (1) { + struct cas_rx_comp *rxc = rxcs + entry; +- struct sk_buff *uninitialized_var(skb); ++ struct sk_buff *skb; + int type, len; + u64 words[4]; + int i, dring; +@@ -3807,7 +3807,7 @@ static void cas_reset(struct cas *cp, int blkflag) + + /* program header parser */ + if ((cp->cas_flags & CAS_FLAG_TARGET_ABORT) || +- (CAS_HP_ALT_FIRMWARE == cas_prog_null)) { ++ (&CAS_HP_ALT_FIRMWARE[0] == &cas_prog_null[0])) { + cas_load_firmware(cp, CAS_HP_FIRMWARE); + } else { + cas_load_firmware(cp, CAS_HP_ALT_FIRMWARE); +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 201470d540d87..e659415c62bd7 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -429,7 +429,7 @@ static int serdes_init_niu_1g_serdes(struct niu *np) + struct niu_link_config *lp = &np->link_config; + u16 pll_cfg, pll_sts; + int max_retry = 100; +- u64 uninitialized_var(sig), mask, val; ++ u64 sig, mask, val; + u32 tx_cfg, rx_cfg; + unsigned long i; + int err; +@@ -526,7 +526,7 @@ static int serdes_init_niu_10g_serdes(struct niu *np) + struct niu_link_config *lp = &np->link_config; + u32 tx_cfg, rx_cfg, pll_cfg, pll_sts; + int max_retry = 100; +- u64 uninitialized_var(sig), mask, val; ++ u64 sig, mask, val; + unsigned long i; + int err; + +@@ -714,7 +714,7 @@ static int esr_write_glue0(struct niu *np, unsigned long chan, u32 val) + + static int esr_reset(struct niu *np) + { +- u32 uninitialized_var(reset); ++ u32 reset; + int err; + + err = mdio_write(np, np->port, NIU_ESR_DEV_ADDR, +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index c2307cfaf4009..0cb58a0cf4e6e 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1282,7 +1282,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */ + {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ + {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ +- {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ ++ {QMI_QUIRK_SET_DTR(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c +index 7ad3d24195ba1..138930c66ad2c 100644 +--- a/drivers/net/wan/z85230.c ++++ b/drivers/net/wan/z85230.c +@@ -702,7 +702,7 @@ EXPORT_SYMBOL(z8530_nop); + irqreturn_t z8530_interrupt(int irq, void *dev_id) + { + struct z8530_dev *dev=dev_id; +- u8 uninitialized_var(intr); ++ u8 intr; + static volatile int locker=0; + int work=0; + struct z8530_irqhandler *irqs; +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index 383d4fa555a88..3e1adfa2f2779 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -2157,7 +2157,7 @@ static int ath10k_init_uart(struct ath10k *ar) + + static int ath10k_init_hw_params(struct ath10k *ar) + { +- const struct ath10k_hw_params *uninitialized_var(hw_params); ++ const struct ath10k_hw_params *hw_params; + int i; + + for (i = 0; i < ARRAY_SIZE(ath10k_hw_params_list); i++) { +diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c +index aa1c71a76ef74..811fad6d60c0e 100644 +--- a/drivers/net/wireless/ath/ath6kl/init.c ++++ b/drivers/net/wireless/ath/ath6kl/init.c +@@ -1575,7 +1575,7 @@ static int ath6kl_init_upload(struct ath6kl *ar) + + int ath6kl_init_hw_params(struct ath6kl *ar) + { +- const struct ath6kl_hw *uninitialized_var(hw); ++ const struct ath6kl_hw *hw; + int i; + + for (i = 0; i < ARRAY_SIZE(hw_list); i++) { +diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c +index 17c318902cb86..68cc7803b91a2 100644 +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -230,7 +230,7 @@ static unsigned int ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 cl + struct ath_hw *ah = hw_priv; + struct ath_common *common = ath9k_hw_common(ah); + struct ath_softc *sc = (struct ath_softc *) common->priv; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + u32 val; + + if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_ON) { +diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h +index 9fc7c088a539e..67b4bac048e58 100644 +--- a/drivers/net/wireless/broadcom/b43/b43.h ++++ b/drivers/net/wireless/broadcom/b43/b43.h +@@ -651,7 +651,7 @@ struct b43_iv { + union { + __be16 d16; + __be32 d32; +- } data __packed; ++ } __packed data; + } __packed; + + +diff --git a/drivers/net/wireless/broadcom/b43/debugfs.c b/drivers/net/wireless/broadcom/b43/debugfs.c +index 1325727a74ed4..8d9a337624a70 100644 +--- a/drivers/net/wireless/broadcom/b43/debugfs.c ++++ b/drivers/net/wireless/broadcom/b43/debugfs.c +@@ -493,7 +493,7 @@ static ssize_t b43_debugfs_read(struct file *file, char __user *userbuf, + struct b43_wldev *dev; + struct b43_debugfs_fops *dfops; + struct b43_dfs_file *dfile; +- ssize_t uninitialized_var(ret); ++ ssize_t ret; + char *buf; + const size_t bufsize = 1024 * 16; /* 16 kiB buffer */ + const size_t buforder = get_order(bufsize); +diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c +index 31bf71a80c26a..72bf07540da39 100644 +--- a/drivers/net/wireless/broadcom/b43/dma.c ++++ b/drivers/net/wireless/broadcom/b43/dma.c +@@ -37,7 +37,7 @@ + static u32 b43_dma_address(struct b43_dma *dma, dma_addr_t dmaaddr, + enum b43_addrtype addrtype) + { +- u32 uninitialized_var(addr); ++ u32 addr; + + switch (addrtype) { + case B43_DMA_ADDR_LOW: +diff --git a/drivers/net/wireless/broadcom/b43/lo.c b/drivers/net/wireless/broadcom/b43/lo.c +index 5d97cf06eceb0..338b6545a1e75 100644 +--- a/drivers/net/wireless/broadcom/b43/lo.c ++++ b/drivers/net/wireless/broadcom/b43/lo.c +@@ -729,7 +729,7 @@ struct b43_lo_calib *b43_calibrate_lo_setting(struct b43_wldev *dev, + }; + int max_rx_gain; + struct b43_lo_calib *cal; +- struct lo_g_saved_values uninitialized_var(saved_regs); ++ struct lo_g_saved_values saved_regs; + /* Values from the "TXCTL Register and Value Table" */ + u16 txctl_reg; + u16 txctl_value; +diff --git a/drivers/net/wireless/broadcom/b43/phy_n.c b/drivers/net/wireless/broadcom/b43/phy_n.c +index 0ef62ef77af64..eb4d35cae0c99 100644 +--- a/drivers/net/wireless/broadcom/b43/phy_n.c ++++ b/drivers/net/wireless/broadcom/b43/phy_n.c +@@ -5643,7 +5643,7 @@ static int b43_nphy_rev2_cal_rx_iq(struct b43_wldev *dev, + u8 rfctl[2]; + u8 afectl_core; + u16 tmp[6]; +- u16 uninitialized_var(cur_hpf1), uninitialized_var(cur_hpf2), cur_lna; ++ u16 cur_hpf1, cur_hpf2, cur_lna; + u32 real, imag; + enum nl80211_band band; + +diff --git a/drivers/net/wireless/broadcom/b43/xmit.c b/drivers/net/wireless/broadcom/b43/xmit.c +index 0587452195160..2ff005b453cdb 100644 +--- a/drivers/net/wireless/broadcom/b43/xmit.c ++++ b/drivers/net/wireless/broadcom/b43/xmit.c +@@ -422,10 +422,10 @@ int b43_generate_txhdr(struct b43_wldev *dev, + if ((rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) || + (rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)) { + unsigned int len; +- struct ieee80211_hdr *uninitialized_var(hdr); ++ struct ieee80211_hdr *hdr; + int rts_rate, rts_rate_fb; + int rts_rate_ofdm, rts_rate_fb_ofdm; +- struct b43_plcp_hdr6 *uninitialized_var(plcp); ++ struct b43_plcp_hdr6 *plcp; + struct ieee80211_rate *rts_cts_rate; + + rts_cts_rate = ieee80211_get_rts_cts_rate(dev->wl->hw, info); +@@ -436,7 +436,7 @@ int b43_generate_txhdr(struct b43_wldev *dev, + rts_rate_fb_ofdm = b43_is_ofdm_rate(rts_rate_fb); + + if (rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) { +- struct ieee80211_cts *uninitialized_var(cts); ++ struct ieee80211_cts *cts; + + switch (dev->fw.hdr_format) { + case B43_FW_HDR_598: +@@ -458,7 +458,7 @@ int b43_generate_txhdr(struct b43_wldev *dev, + mac_ctl |= B43_TXH_MAC_SENDCTS; + len = sizeof(struct ieee80211_cts); + } else { +- struct ieee80211_rts *uninitialized_var(rts); ++ struct ieee80211_rts *rts; + + switch (dev->fw.hdr_format) { + case B43_FW_HDR_598: +@@ -650,8 +650,8 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr) + const struct b43_rxhdr_fw4 *rxhdr = _rxhdr; + __le16 fctl; + u16 phystat0, phystat3; +- u16 uninitialized_var(chanstat), uninitialized_var(mactime); +- u32 uninitialized_var(macstat); ++ u16 chanstat, mactime; ++ u32 macstat; + u16 chanid; + int padding, rate_idx; + +diff --git a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h +index 6b0cec467938f..f49365d14619f 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h ++++ b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h +@@ -379,7 +379,7 @@ struct b43legacy_iv { + union { + __be16 d16; + __be32 d32; +- } data __packed; ++ } __packed data; + } __packed; + + #define B43legacy_PHYMODE(phytype) (1 << (phytype)) +diff --git a/drivers/net/wireless/broadcom/b43legacy/debugfs.c b/drivers/net/wireless/broadcom/b43legacy/debugfs.c +index 082aab8353b81..cab2c44676935 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/debugfs.c ++++ b/drivers/net/wireless/broadcom/b43legacy/debugfs.c +@@ -190,7 +190,7 @@ static ssize_t b43legacy_debugfs_read(struct file *file, char __user *userbuf, + struct b43legacy_wldev *dev; + struct b43legacy_debugfs_fops *dfops; + struct b43legacy_dfs_file *dfile; +- ssize_t uninitialized_var(ret); ++ ssize_t ret; + char *buf; + const size_t bufsize = 1024 * 16; /* 16 KiB buffer */ + const size_t buforder = get_order(bufsize); +diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c +index 5208a39fd6f7d..220c11d34c237 100644 +--- a/drivers/net/wireless/broadcom/b43legacy/main.c ++++ b/drivers/net/wireless/broadcom/b43legacy/main.c +@@ -2580,7 +2580,7 @@ static void b43legacy_put_phy_into_reset(struct b43legacy_wldev *dev) + static int b43legacy_switch_phymode(struct b43legacy_wl *wl, + unsigned int new_mode) + { +- struct b43legacy_wldev *uninitialized_var(up_dev); ++ struct b43legacy_wldev *up_dev; + struct b43legacy_wldev *down_dev; + int err; + bool gmode = false; +diff --git a/drivers/net/wireless/intel/iwlegacy/3945.c b/drivers/net/wireless/intel/iwlegacy/3945.c +index 2ac494f5ae22b..fd63eba47ba22 100644 +--- a/drivers/net/wireless/intel/iwlegacy/3945.c ++++ b/drivers/net/wireless/intel/iwlegacy/3945.c +@@ -2100,7 +2100,7 @@ il3945_txpower_set_from_eeprom(struct il_priv *il) + + /* set tx power value for all OFDM rates */ + for (rate_idx = 0; rate_idx < IL_OFDM_RATES; rate_idx++) { +- s32 uninitialized_var(power_idx); ++ s32 power_idx; + int rc; + + /* use channel group's clip-power table, +diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +index feeb57cadc1ca..20c933602f0a2 100644 +--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c ++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c +@@ -2768,7 +2768,7 @@ il4965_hdl_tx(struct il_priv *il, struct il_rx_buf *rxb) + struct ieee80211_tx_info *info; + struct il4965_tx_resp *tx_resp = (void *)&pkt->u.raw[0]; + u32 status = le32_to_cpu(tx_resp->u.status); +- int uninitialized_var(tid); ++ int tid; + int sta_id; + int freed; + u8 *qc = NULL; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 2a02d4d72dec9..b7da89ba1e7d5 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1255,6 +1255,7 @@ struct rtl8xxxu_priv { + u32 rege9c; + u32 regeb4; + u32 regebc; ++ u32 regrcr; + int next_mbox; + int nr_out_eps; + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index bdccc84278d85..2648b30aab76a 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -4048,6 +4048,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw) + RCR_ACCEPT_MGMT_FRAME | RCR_HTC_LOC_CTRL | + RCR_APPEND_PHYSTAT | RCR_APPEND_ICV | RCR_APPEND_MIC; + rtl8xxxu_write32(priv, REG_RCR, val32); ++ priv->regrcr = val32; + + /* + * Accept all multicast +@@ -5585,7 +5586,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw, + unsigned int *total_flags, u64 multicast) + { + struct rtl8xxxu_priv *priv = hw->priv; +- u32 rcr = rtl8xxxu_read32(priv, REG_RCR); ++ u32 rcr = priv->regrcr; + + dev_dbg(&priv->udev->dev, "%s: changed_flags %08x, total_flags %08x\n", + __func__, changed_flags, *total_flags); +@@ -5631,6 +5632,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw, + */ + + rtl8xxxu_write32(priv, REG_RCR, rcr); ++ priv->regrcr = rcr; + + *total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_BCN_PRBRESP_PROMISC | + FIF_CONTROL | FIF_OTHER_BSS | FIF_PSPOLL | +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +index df7a14320fd29..869775c711f59 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +@@ -618,8 +618,8 @@ static void _rtl92cu_init_chipn_two_out_ep_priority(struct ieee80211_hw *hw, + u8 queue_sel) + { + u16 beq, bkq, viq, voq, mgtq, hiq; +- u16 uninitialized_var(valuehi); +- u16 uninitialized_var(valuelow); ++ u16 valuehi; ++ u16 valuelow; + + switch (queue_sel) { + case (TX_SELE_HQ | TX_SELE_LQ): +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +index 0ae6371b63182..667578087af2c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +@@ -2392,14 +2392,10 @@ void rtl92d_phy_reload_iqk_setting(struct ieee80211_hw *hw, u8 channel) + RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, + "Just Read IQK Matrix reg for channel:%d....\n", + channel); +- if ((rtlphy->iqk_matrix[indexforchannel]. +- value[0] != NULL) +- /*&&(regea4 != 0) */) ++ if (rtlphy->iqk_matrix[indexforchannel].value[0][0] != 0) + _rtl92d_phy_patha_fill_iqk_matrix(hw, true, +- rtlphy->iqk_matrix[ +- indexforchannel].value, 0, +- (rtlphy->iqk_matrix[ +- indexforchannel].value[0][2] == 0)); ++ rtlphy->iqk_matrix[indexforchannel].value, 0, ++ rtlphy->iqk_matrix[indexforchannel].value[0][2] == 0); + if (IS_92D_SINGLEPHY(rtlhal->version)) { + if ((rtlphy->iqk_matrix[ + indexforchannel].value[0][4] != 0) +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index 271aecfbc3bf3..aec1748cc821f 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -1212,7 +1212,7 @@ static irqreturn_t aer_isr(int irq, void *context) + { + struct pcie_device *dev = (struct pcie_device *)context; + struct aer_rpc *rpc = get_service_data(dev); +- struct aer_err_source uninitialized_var(e_src); ++ struct aer_err_source e_src; + + if (kfifo_is_empty(&rpc->aer_fifo)) + return IRQ_NONE; +diff --git a/drivers/platform/x86/hdaps.c b/drivers/platform/x86/hdaps.c +index 3adcb0de01935..922ca87919bbf 100644 +--- a/drivers/platform/x86/hdaps.c ++++ b/drivers/platform/x86/hdaps.c +@@ -366,7 +366,7 @@ static ssize_t hdaps_variance_show(struct device *dev, + static ssize_t hdaps_temp1_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- u8 uninitialized_var(temp); ++ u8 temp; + int ret; + + ret = hdaps_readb_one(HDAPS_PORT_TEMP1, &temp); +@@ -379,7 +379,7 @@ static ssize_t hdaps_temp1_show(struct device *dev, + static ssize_t hdaps_temp2_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +- u8 uninitialized_var(temp); ++ u8 temp; + int ret; + + ret = hdaps_readb_one(HDAPS_PORT_TEMP2, &temp); +diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig +index 9ea30fcb44282..51bbc858a944c 100644 +--- a/drivers/scsi/Kconfig ++++ b/drivers/scsi/Kconfig +@@ -443,7 +443,7 @@ config SCSI_MVUMI + + config SCSI_DPT_I2O + tristate "Adaptec I2O RAID support " +- depends on SCSI && PCI && VIRT_TO_BUS ++ depends on SCSI && PCI + help + This driver supports all of Adaptec's I2O based RAID controllers as + well as the DPT SmartRaid V cards. This is an Adaptec maintained +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c +index c4a6609d8fae1..cd0c978dc169c 100644 +--- a/drivers/scsi/dc395x.c ++++ b/drivers/scsi/dc395x.c +@@ -4168,7 +4168,7 @@ static int adapter_sg_tables_alloc(struct AdapterCtlBlk *acb) + const unsigned srbs_per_page = PAGE_SIZE/SEGMENTX_LEN; + int srb_idx = 0; + unsigned i = 0; +- struct SGentry *uninitialized_var(ptr); ++ struct SGentry *ptr; + + for (i = 0; i < DC395x_MAX_SRB_CNT; i++) + acb->srb_array[i].segment_x = NULL; +diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c +index abc74fd474dcb..912acd2b5067c 100644 +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -56,7 +56,7 @@ MODULE_DESCRIPTION("Adaptec I2O RAID Driver"); + + #include <asm/processor.h> /* for boot_cpu_data */ + #include <asm/pgtable.h> +-#include <asm/io.h> /* for virt_to_bus, etc. */ ++#include <asm/io.h> + + #include <scsi/scsi.h> + #include <scsi/scsi_cmnd.h> +@@ -585,51 +585,6 @@ static int adpt_show_info(struct seq_file *m, struct Scsi_Host *host) + return 0; + } + +-/* +- * Turn a pointer to ioctl reply data into an u32 'context' +- */ +-static u32 adpt_ioctl_to_context(adpt_hba * pHba, void *reply) +-{ +-#if BITS_PER_LONG == 32 +- return (u32)(unsigned long)reply; +-#else +- ulong flags = 0; +- u32 nr, i; +- +- spin_lock_irqsave(pHba->host->host_lock, flags); +- nr = ARRAY_SIZE(pHba->ioctl_reply_context); +- for (i = 0; i < nr; i++) { +- if (pHba->ioctl_reply_context[i] == NULL) { +- pHba->ioctl_reply_context[i] = reply; +- break; +- } +- } +- spin_unlock_irqrestore(pHba->host->host_lock, flags); +- if (i >= nr) { +- printk(KERN_WARNING"%s: Too many outstanding " +- "ioctl commands\n", pHba->name); +- return (u32)-1; +- } +- +- return i; +-#endif +-} +- +-/* +- * Go from an u32 'context' to a pointer to ioctl reply data. +- */ +-static void *adpt_ioctl_from_context(adpt_hba *pHba, u32 context) +-{ +-#if BITS_PER_LONG == 32 +- return (void *)(unsigned long)context; +-#else +- void *p = pHba->ioctl_reply_context[context]; +- pHba->ioctl_reply_context[context] = NULL; +- +- return p; +-#endif +-} +- + /*=========================================================================== + * Error Handling routines + *=========================================================================== +@@ -1652,208 +1607,6 @@ static int adpt_close(struct inode *inode, struct file *file) + return 0; + } + +- +-static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg) +-{ +- u32 msg[MAX_MESSAGE_SIZE]; +- u32* reply = NULL; +- u32 size = 0; +- u32 reply_size = 0; +- u32 __user *user_msg = arg; +- u32 __user * user_reply = NULL; +- void **sg_list = NULL; +- u32 sg_offset = 0; +- u32 sg_count = 0; +- int sg_index = 0; +- u32 i = 0; +- u32 rcode = 0; +- void *p = NULL; +- dma_addr_t addr; +- ulong flags = 0; +- +- memset(&msg, 0, MAX_MESSAGE_SIZE*4); +- // get user msg size in u32s +- if(get_user(size, &user_msg[0])){ +- return -EFAULT; +- } +- size = size>>16; +- +- user_reply = &user_msg[size]; +- if(size > MAX_MESSAGE_SIZE){ +- return -EFAULT; +- } +- size *= 4; // Convert to bytes +- +- /* Copy in the user's I2O command */ +- if(copy_from_user(msg, user_msg, size)) { +- return -EFAULT; +- } +- get_user(reply_size, &user_reply[0]); +- reply_size = reply_size>>16; +- if(reply_size > REPLY_FRAME_SIZE){ +- reply_size = REPLY_FRAME_SIZE; +- } +- reply_size *= 4; +- reply = kzalloc(REPLY_FRAME_SIZE*4, GFP_KERNEL); +- if(reply == NULL) { +- printk(KERN_WARNING"%s: Could not allocate reply buffer\n",pHba->name); +- return -ENOMEM; +- } +- sg_offset = (msg[0]>>4)&0xf; +- msg[2] = 0x40000000; // IOCTL context +- msg[3] = adpt_ioctl_to_context(pHba, reply); +- if (msg[3] == (u32)-1) { +- rcode = -EBUSY; +- goto free; +- } +- +- sg_list = kcalloc(pHba->sg_tablesize, sizeof(*sg_list), GFP_KERNEL); +- if (!sg_list) { +- rcode = -ENOMEM; +- goto free; +- } +- if(sg_offset) { +- // TODO add 64 bit API +- struct sg_simple_element *sg = (struct sg_simple_element*) (msg+sg_offset); +- sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element); +- if (sg_count > pHba->sg_tablesize){ +- printk(KERN_DEBUG"%s:IOCTL SG List too large (%u)\n", pHba->name,sg_count); +- rcode = -EINVAL; +- goto free; +- } +- +- for(i = 0; i < sg_count; i++) { +- int sg_size; +- +- if (!(sg[i].flag_count & 0x10000000 /*I2O_SGL_FLAGS_SIMPLE_ADDRESS_ELEMENT*/)) { +- printk(KERN_DEBUG"%s:Bad SG element %d - not simple (%x)\n",pHba->name,i, sg[i].flag_count); +- rcode = -EINVAL; +- goto cleanup; +- } +- sg_size = sg[i].flag_count & 0xffffff; +- /* Allocate memory for the transfer */ +- p = dma_alloc_coherent(&pHba->pDev->dev, sg_size, &addr, GFP_KERNEL); +- if(!p) { +- printk(KERN_DEBUG"%s: Could not allocate SG buffer - size = %d buffer number %d of %d\n", +- pHba->name,sg_size,i,sg_count); +- rcode = -ENOMEM; +- goto cleanup; +- } +- sg_list[sg_index++] = p; // sglist indexed with input frame, not our internal frame. +- /* Copy in the user's SG buffer if necessary */ +- if(sg[i].flag_count & 0x04000000 /*I2O_SGL_FLAGS_DIR*/) { +- // sg_simple_element API is 32 bit +- if (copy_from_user(p,(void __user *)(ulong)sg[i].addr_bus, sg_size)) { +- printk(KERN_DEBUG"%s: Could not copy SG buf %d FROM user\n",pHba->name,i); +- rcode = -EFAULT; +- goto cleanup; +- } +- } +- /* sg_simple_element API is 32 bit, but addr < 4GB */ +- sg[i].addr_bus = addr; +- } +- } +- +- do { +- /* +- * Stop any new commands from enterring the +- * controller while processing the ioctl +- */ +- if (pHba->host) { +- scsi_block_requests(pHba->host); +- spin_lock_irqsave(pHba->host->host_lock, flags); +- } +- rcode = adpt_i2o_post_wait(pHba, msg, size, FOREVER); +- if (rcode != 0) +- printk("adpt_i2o_passthru: post wait failed %d %p\n", +- rcode, reply); +- if (pHba->host) { +- spin_unlock_irqrestore(pHba->host->host_lock, flags); +- scsi_unblock_requests(pHba->host); +- } +- } while (rcode == -ETIMEDOUT); +- +- if(rcode){ +- goto cleanup; +- } +- +- if(sg_offset) { +- /* Copy back the Scatter Gather buffers back to user space */ +- u32 j; +- // TODO add 64 bit API +- struct sg_simple_element* sg; +- int sg_size; +- +- // re-acquire the original message to handle correctly the sg copy operation +- memset(&msg, 0, MAX_MESSAGE_SIZE*4); +- // get user msg size in u32s +- if(get_user(size, &user_msg[0])){ +- rcode = -EFAULT; +- goto cleanup; +- } +- size = size>>16; +- size *= 4; +- if (size > MAX_MESSAGE_SIZE) { +- rcode = -EINVAL; +- goto cleanup; +- } +- /* Copy in the user's I2O command */ +- if (copy_from_user (msg, user_msg, size)) { +- rcode = -EFAULT; +- goto cleanup; +- } +- sg_count = (size - sg_offset*4) / sizeof(struct sg_simple_element); +- +- // TODO add 64 bit API +- sg = (struct sg_simple_element*)(msg + sg_offset); +- for (j = 0; j < sg_count; j++) { +- /* Copy out the SG list to user's buffer if necessary */ +- if(! (sg[j].flag_count & 0x4000000 /*I2O_SGL_FLAGS_DIR*/)) { +- sg_size = sg[j].flag_count & 0xffffff; +- // sg_simple_element API is 32 bit +- if (copy_to_user((void __user *)(ulong)sg[j].addr_bus,sg_list[j], sg_size)) { +- printk(KERN_WARNING"%s: Could not copy %p TO user %x\n",pHba->name, sg_list[j], sg[j].addr_bus); +- rcode = -EFAULT; +- goto cleanup; +- } +- } +- } +- } +- +- /* Copy back the reply to user space */ +- if (reply_size) { +- // we wrote our own values for context - now restore the user supplied ones +- if(copy_from_user(reply+2, user_msg+2, sizeof(u32)*2)) { +- printk(KERN_WARNING"%s: Could not copy message context FROM user\n",pHba->name); +- rcode = -EFAULT; +- } +- if(copy_to_user(user_reply, reply, reply_size)) { +- printk(KERN_WARNING"%s: Could not copy reply TO user\n",pHba->name); +- rcode = -EFAULT; +- } +- } +- +- +-cleanup: +- if (rcode != -ETIME && rcode != -EINTR) { +- struct sg_simple_element *sg = +- (struct sg_simple_element*) (msg +sg_offset); +- while(sg_index) { +- if(sg_list[--sg_index]) { +- dma_free_coherent(&pHba->pDev->dev, +- sg[sg_index].flag_count & 0xffffff, +- sg_list[sg_index], +- sg[sg_index].addr_bus); +- } +- } +- } +- +-free: +- kfree(sg_list); +- kfree(reply); +- return rcode; +-} +- + #if defined __ia64__ + static void adpt_ia64_info(sysInfo_S* si) + { +@@ -1980,8 +1733,6 @@ static int adpt_ioctl(struct inode *inode, struct file *file, uint cmd, ulong ar + return -EFAULT; + } + break; +- case I2OUSRCMD: +- return adpt_i2o_passthru(pHba, argp); + + case DPT_CTRLINFO:{ + drvrHBAinfo_S HbaInfo; +@@ -2118,7 +1869,7 @@ static irqreturn_t adpt_isr(int irq, void *dev_id) + } else { + /* Ick, we should *never* be here */ + printk(KERN_ERR "dpti: reply frame not from pool\n"); +- reply = (u8 *)bus_to_virt(m); ++ continue; + } + + if (readl(reply) & MSG_FAIL) { +@@ -2138,13 +1889,6 @@ static irqreturn_t adpt_isr(int irq, void *dev_id) + adpt_send_nop(pHba, old_m); + } + context = readl(reply+8); +- if(context & 0x40000000){ // IOCTL +- void *p = adpt_ioctl_from_context(pHba, readl(reply+12)); +- if( p != NULL) { +- memcpy_fromio(p, reply, REPLY_FRAME_SIZE * 4); +- } +- // All IOCTLs will also be post wait +- } + if(context & 0x80000000){ // Post wait message + status = readl(reply+16); + if(status >> 24){ +@@ -2152,16 +1896,14 @@ static irqreturn_t adpt_isr(int irq, void *dev_id) + } else { + status = I2O_POST_WAIT_OK; + } +- if(!(context & 0x40000000)) { +- /* +- * The request tag is one less than the command tag +- * as the firmware might treat a 0 tag as invalid +- */ +- cmd = scsi_host_find_tag(pHba->host, +- readl(reply + 12) - 1); +- if(cmd != NULL) { +- printk(KERN_WARNING"%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n", pHba->name, cmd, context); +- } ++ /* ++ * The request tag is one less than the command tag ++ * as the firmware might treat a 0 tag as invalid ++ */ ++ cmd = scsi_host_find_tag(pHba->host, ++ readl(reply + 12) - 1); ++ if(cmd != NULL) { ++ printk(KERN_WARNING"%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n", pHba->name, cmd, context); + } + adpt_i2o_post_wait_complete(context, status); + } else { // SCSI message +diff --git a/drivers/scsi/dpti.h b/drivers/scsi/dpti.h +index 42b1e28b58846..87df0c1e0ab26 100644 +--- a/drivers/scsi/dpti.h ++++ b/drivers/scsi/dpti.h +@@ -248,7 +248,6 @@ typedef struct _adpt_hba { + void __iomem *FwDebugBLEDflag_P;// Virtual Addr Of FW Debug BLED + void __iomem *FwDebugBLEDvalue_P;// Virtual Addr Of FW Debug BLED + u32 FwDebugFlags; +- u32 *ioctl_reply_context[4]; + } adpt_hba; + + struct sg_simple_element { +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index fec653b54307a..cba30618e8fed 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4173,7 +4173,7 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + { + struct outbound_queue_table *circularQ; + void *pMsg1 = NULL; +- u8 uninitialized_var(bc); ++ u8 bc; + u32 ret = MPI_IO_STATUS_FAIL; + unsigned long flags; + +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index ce67965a504fa..bdc6812acf984 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -3813,7 +3813,7 @@ static int process_oq(struct pm8001_hba_info *pm8001_ha, u8 vec) + { + struct outbound_queue_table *circularQ; + void *pMsg1 = NULL; +- u8 uninitialized_var(bc); ++ u8 bc; + u32 ret = MPI_IO_STATUS_FAIL; + unsigned long flags; + u32 regval; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 490d6c72d8bd6..8d05faf95ac3b 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1534,6 +1534,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd) + */ + SCSI_LOG_MLQUEUE(3, scmd_printk(KERN_INFO, cmd, + "queuecommand : device blocked\n")); ++ atomic_dec(&cmd->device->iorequest_cnt); + return SCSI_MLQUEUE_DEVICE_BUSY; + } + +@@ -1566,6 +1567,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd) + trace_scsi_dispatch_cmd_start(cmd); + rtn = host->hostt->queuecommand(host, cmd); + if (rtn) { ++ atomic_dec(&cmd->device->iorequest_cnt); + trace_scsi_dispatch_cmd_error(cmd, rtn); + if (rtn != SCSI_MLQUEUE_DEVICE_BUSY && + rtn != SCSI_MLQUEUE_TARGET_BUSY) +diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c +index 159ffc2bb592f..20b6556e5dcb0 100644 +--- a/drivers/scsi/stex.c ++++ b/drivers/scsi/stex.c +@@ -109,7 +109,9 @@ enum { + TASK_ATTRIBUTE_HEADOFQUEUE = 0x1, + TASK_ATTRIBUTE_ORDERED = 0x2, + TASK_ATTRIBUTE_ACA = 0x4, ++}; + ++enum { + SS_STS_NORMAL = 0x80000000, + SS_STS_DONE = 0x40000000, + SS_STS_HANDSHAKE = 0x20000000, +@@ -121,7 +123,9 @@ enum { + SS_I2H_REQUEST_RESET = 0x2000, + + SS_MU_OPERATIONAL = 0x80000000, ++}; + ++enum { + STEX_CDB_LENGTH = 16, + STATUS_VAR_LEN = 128, + +diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c +index 3861cb659cb94..6c647ba4ba0b5 100644 +--- a/drivers/ssb/driver_chipcommon.c ++++ b/drivers/ssb/driver_chipcommon.c +@@ -119,7 +119,7 @@ void ssb_chipco_set_clockmode(struct ssb_chipcommon *cc, + static enum ssb_clksrc chipco_pctl_get_slowclksrc(struct ssb_chipcommon *cc) + { + struct ssb_bus *bus = cc->dev->bus; +- u32 uninitialized_var(tmp); ++ u32 tmp; + + if (cc->dev->id.revision < 6) { + if (bus->bustype == SSB_BUSTYPE_SSB || +@@ -149,7 +149,7 @@ static enum ssb_clksrc chipco_pctl_get_slowclksrc(struct ssb_chipcommon *cc) + /* Get maximum or minimum (depending on get_max flag) slowclock frequency. */ + static int chipco_pctl_clockfreqlimit(struct ssb_chipcommon *cc, int get_max) + { +- int uninitialized_var(limit); ++ int limit; + enum ssb_clksrc clocksrc; + int divisor = 1; + u32 tmp; +diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c +index 26581d2456c8f..44ffa2b4c9fce 100644 +--- a/drivers/tty/cyclades.c ++++ b/drivers/tty/cyclades.c +@@ -3643,7 +3643,7 @@ static int cy_pci_probe(struct pci_dev *pdev, + struct cyclades_card *card; + void __iomem *addr0 = NULL, *addr2 = NULL; + char *card_name = NULL; +- u32 uninitialized_var(mailbox); ++ u32 mailbox; + unsigned int device_id, nchan = 0, card_no, i, j; + unsigned char plx_ver; + int retval, irq; +diff --git a/drivers/tty/isicom.c b/drivers/tty/isicom.c +index fc38f96475bf2..3b2f9fb01aa0a 100644 +--- a/drivers/tty/isicom.c ++++ b/drivers/tty/isicom.c +@@ -1514,7 +1514,7 @@ static unsigned int card_count; + static int isicom_probe(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +- unsigned int uninitialized_var(signature), index; ++ unsigned int signature, index; + int retval = -EPERM; + struct isi_board *board = NULL; + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 0b57973e7c658..1d0124126eb22 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1376,34 +1376,36 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state) + + static void lpuart32_break_ctl(struct uart_port *port, int break_state) + { +- unsigned long temp, modem; +- struct tty_struct *tty; +- unsigned int cflag = 0; +- +- tty = tty_port_tty_get(&port->state->port); +- if (tty) { +- cflag = tty->termios.c_cflag; +- tty_kref_put(tty); +- } ++ unsigned long temp; + +- temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK; +- modem = lpuart32_read(port, UARTMODIR); ++ temp = lpuart32_read(port, UARTCTRL); + ++ /* ++ * LPUART IP now has two known bugs, one is CTS has higher priority than the ++ * break signal, which causes the break signal sending through UARTCTRL_SBK ++ * may impacted by the CTS input if the HW flow control is enabled. It ++ * exists on all platforms we support in this driver. ++ * Another bug is i.MX8QM LPUART may have an additional break character ++ * being sent after SBK was cleared. ++ * To avoid above two bugs, we use Transmit Data Inversion function to send ++ * the break signal instead of UARTCTRL_SBK. ++ */ + if (break_state != 0) { +- temp |= UARTCTRL_SBK; + /* +- * LPUART CTS has higher priority than SBK, need to disable CTS before +- * asserting SBK to avoid any interference if flow control is enabled. ++ * Disable the transmitter to prevent any data from being sent out ++ * during break, then invert the TX line to send break. + */ +- if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE) +- lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR); ++ temp &= ~UARTCTRL_TE; ++ lpuart32_write(port, temp, UARTCTRL); ++ temp |= UARTCTRL_TXINV; ++ lpuart32_write(port, temp, UARTCTRL); + } else { +- /* Re-enable the CTS when break off. */ +- if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE)) +- lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR); ++ /* Disable the TXINV to turn off break and re-enable transmitter. */ ++ temp &= ~UARTCTRL_TXINV; ++ lpuart32_write(port, temp, UARTCTRL); ++ temp |= UARTCTRL_TE; ++ lpuart32_write(port, temp, UARTCTRL); + } +- +- lpuart32_write(port, temp, UARTCTRL); + } + + static void lpuart_setup_watermark(struct lpuart_port *sport) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 5fe7490367734..588a659f245e6 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3628,6 +3628,7 @@ static void ffs_func_unbind(struct usb_configuration *c, + /* Drain any pending AIO completions */ + drain_workqueue(ffs->io_completion_wq); + ++ ffs_event_add(ffs, FUNCTIONFS_UNBIND); + if (!--opts->refcnt) + functionfs_unbind(ffs); + +@@ -3652,7 +3653,6 @@ static void ffs_func_unbind(struct usb_configuration *c, + func->function.ssp_descriptors = NULL; + func->interfaces_nums = NULL; + +- ffs_event_add(ffs, FUNCTIONFS_UNBIND); + } + + static struct usb_function *ffs_alloc(struct usb_function_instance *fi) +diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c +index b4d6d9bb32395..c545b27ea5681 100644 +--- a/drivers/usb/musb/cppi_dma.c ++++ b/drivers/usb/musb/cppi_dma.c +@@ -1146,7 +1146,7 @@ irqreturn_t cppi_interrupt(int irq, void *dev_id) + struct musb_hw_ep *hw_ep = NULL; + u32 rx, tx; + int i, index; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + + cppi = container_of(musb->dma_controller, struct cppi, controller); + if (cppi->irq) +diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c +index ba955d65eb0eb..c8a988d2cfdd3 100644 +--- a/drivers/usb/storage/sddr55.c ++++ b/drivers/usb/storage/sddr55.c +@@ -554,8 +554,8 @@ static int sddr55_reset(struct us_data *us) + + static unsigned long sddr55_get_capacity(struct us_data *us) { + +- unsigned char uninitialized_var(manufacturerID); +- unsigned char uninitialized_var(deviceID); ++ unsigned char manufacturerID; ++ unsigned char deviceID; + int result; + struct sddr55_card_info *info = (struct sddr55_card_info *)us->extra; + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 3e0267ead718d..b19d60adc606e 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -1049,7 +1049,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq, + /* len is always initialized before use since we are always called with + * datalen > 0. + */ +- u32 uninitialized_var(len); ++ u32 len; + + while (datalen > 0 && headcount < quota) { + if (unlikely(seg >= UIO_MAXIOV)) { +@@ -1106,7 +1106,7 @@ static void handle_rx(struct vhost_net *net) + { + struct vhost_net_virtqueue *nvq = &net->vqs[VHOST_NET_VQ_RX]; + struct vhost_virtqueue *vq = &nvq->vq; +- unsigned uninitialized_var(in), log; ++ unsigned in, log; + struct vhost_log *vq_log; + struct msghdr msg = { + .msg_name = NULL, +diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c +index 436365efae731..5bb2b07cbe1a0 100644 +--- a/drivers/video/fbdev/core/bitblit.c ++++ b/drivers/video/fbdev/core/bitblit.c +@@ -247,6 +247,9 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, int mode, + + cursor.set = 0; + ++ if (!vc->vc_font.data) ++ return; ++ + c = scr_readw((u16 *) vc->vc_pos); + attribute = get_attribute(info, c); + src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height)); +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 6473e0dfe1464..e78ec7f728463 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -257,6 +257,11 @@ static const struct fb_videomode modedb[] = { + { NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3, 0, + FB_VMODE_DOUBLE }, + ++ /* 1920x1080 @ 60 Hz, 67.3 kHz hsync */ ++ { NULL, 60, 1920, 1080, 6734, 148, 88, 36, 4, 44, 5, 0, ++ FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, ++ FB_VMODE_NONINTERLACED }, ++ + /* 1920x1200 @ 60 Hz, 74.5 Khz hsync */ + { NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3, + FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT, +diff --git a/drivers/video/fbdev/matrox/matroxfb_maven.c b/drivers/video/fbdev/matrox/matroxfb_maven.c +index eda893b7a2e9e..9a98c4a6ba331 100644 +--- a/drivers/video/fbdev/matrox/matroxfb_maven.c ++++ b/drivers/video/fbdev/matrox/matroxfb_maven.c +@@ -300,7 +300,7 @@ static int matroxfb_mavenclock(const struct matrox_pll_ctl *ctl, + unsigned int* in, unsigned int* feed, unsigned int* post, + unsigned int* htotal2) { + unsigned int fvco; +- unsigned int uninitialized_var(p); ++ unsigned int p; + + fvco = matroxfb_PLL_mavenclock(&maven1000_pll, ctl, htotal, vtotal, in, feed, &p, htotal2); + if (!fvco) +@@ -732,8 +732,8 @@ static int maven_find_exact_clocks(unsigned int ht, unsigned int vt, + + for (x = 0; x < 8; x++) { + unsigned int c; +- unsigned int uninitialized_var(a), uninitialized_var(b), +- uninitialized_var(h2); ++ unsigned int a, b, ++ h2; + unsigned int h = ht + 2 + x; + + if (!matroxfb_mavenclock((m->mode == MATROXFB_OUTPUT_MODE_PAL) ? &maven_PAL : &maven_NTSC, h, vt, &a, &b, &c, &h2)) { +diff --git a/drivers/video/fbdev/pm3fb.c b/drivers/video/fbdev/pm3fb.c +index 6130aa56a1e93..7bd45334dcac4 100644 +--- a/drivers/video/fbdev/pm3fb.c ++++ b/drivers/video/fbdev/pm3fb.c +@@ -821,9 +821,9 @@ static void pm3fb_write_mode(struct fb_info *info) + + wmb(); + { +- unsigned char uninitialized_var(m); /* ClkPreScale */ +- unsigned char uninitialized_var(n); /* ClkFeedBackScale */ +- unsigned char uninitialized_var(p); /* ClkPostScale */ ++ unsigned char m; /* ClkPreScale */ ++ unsigned char n; /* ClkFeedBackScale */ ++ unsigned char p; /* ClkPostScale */ + unsigned long pixclock = PICOS2KHZ(info->var.pixclock); + + (void)pm3fb_calculate_clock(pixclock, &m, &n, &p); +diff --git a/drivers/video/fbdev/riva/riva_hw.c b/drivers/video/fbdev/riva/riva_hw.c +index 0601c13f21050..f90b9327bae73 100644 +--- a/drivers/video/fbdev/riva/riva_hw.c ++++ b/drivers/video/fbdev/riva/riva_hw.c +@@ -1245,8 +1245,7 @@ int CalcStateExt + ) + { + int pixelDepth; +- int uninitialized_var(VClk),uninitialized_var(m), +- uninitialized_var(n), uninitialized_var(p); ++ int VClk, m, n, p; + + /* + * Save mode parameters. +diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c +index e606fc7287947..9c2be08026514 100644 +--- a/drivers/video/fbdev/stifb.c ++++ b/drivers/video/fbdev/stifb.c +@@ -1371,6 +1371,7 @@ out_err1: + iounmap(info->screen_base); + out_err0: + kfree(fb); ++ sti->info = NULL; + return -ENXIO; + } + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index deb72fd7ec504..b5c0509112769 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -424,7 +424,7 @@ static inline int virtqueue_add_split(struct virtqueue *_vq, + struct vring_virtqueue *vq = to_vvq(_vq); + struct scatterlist *sg; + struct vring_desc *desc; +- unsigned int i, n, avail, descs_used, uninitialized_var(prev), err_idx; ++ unsigned int i, n, avail, descs_used, prev, err_idx; + int head; + bool indirect; + +@@ -1101,8 +1101,8 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq, + struct vring_packed_desc *desc; + struct scatterlist *sg; + unsigned int i, n, c, descs_used, err_idx; +- __le16 uninitialized_var(head_flags), flags; +- u16 head, id, uninitialized_var(prev), curr, avail_used_flags; ++ __le16 head_flags, flags; ++ u16 head, id, prev, curr, avail_used_flags; + + START_USE(vq); + +diff --git a/drivers/watchdog/menz69_wdt.c b/drivers/watchdog/menz69_wdt.c +index ed18238c54074..96a25d18ab643 100644 +--- a/drivers/watchdog/menz69_wdt.c ++++ b/drivers/watchdog/menz69_wdt.c +@@ -98,14 +98,6 @@ static const struct watchdog_ops men_z069_ops = { + .set_timeout = men_z069_wdt_set_timeout, + }; + +-static struct watchdog_device men_z069_wdt = { +- .info = &men_z069_info, +- .ops = &men_z069_ops, +- .timeout = MEN_Z069_DEFAULT_TIMEOUT, +- .min_timeout = 1, +- .max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ, +-}; +- + static int men_z069_probe(struct mcb_device *dev, + const struct mcb_device_id *id) + { +@@ -125,15 +117,19 @@ static int men_z069_probe(struct mcb_device *dev, + goto release_mem; + + drv->mem = mem; ++ drv->wdt.info = &men_z069_info; ++ drv->wdt.ops = &men_z069_ops; ++ drv->wdt.timeout = MEN_Z069_DEFAULT_TIMEOUT; ++ drv->wdt.min_timeout = 1; ++ drv->wdt.max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ; + +- drv->wdt = men_z069_wdt; + watchdog_init_timeout(&drv->wdt, 0, &dev->dev); + watchdog_set_nowayout(&drv->wdt, nowayout); + watchdog_set_drvdata(&drv->wdt, drv); + drv->wdt.parent = &dev->dev; + mcb_set_drvdata(dev, drv); + +- return watchdog_register_device(&men_z069_wdt); ++ return watchdog_register_device(&drv->wdt); + + release_mem: + mcb_release_mem(mem); +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 3a355a209919b..43f5b972fcead 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -1023,7 +1023,7 @@ static int afs_d_revalidate_rcu(struct dentry *dentry) + static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + { + struct afs_vnode *vnode, *dir; +- struct afs_fid uninitialized_var(fid); ++ struct afs_fid fid; + struct dentry *parent; + struct inode *inode; + struct key *key; +diff --git a/fs/afs/security.c b/fs/afs/security.c +index ce9de1e6742b0..207a54ce45402 100644 +--- a/fs/afs/security.c ++++ b/fs/afs/security.c +@@ -401,7 +401,7 @@ int afs_check_permit(struct afs_vnode *vnode, struct key *key, + int afs_permission(struct inode *inode, int mask) + { + struct afs_vnode *vnode = AFS_FS_I(inode); +- afs_access_t uninitialized_var(access); ++ afs_access_t access; + struct key *key; + int ret = 0; + +diff --git a/fs/dlm/netlink.c b/fs/dlm/netlink.c +index e7f550327d5dd..e338c407cb75c 100644 +--- a/fs/dlm/netlink.c ++++ b/fs/dlm/netlink.c +@@ -113,7 +113,7 @@ static void fill_data(struct dlm_lock_data *data, struct dlm_lkb *lkb) + + void dlm_timeout_warn(struct dlm_lkb *lkb) + { +- struct sk_buff *uninitialized_var(send_skb); ++ struct sk_buff *send_skb; + struct dlm_lock_data *data; + size_t size; + int rv; +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 946804c3c4b13..9d86cf3a09bf7 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -938,11 +938,13 @@ do { \ + * where the second inode has larger inode number + * than the first + * I_DATA_SEM_QUOTA - Used for quota inodes only ++ * I_DATA_SEM_EA - Used for ea_inodes only + */ + enum { + I_DATA_SEM_NORMAL = 0, + I_DATA_SEM_OTHER, + I_DATA_SEM_QUOTA, ++ I_DATA_SEM_EA + }; + + +@@ -2609,7 +2611,8 @@ typedef enum { + EXT4_IGET_NORMAL = 0, + EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */ + EXT4_IGET_HANDLE = 0x0002, /* Inode # is from a handle */ +- EXT4_IGET_BAD = 0x0004 /* Allow to iget a bad inode */ ++ EXT4_IGET_BAD = 0x0004, /* Allow to iget a bad inode */ ++ EXT4_IGET_EA_INODE = 0x0008 /* Inode should contain an EA value */ + } ext4_iget_flags; + + extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index c078a8cc0c73f..51c67418ed020 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4903,6 +4903,24 @@ static inline u64 ext4_inode_peek_iversion(const struct inode *inode) + return inode_peek_iversion(inode); + } + ++static const char *check_igot_inode(struct inode *inode, ext4_iget_flags flags) ++ ++{ ++ if (flags & EXT4_IGET_EA_INODE) { ++ if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) ++ return "missing EA_INODE flag"; ++ if (ext4_test_inode_state(inode, EXT4_STATE_XATTR) || ++ EXT4_I(inode)->i_file_acl) ++ return "ea_inode with extended attributes"; ++ } else { ++ if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) ++ return "unexpected EA_INODE flag"; ++ } ++ if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) ++ return "unexpected bad inode w/o EXT4_IGET_BAD"; ++ return NULL; ++} ++ + struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + ext4_iget_flags flags, const char *function, + unsigned int line) +@@ -4911,6 +4929,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + struct ext4_inode *raw_inode; + struct ext4_inode_info *ei; + struct inode *inode; ++ const char *err_str; + journal_t *journal = EXT4_SB(sb)->s_journal; + long ret; + loff_t size; +@@ -4934,8 +4953,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + inode = iget_locked(sb, ino); + if (!inode) + return ERR_PTR(-ENOMEM); +- if (!(inode->i_state & I_NEW)) ++ if (!(inode->i_state & I_NEW)) { ++ if ((err_str = check_igot_inode(inode, flags)) != NULL) { ++ ext4_error_inode(inode, function, line, 0, err_str); ++ iput(inode); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + return inode; ++ } + + ei = EXT4_I(inode); + iloc.bh = NULL; +@@ -5200,10 +5225,9 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + if (IS_CASEFOLDED(inode) && !ext4_has_feature_casefold(inode->i_sb)) + ext4_error_inode(inode, function, line, 0, + "casefold flag without casefold feature"); +- if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) { +- ext4_error_inode(inode, function, line, 0, +- "bad inode without EXT4_IGET_BAD flag"); +- ret = -EUCLEAN; ++ if ((err_str = check_igot_inode(inode, flags)) != NULL) { ++ ext4_error_inode(inode, function, line, 0, err_str); ++ ret = -EFSCORRUPTED; + goto bad_inode; + } + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 498ef733b73c0..3440cddb5ffb8 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -121,7 +121,11 @@ ext4_expand_inode_array(struct ext4_xattr_inode_array **ea_inode_array, + #ifdef CONFIG_LOCKDEP + void ext4_xattr_inode_set_class(struct inode *ea_inode) + { ++ struct ext4_inode_info *ei = EXT4_I(ea_inode); ++ + lockdep_set_subclass(&ea_inode->i_rwsem, 1); ++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ ++ lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA); + } + #endif + +@@ -395,7 +399,7 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + return -EFSCORRUPTED; + } + +- inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL); ++ inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_EA_INODE); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); + ext4_error(parent->i_sb, +@@ -403,23 +407,6 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + err); + return err; + } +- +- if (is_bad_inode(inode)) { +- ext4_error(parent->i_sb, +- "error while reading EA inode %lu is_bad_inode", +- ea_ino); +- err = -EIO; +- goto error; +- } +- +- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { +- ext4_error(parent->i_sb, +- "EA inode %lu does not have EXT4_EA_INODE_FL flag", +- ea_ino); +- err = -EINVAL; +- goto error; +- } +- + ext4_xattr_inode_set_class(inode); + + /* +@@ -440,9 +427,6 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + + *ea_inode = inode; + return 0; +-error: +- iput(inode); +- return err; + } + + /* Remove entry from mbcache when EA inode is getting evicted */ +@@ -1517,11 +1501,11 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, + + while (ce) { + ea_inode = ext4_iget(inode->i_sb, ce->e_value, +- EXT4_IGET_NORMAL); +- if (!IS_ERR(ea_inode) && +- !is_bad_inode(ea_inode) && +- (EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) && +- i_size_read(ea_inode) == value_len && ++ EXT4_IGET_EA_INODE); ++ if (IS_ERR(ea_inode)) ++ goto next_entry; ++ ext4_xattr_inode_set_class(ea_inode); ++ if (i_size_read(ea_inode) == value_len && + !ext4_xattr_inode_read(ea_inode, ea_data, value_len) && + !ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data, + value_len) && +@@ -1531,9 +1515,8 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value, + kvfree(ea_data); + return ea_inode; + } +- +- if (!IS_ERR(ea_inode)) +- iput(ea_inode); ++ iput(ea_inode); ++ next_entry: + ce = mb_cache_entry_find_next(ea_inode_cache, ce); + } + kvfree(ea_data); +diff --git a/fs/fat/dir.c b/fs/fat/dir.c +index 054acd9fd0331..bd07a4383ae01 100644 +--- a/fs/fat/dir.c ++++ b/fs/fat/dir.c +@@ -1288,7 +1288,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots, + struct super_block *sb = dir->i_sb; + struct msdos_sb_info *sbi = MSDOS_SB(sb); + struct buffer_head *bh, *prev, *bhs[3]; /* 32*slots (672bytes) */ +- struct msdos_dir_entry *uninitialized_var(de); ++ struct msdos_dir_entry *de; + int err, free_slots, i, nr_bhs; + loff_t pos, i_pos; + +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index 2742d74cedda8..7092958c43ed7 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -120,7 +120,7 @@ static ssize_t fuse_conn_max_background_write(struct file *file, + const char __user *buf, + size_t count, loff_t *ppos) + { +- unsigned uninitialized_var(val); ++ unsigned val; + ssize_t ret; + + ret = fuse_conn_limit_write(file, buf, count, ppos, &val, +@@ -162,7 +162,7 @@ static ssize_t fuse_conn_congestion_threshold_write(struct file *file, + const char __user *buf, + size_t count, loff_t *ppos) + { +- unsigned uninitialized_var(val); ++ unsigned val; + struct fuse_conn *fc; + ssize_t ret; + +diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c +index e51b7019e8871..072b68fbf8f44 100644 +--- a/fs/fuse/cuse.c ++++ b/fs/fuse/cuse.c +@@ -270,7 +270,7 @@ static int cuse_parse_one(char **pp, char *end, char **keyp, char **valp) + static int cuse_parse_devinfo(char *p, size_t len, struct cuse_devinfo *devinfo) + { + char *end = p + len; +- char *uninitialized_var(key), *uninitialized_var(val); ++ char *key, *val; + int rc; + + while (true) { +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index 74e8fdc85f823..f6c499dbfd065 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2994,7 +2994,7 @@ static void fuse_register_polled_file(struct fuse_conn *fc, + { + spin_lock(&fc->lock); + if (RB_EMPTY_NODE(&ff->polled_node)) { +- struct rb_node **link, *uninitialized_var(parent); ++ struct rb_node **link, *parent; + + link = fuse_find_polled_node(fc, ff->kh, &parent); + BUG_ON(*link); +diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c +index 9dbe94c7d8e89..b1ce0061f127e 100644 +--- a/fs/gfs2/aops.c ++++ b/fs/gfs2/aops.c +@@ -336,7 +336,7 @@ static int gfs2_write_cache_jdata(struct address_space *mapping, + int done = 0; + struct pagevec pvec; + int nr_pages; +- pgoff_t uninitialized_var(writeback_index); ++ pgoff_t writeback_index; + pgoff_t index; + pgoff_t end; + pgoff_t done_index; +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index b349ba328a0b8..63e925aa12a75 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1763,7 +1763,7 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length) + u64 lblock = (offset + (1 << bsize_shift) - 1) >> bsize_shift; + __u16 start_list[GFS2_MAX_META_HEIGHT]; + __u16 __end_list[GFS2_MAX_META_HEIGHT], *end_list = NULL; +- unsigned int start_aligned, uninitialized_var(end_aligned); ++ unsigned int start_aligned, end_aligned; + unsigned int strip_h = ip->i_height - 1; + u32 btotal = 0; + int ret, state; +diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c +index d2ed4dc4434cd..4aaaf3a4203cf 100644 +--- a/fs/gfs2/lops.c ++++ b/fs/gfs2/lops.c +@@ -414,7 +414,7 @@ static bool gfs2_jhead_pg_srch(struct gfs2_jdesc *jd, + struct page *page) + { + struct gfs2_sbd *sdp = GFS2_SB(jd->jd_inode); +- struct gfs2_log_header_host uninitialized_var(lh); ++ struct gfs2_log_header_host lh; + void *kaddr = kmap_atomic(page); + unsigned int offset; + bool ret = false; +diff --git a/fs/hfsplus/unicode.c b/fs/hfsplus/unicode.c +index c8d1b2be7854e..73342c925a4b6 100644 +--- a/fs/hfsplus/unicode.c ++++ b/fs/hfsplus/unicode.c +@@ -398,7 +398,7 @@ int hfsplus_hash_dentry(const struct dentry *dentry, struct qstr *str) + astr = str->name; + len = str->len; + while (len > 0) { +- int uninitialized_var(dsize); ++ int dsize; + size = asc2unichar(sb, astr, len, &c); + astr += size; + len -= size; +diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c +index 558e7c51ce0d4..58f80e1b3ac0d 100644 +--- a/fs/isofs/namei.c ++++ b/fs/isofs/namei.c +@@ -153,8 +153,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry, + struct dentry *isofs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) + { + int found; +- unsigned long uninitialized_var(block); +- unsigned long uninitialized_var(offset); ++ unsigned long block; ++ unsigned long offset; + struct inode *inode; + struct page *page; + +diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c +index 83b8f06b4a642..7e9abdb897122 100644 +--- a/fs/jffs2/erase.c ++++ b/fs/jffs2/erase.c +@@ -401,7 +401,7 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb + { + size_t retlen; + int ret; +- uint32_t uninitialized_var(bad_offset); ++ uint32_t bad_offset; + + switch (jffs2_block_check_erase(c, jeb, &bad_offset)) { + case -EAGAIN: goto refile; +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index a2454739b1cfa..ce72869315adb 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -351,7 +351,7 @@ static ssize_t write_unlock_fs(struct file *file, char *buf, size_t size) + static ssize_t write_filehandle(struct file *file, char *buf, size_t size) + { + char *dname, *path; +- int uninitialized_var(maxsize); ++ int maxsize; + char *mesg = buf; + int len; + struct auth_domain *dom; +diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c +index 4db87b26cf7b2..52ccd8d4ed820 100644 +--- a/fs/ocfs2/alloc.c ++++ b/fs/ocfs2/alloc.c +@@ -4708,7 +4708,7 @@ int ocfs2_insert_extent(handle_t *handle, + struct ocfs2_alloc_context *meta_ac) + { + int status; +- int uninitialized_var(free_records); ++ int free_records; + struct buffer_head *last_eb_bh = NULL; + struct ocfs2_insert_type insert = {0, }; + struct ocfs2_extent_rec rec; +@@ -7052,7 +7052,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + int need_free = 0; + u32 bit_off, num; + handle_t *handle; +- u64 uninitialized_var(block); ++ u64 block; + struct ocfs2_inode_info *oi = OCFS2_I(inode); + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data; +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index bdef72c0f0991..49b9c61459c5d 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -848,9 +848,9 @@ static int ocfs2_dx_dir_lookup(struct inode *inode, + u64 *ret_phys_blkno) + { + int ret = 0; +- unsigned int cend, uninitialized_var(clen); +- u32 uninitialized_var(cpos); +- u64 uninitialized_var(blkno); ++ unsigned int cend, clen; ++ u32 cpos; ++ u64 blkno; + u32 name_hash = hinfo->major_hash; + + ret = ocfs2_dx_dir_lookup_rec(inode, el, name_hash, &cpos, &blkno, +@@ -894,7 +894,7 @@ static int ocfs2_dx_dir_search(const char *name, int namelen, + struct ocfs2_dir_lookup_result *res) + { + int ret, i, found; +- u64 uninitialized_var(phys); ++ u64 phys; + struct buffer_head *dx_leaf_bh = NULL; + struct ocfs2_dx_leaf *dx_leaf; + struct ocfs2_dx_entry *dx_entry = NULL; +@@ -4393,9 +4393,9 @@ out: + int ocfs2_dx_dir_truncate(struct inode *dir, struct buffer_head *di_bh) + { + int ret; +- unsigned int uninitialized_var(clen); +- u32 major_hash = UINT_MAX, p_cpos, uninitialized_var(cpos); +- u64 uninitialized_var(blkno); ++ unsigned int clen; ++ u32 major_hash = UINT_MAX, p_cpos, cpos; ++ u64 blkno; + struct ocfs2_super *osb = OCFS2_SB(dir->i_sb); + struct buffer_head *dx_root_bh = NULL; + struct ocfs2_dx_root_block *dx_root; +diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h +index aaf24548b02a1..0463dce65bb22 100644 +--- a/fs/ocfs2/dlm/dlmcommon.h ++++ b/fs/ocfs2/dlm/dlmcommon.h +@@ -688,10 +688,6 @@ struct dlm_begin_reco + __be32 pad2; + }; + +- +-#define BITS_PER_BYTE 8 +-#define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) +- + struct dlm_query_join_request + { + u8 node_idx; +diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c +index e3e2d1b2af51a..f3926765c3f01 100644 +--- a/fs/ocfs2/extent_map.c ++++ b/fs/ocfs2/extent_map.c +@@ -403,7 +403,7 @@ static int ocfs2_get_clusters_nocache(struct inode *inode, + { + int i, ret, tree_height, len; + struct ocfs2_dinode *di; +- struct ocfs2_extent_block *uninitialized_var(eb); ++ struct ocfs2_extent_block *eb; + struct ocfs2_extent_list *el; + struct ocfs2_extent_rec *rec; + struct buffer_head *eb_bh = NULL; +@@ -599,7 +599,7 @@ int ocfs2_get_clusters(struct inode *inode, u32 v_cluster, + unsigned int *extent_flags) + { + int ret; +- unsigned int uninitialized_var(hole_len), flags = 0; ++ unsigned int hole_len, flags = 0; + struct buffer_head *di_bh = NULL; + struct ocfs2_extent_rec rec; + +diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c +index e1a83fc8f2eb9..fb284bf3aed15 100644 +--- a/fs/ocfs2/namei.c ++++ b/fs/ocfs2/namei.c +@@ -2491,7 +2491,7 @@ int ocfs2_create_inode_in_orphan(struct inode *dir, + struct buffer_head *new_di_bh = NULL; + struct ocfs2_alloc_context *inode_ac = NULL; + struct ocfs2_dir_lookup_result orphan_insert = { NULL, }; +- u64 uninitialized_var(di_blkno), suballoc_loc; ++ u64 di_blkno, suballoc_loc; + u16 suballoc_bit; + + status = ocfs2_inode_lock(dir, &parent_di_bh, 1); +diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c +index ee43e51188be9..3f812d348d6b5 100644 +--- a/fs/ocfs2/refcounttree.c ++++ b/fs/ocfs2/refcounttree.c +@@ -1061,7 +1061,7 @@ static int ocfs2_get_refcount_rec(struct ocfs2_caching_info *ci, + struct buffer_head **ret_bh) + { + int ret = 0, i, found; +- u32 low_cpos, uninitialized_var(cpos_end); ++ u32 low_cpos, cpos_end; + struct ocfs2_extent_list *el; + struct ocfs2_extent_rec *rec = NULL; + struct ocfs2_extent_block *eb = NULL; +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 90c830e3758e2..9ccd19d8f7b18 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -1211,7 +1211,7 @@ static int ocfs2_xattr_block_get(struct inode *inode, + struct ocfs2_xattr_value_root *xv; + size_t size; + int ret = -ENODATA, name_offset, name_len, i; +- int uninitialized_var(block_off); ++ int block_off; + + xs->bucket = ocfs2_xattr_bucket_new(inode); + if (!xs->bucket) { +diff --git a/fs/omfs/file.c b/fs/omfs/file.c +index d640b93882385..b08881b35ac38 100644 +--- a/fs/omfs/file.c ++++ b/fs/omfs/file.c +@@ -220,7 +220,7 @@ static int omfs_get_block(struct inode *inode, sector_t block, + struct buffer_head *bh; + sector_t next, offset; + int ret; +- u64 uninitialized_var(new_block); ++ u64 new_block; + u32 max_extents; + int extent_count; + struct omfs_extent *oe; +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 143c52de97ecc..1bfd1660a66c0 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -741,7 +741,7 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c) + struct path upperpath, datapath; + int err; + char *capability = NULL; +- ssize_t uninitialized_var(cap_size); ++ ssize_t cap_size; + + ovl_path_upper(c->dentry, &upperpath); + if (WARN_ON(upperpath.dentry == NULL)) +diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c +index ad292c5a43a9a..b5cdac9b0368d 100644 +--- a/fs/ubifs/commit.c ++++ b/fs/ubifs/commit.c +@@ -552,11 +552,11 @@ out: + */ + int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot) + { +- int lnum, offs, len, err = 0, uninitialized_var(last_level), child_cnt; ++ int lnum, offs, len, err = 0, last_level, child_cnt; + int first = 1, iip; + struct ubifs_debug_info *d = c->dbg; +- union ubifs_key uninitialized_var(lower_key), upper_key, l_key, u_key; +- unsigned long long uninitialized_var(last_sqnum); ++ union ubifs_key lower_key, upper_key, l_key, u_key; ++ unsigned long long last_sqnum; + struct ubifs_idx_node *idx; + struct list_head list; + struct idx_node *i; +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index a5294e7379099..88beae18e3c44 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -1278,7 +1278,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + struct ubifs_budget_req ino_req = { .dirtied_ino = 1, + .dirtied_ino_d = ALIGN(old_inode_ui->data_len, 8) }; + struct timespec64 time; +- unsigned int uninitialized_var(saved_nlink); ++ unsigned int saved_nlink; + struct fscrypt_name old_nm, new_nm; + + /* +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 177cd4a751ebb..4d3a5cb6e9b03 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -222,7 +222,7 @@ static int write_begin_slow(struct address_space *mapping, + struct ubifs_info *c = inode->i_sb->s_fs_info; + pgoff_t index = pos >> PAGE_SHIFT; + struct ubifs_budget_req req = { .new_page = 1 }; +- int uninitialized_var(err), appending = !!(pos + len > inode->i_size); ++ int err, appending = !!(pos + len > inode->i_size); + struct page *page; + + dbg_gen("ino %lu, pos %llu, len %u, i_size %lld", +@@ -426,7 +426,7 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping, + struct ubifs_info *c = inode->i_sb->s_fs_info; + struct ubifs_inode *ui = ubifs_inode(inode); + pgoff_t index = pos >> PAGE_SHIFT; +- int uninitialized_var(err), appending = !!(pos + len > inode->i_size); ++ int err, appending = !!(pos + len > inode->i_size); + int skipped_read = 0; + struct page *page; + +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index f78c3e3ef9314..99f391293c5e3 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -1225,7 +1225,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ; + int last_reference = !!(new_inode && new_inode->i_nlink == 0); + int move = (old_dir != new_dir); +- struct ubifs_inode *uninitialized_var(new_ui); ++ struct ubifs_inode *new_ui; + u8 hash_old_dir[UBIFS_HASH_ARR_SZ]; + u8 hash_new_dir[UBIFS_HASH_ARR_SZ]; + u8 hash_new_inode[UBIFS_HASH_ARR_SZ]; +@@ -1511,7 +1511,7 @@ int ubifs_jnl_truncate(struct ubifs_info *c, const struct inode *inode, + union ubifs_key key, to_key; + struct ubifs_ino_node *ino; + struct ubifs_trun_node *trun; +- struct ubifs_data_node *uninitialized_var(dn); ++ struct ubifs_data_node *dn; + int err, dlen, len, lnum, offs, bit, sz, sync = IS_SYNC(inode); + struct ubifs_inode *ui = ubifs_inode(inode); + ino_t inum = inode->i_ino; +diff --git a/fs/ubifs/lpt.c b/fs/ubifs/lpt.c +index e21abf2509519..6e0a153b71942 100644 +--- a/fs/ubifs/lpt.c ++++ b/fs/ubifs/lpt.c +@@ -275,7 +275,7 @@ uint32_t ubifs_unpack_bits(const struct ubifs_info *c, uint8_t **addr, int *pos, + const int k = 32 - nrbits; + uint8_t *p = *addr; + int b = *pos; +- uint32_t uninitialized_var(val); ++ uint32_t val; + const int bytes = (nrbits + b + 7) >> 3; + + ubifs_assert(c, nrbits > 0); +diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c +index 91543e3b5b3fe..c8b99a86b63f4 100644 +--- a/fs/ubifs/tnc.c ++++ b/fs/ubifs/tnc.c +@@ -929,7 +929,7 @@ static int fallible_resolve_collision(struct ubifs_info *c, + int adding) + { + struct ubifs_znode *o_znode = NULL, *znode = *zn; +- int uninitialized_var(o_n), err, cmp, unsure = 0, nn = *n; ++ int o_n, err, cmp, unsure = 0, nn = *n; + + cmp = fallible_matches_name(c, &znode->zbranch[nn], nm); + if (unlikely(cmp < 0)) +@@ -1551,8 +1551,8 @@ out: + */ + int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu) + { +- int n, err = 0, lnum = -1, uninitialized_var(offs); +- int uninitialized_var(len); ++ int n, err = 0, lnum = -1, offs; ++ int len; + unsigned int block = key_block(c, &bu->key); + struct ubifs_znode *znode; + +diff --git a/fs/ubifs/tnc_misc.c b/fs/ubifs/tnc_misc.c +index 49cb34c3f3243..ccaf94ea5be35 100644 +--- a/fs/ubifs/tnc_misc.c ++++ b/fs/ubifs/tnc_misc.c +@@ -126,8 +126,8 @@ int ubifs_search_zbranch(const struct ubifs_info *c, + const struct ubifs_znode *znode, + const union ubifs_key *key, int *n) + { +- int beg = 0, end = znode->child_cnt, uninitialized_var(mid); +- int uninitialized_var(cmp); ++ int beg = 0, end = znode->child_cnt, mid; ++ int cmp; + const struct ubifs_zbranch *zbr = &znode->zbranch[0]; + + ubifs_assert(c, end > beg); +diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c +index 02f03fadb75b3..8e597db4d9710 100644 +--- a/fs/udf/balloc.c ++++ b/fs/udf/balloc.c +@@ -564,7 +564,7 @@ static udf_pblk_t udf_table_new_block(struct super_block *sb, + udf_pblk_t newblock = 0; + uint32_t adsize; + uint32_t elen, goal_elen = 0; +- struct kernel_lb_addr eloc, uninitialized_var(goal_eloc); ++ struct kernel_lb_addr eloc, goal_eloc; + struct extent_position epos, goal_epos; + int8_t etype; + struct udf_inode_info *iinfo = UDF_I(table); +diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c +index 2462dabb5ab84..32170ce2984c0 100644 +--- a/fs/xfs/xfs_bmap_util.c ++++ b/fs/xfs/xfs_bmap_util.c +@@ -125,7 +125,7 @@ xfs_bmap_rtalloc( + * pick an extent that will space things out in the rt area. + */ + if (ap->eof && ap->offset == 0) { +- xfs_rtblock_t uninitialized_var(rtx); /* realtime extent no */ ++ xfs_rtblock_t rtx; /* realtime extent no */ + + error = xfs_rtpick_extent(mp, ap->tp, ralen, &rtx); + if (error) +diff --git a/include/linux/bitops.h b/include/linux/bitops.h +index 4f0e62cbf2ffe..e9e74af163fab 100644 +--- a/include/linux/bitops.h ++++ b/include/linux/bitops.h +@@ -13,6 +13,7 @@ + + #define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE) + #define BITS_TO_LONGS(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(long)) ++#define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) + + extern unsigned int __sw_hweight8(unsigned int w); + extern unsigned int __sw_hweight16(unsigned int w); +diff --git a/include/media/dvb_net.h b/include/media/dvb_net.h +index 5e31d37f25fac..cc01dffcc9f35 100644 +--- a/include/media/dvb_net.h ++++ b/include/media/dvb_net.h +@@ -41,6 +41,9 @@ + * @exit: flag to indicate when the device is being removed. + * @demux: pointer to &struct dmx_demux. + * @ioctl_mutex: protect access to this struct. ++ * @remove_mutex: mutex that avoids a race condition between a callback ++ * called when the hardware is disconnected and the ++ * file_operations of dvb_net. + * + * Currently, the core supports up to %DVB_NET_DEVICES_MAX (10) network + * devices. +@@ -53,6 +56,7 @@ struct dvb_net { + unsigned int exit:1; + struct dmx_demux *demux; + struct mutex ioctl_mutex; ++ struct mutex remove_mutex; + }; + + /** +diff --git a/include/net/sock.h b/include/net/sock.h +index fa19c6ba24441..06fdb8f207b69 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -309,6 +309,7 @@ struct bpf_sk_storage; + * @sk_cgrp_data: cgroup data for this cgroup + * @sk_memcg: this socket's memory cgroup association + * @sk_write_pending: a write to stream socket waits to start ++ * @sk_wait_pending: number of threads blocked on this socket + * @sk_state_change: callback to indicate change in the state of the sock + * @sk_data_ready: callback to indicate there is data to be processed + * @sk_write_space: callback to indicate there is bf sending space available +@@ -390,6 +391,7 @@ struct sock { + unsigned int sk_napi_id; + #endif + int sk_rcvbuf; ++ int sk_wait_pending; + + struct sk_filter __rcu *sk_filter; + union { +@@ -1019,6 +1021,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk) + + #define sk_wait_event(__sk, __timeo, __condition, __wait) \ + ({ int __rc; \ ++ __sk->sk_wait_pending++; \ + release_sock(__sk); \ + __rc = __condition; \ + if (!__rc) { \ +@@ -1028,6 +1031,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk) + } \ + sched_annotate_sleep(); \ + lock_sock(__sk); \ ++ __sk->sk_wait_pending--; \ + __rc = __condition; \ + __rc; \ + }) +diff --git a/kernel/async.c b/kernel/async.c +index 74660f611b97d..1746cd65e271b 100644 +--- a/kernel/async.c ++++ b/kernel/async.c +@@ -111,7 +111,7 @@ static void async_run_entry_fn(struct work_struct *work) + struct async_entry *entry = + container_of(work, struct async_entry, work); + unsigned long flags; +- ktime_t uninitialized_var(calltime), delta, rettime; ++ ktime_t calltime, delta, rettime; + + /* 1) run (and print duration) */ + if (initcall_debug && system_state < SYSTEM_RUNNING) { +@@ -284,7 +284,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain); + */ + void async_synchronize_cookie_domain(async_cookie_t cookie, struct async_domain *domain) + { +- ktime_t uninitialized_var(starttime), delta, endtime; ++ ktime_t starttime, delta, endtime; + + if (initcall_debug && system_state < SYSTEM_RUNNING) { + pr_debug("async_waiting @ %i\n", task_pid_nr(current)); +diff --git a/kernel/audit.c b/kernel/audit.c +index db8141866ceaa..805b0c9972d35 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1796,7 +1796,7 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, + { + struct audit_buffer *ab; + struct timespec64 t; +- unsigned int uninitialized_var(serial); ++ unsigned int serial; + + if (audit_initialized != AUDIT_INITIALIZED) + return NULL; +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index 9a4837b68e18f..5ecd52a4bb213 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -887,7 +887,7 @@ static int device_dma_allocations(struct device *dev, struct dma_debug_entry **o + static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data) + { + struct device *dev = data; +- struct dma_debug_entry *uninitialized_var(entry); ++ struct dma_debug_entry *entry; + int count; + + if (dma_debug_disabled()) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 41a8a5f749409..c4a44ef836b02 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10942,7 +10942,7 @@ SYSCALL_DEFINE5(perf_event_open, + struct perf_event *group_leader = NULL, *output_event = NULL; + struct perf_event *event, *sibling; + struct perf_event_attr attr; +- struct perf_event_context *ctx, *uninitialized_var(gctx); ++ struct perf_event_context *ctx, *gctx; + struct file *event_file = NULL; + struct fd group = {NULL, 0}; + struct task_struct *task = NULL; +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index a793bd23fe56c..1799427a384ae 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -2195,7 +2195,7 @@ static void handle_swbp(struct pt_regs *regs) + { + struct uprobe *uprobe; + unsigned long bp_vaddr; +- int uninitialized_var(is_swbp); ++ int is_swbp; + + bp_vaddr = uprobe_get_swbp_addr(regs); + if (bp_vaddr == get_trampoline_vaddr()) +diff --git a/kernel/exit.c b/kernel/exit.c +index 563bdaa766945..c764d16328f6a 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -141,7 +141,7 @@ static void __exit_signal(struct task_struct *tsk) + struct signal_struct *sig = tsk->signal; + bool group_dead = thread_group_leader(tsk); + struct sighand_struct *sighand; +- struct tty_struct *uninitialized_var(tty); ++ struct tty_struct *tty; + u64 utime, stime; + + sighand = rcu_dereference_check(tsk->sighand, +diff --git a/kernel/extable.c b/kernel/extable.c +index f6c9406eec7db..14bda7cab65f0 100644 +--- a/kernel/extable.c ++++ b/kernel/extable.c +@@ -34,7 +34,8 @@ u32 __initdata __visible main_extable_sort_needed = 1; + /* Sort the kernel's built-in exception table */ + void __init sort_main_extable(void) + { +- if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) { ++ if (main_extable_sort_needed && ++ &__stop___ex_table > &__start___ex_table) { + pr_notice("Sorting __ex_table...\n"); + sort_extable(__start___ex_table, __stop___ex_table); + } +diff --git a/kernel/futex.c b/kernel/futex.c +index f82879ae6577c..d51bbb398142c 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1416,7 +1416,7 @@ static int lookup_pi_state(u32 __user *uaddr, u32 uval, + static int lock_pi_update_atomic(u32 __user *uaddr, u32 uval, u32 newval) + { + int err; +- u32 uninitialized_var(curval); ++ u32 curval; + + if (unlikely(should_fail_futex(true))) + return -EFAULT; +@@ -1586,7 +1586,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + */ + static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_state) + { +- u32 uninitialized_var(curval), newval; ++ u32 curval, newval; + struct task_struct *new_owner; + bool postunlock = false; + DEFINE_WAKE_Q(wake_q); +@@ -3085,7 +3085,7 @@ uaddr_faulted: + */ + static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags) + { +- u32 uninitialized_var(curval), uval, vpid = task_pid_vnr(current); ++ u32 curval, uval, vpid = task_pid_vnr(current); + union futex_key key = FUTEX_KEY_INIT; + struct futex_hash_bucket *hb; + struct futex_q *top_waiter; +@@ -3553,7 +3553,7 @@ err_unlock: + static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, + bool pi, bool pending_op) + { +- u32 uval, uninitialized_var(nval), mval; ++ u32 uval, nval, mval; + int err; + + /* Futex address must be 32bit aligned */ +@@ -3683,7 +3683,7 @@ static void exit_robust_list(struct task_struct *curr) + struct robust_list_head __user *head = curr->robust_list; + struct robust_list __user *entry, *next_entry, *pending; + unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; +- unsigned int uninitialized_var(next_pi); ++ unsigned int next_pi; + unsigned long futex_offset; + int rc; + +@@ -3982,7 +3982,7 @@ static void compat_exit_robust_list(struct task_struct *curr) + struct compat_robust_list_head __user *head = curr->compat_robust_list; + struct robust_list __user *entry, *next_entry, *pending; + unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; +- unsigned int uninitialized_var(next_pi); ++ unsigned int next_pi; + compat_uptr_t uentry, next_uentry, upending; + compat_long_t futex_offset; + int rc; +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index db109d38f301e..0d9ff8b621e6d 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -1705,7 +1705,7 @@ static int noop_count(struct lock_list *entry, void *data) + static unsigned long __lockdep_count_forward_deps(struct lock_list *this) + { + unsigned long count = 0; +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry; + + __bfs_forwards(this, (void *)&count, noop_count, &target_entry); + +@@ -1733,7 +1733,7 @@ unsigned long lockdep_count_forward_deps(struct lock_class *class) + static unsigned long __lockdep_count_backward_deps(struct lock_list *this) + { + unsigned long count = 0; +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry; + + __bfs_backwards(this, (void *)&count, noop_count, &target_entry); + +@@ -1790,7 +1790,7 @@ check_noncircular(struct held_lock *src, struct held_lock *target, + struct lock_trace **const trace) + { + int ret; +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry; + struct lock_list src_entry = { + .class = hlock_class(src), + .parent = NULL, +@@ -1828,7 +1828,7 @@ static noinline int + check_redundant(struct held_lock *src, struct held_lock *target) + { + int ret; +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry; + struct lock_list src_entry = { + .class = hlock_class(src), + .parent = NULL, +@@ -2334,8 +2334,8 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev, + { + unsigned long usage_mask = 0, forward_mask, backward_mask; + enum lock_usage_bit forward_bit = 0, backward_bit = 0; +- struct lock_list *uninitialized_var(target_entry1); +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry1; ++ struct lock_list *target_entry; + struct lock_list this, that; + int ret; + +@@ -3336,7 +3336,7 @@ check_usage_backwards(struct task_struct *curr, struct held_lock *this, + { + int ret; + struct lock_list root; +- struct lock_list *uninitialized_var(target_entry); ++ struct lock_list *target_entry; + + root.parent = NULL; + root.class = hlock_class(this); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 43f452b5deff6..c24039c4d75ab 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -611,7 +611,7 @@ static void rb_wake_up_waiters(struct irq_work *work) + */ + int ring_buffer_wait(struct ring_buffer *buffer, int cpu, int full) + { +- struct ring_buffer_per_cpu *uninitialized_var(cpu_buffer); ++ struct ring_buffer_per_cpu *cpu_buffer; + DEFINE_WAIT(wait); + struct rb_irq_work *work; + int ret = 0; +diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h +index bab9e0dba9af2..dc19d5d185d43 100644 +--- a/kernel/trace/trace_probe.h ++++ b/kernel/trace/trace_probe.h +@@ -302,7 +302,7 @@ trace_probe_primary_from_call(struct trace_event_call *call) + { + struct trace_probe_event *tpe = trace_probe_event_from_call(call); + +- return list_first_entry(&tpe->probes, struct trace_probe, list); ++ return list_first_entry_or_null(&tpe->probes, struct trace_probe, list); + } + + static inline struct list_head *trace_probe_probe_list(struct trace_probe *tp) +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index c9e1960fefc8e..1ce2fa9dc5adc 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -1015,7 +1015,7 @@ static int __init dynamic_debug_init(void) + int n = 0, entries = 0, modct = 0; + int verbose_bytes = 0; + +- if (__start___verbose == __stop___verbose) { ++ if (&__start___verbose == &__stop___verbose) { + pr_warn("_ddebug table is empty in a CONFIG_DYNAMIC_DEBUG build\n"); + return 1; + } +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index c8fa1d2745302..18349781847ca 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -1039,7 +1039,7 @@ void *radix_tree_tag_clear(struct radix_tree_root *root, + { + struct radix_tree_node *node, *parent; + unsigned long maxindex; +- int uninitialized_var(offset); ++ int offset; + + radix_tree_load_root(root, &node, &maxindex); + if (index > maxindex) +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index 0169073ec2b9a..3146845f01562 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -38,6 +38,7 @@ struct test_batched_req { + bool sent; + const struct firmware *fw; + const char *name; ++ const char *fw_buf; + struct completion completion; + struct task_struct *task; + struct device *dev; +@@ -134,8 +135,14 @@ static void __test_release_all_firmware(void) + + for (i = 0; i < test_fw_config->num_requests; i++) { + req = &test_fw_config->reqs[i]; +- if (req->fw) ++ if (req->fw) { ++ if (req->fw_buf) { ++ kfree_const(req->fw_buf); ++ req->fw_buf = NULL; ++ } + release_firmware(req->fw); ++ req->fw = NULL; ++ } + } + + vfree(test_fw_config->reqs); +@@ -489,6 +496,8 @@ static ssize_t trigger_request_store(struct device *dev, + + mutex_lock(&test_fw_mutex); + release_firmware(test_firmware); ++ if (test_fw_config->reqs) ++ __test_release_all_firmware(); + test_firmware = NULL; + rc = request_firmware(&test_firmware, name, dev); + if (rc) { +@@ -531,6 +540,8 @@ static ssize_t trigger_async_request_store(struct device *dev, + mutex_lock(&test_fw_mutex); + release_firmware(test_firmware); + test_firmware = NULL; ++ if (test_fw_config->reqs) ++ __test_release_all_firmware(); + rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL, + NULL, trigger_async_request_cb); + if (rc) { +@@ -573,6 +584,8 @@ static ssize_t trigger_custom_fallback_store(struct device *dev, + + mutex_lock(&test_fw_mutex); + release_firmware(test_firmware); ++ if (test_fw_config->reqs) ++ __test_release_all_firmware(); + test_firmware = NULL; + rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOHOTPLUG, name, + dev, GFP_KERNEL, NULL, +@@ -625,6 +638,8 @@ static int test_fw_run_batch_request(void *data) + TEST_FIRMWARE_BUF_SIZE); + if (!req->fw) + kfree(test_buf); ++ else ++ req->fw_buf = test_buf; + } else { + req->rc = test_fw_config->req_firmware(&req->fw, + req->name, +@@ -680,6 +695,7 @@ static ssize_t trigger_batched_requests_store(struct device *dev, + req->fw = NULL; + req->idx = i; + req->name = test_fw_config->name; ++ req->fw_buf = NULL; + req->dev = dev; + init_completion(&req->completion); + req->task = kthread_run(test_fw_run_batch_request, req, +@@ -779,6 +795,7 @@ ssize_t trigger_batched_requests_async_store(struct device *dev, + for (i = 0; i < test_fw_config->num_requests; i++) { + req = &test_fw_config->reqs[i]; + req->name = test_fw_config->name; ++ req->fw_buf = NULL; + req->fw = NULL; + req->idx = i; + init_completion(&req->completion); +diff --git a/mm/frontswap.c b/mm/frontswap.c +index 60bb20e8a9510..fd3337702513c 100644 +--- a/mm/frontswap.c ++++ b/mm/frontswap.c +@@ -446,7 +446,7 @@ static int __frontswap_shrink(unsigned long target_pages, + void frontswap_shrink(unsigned long target_pages) + { + unsigned long pages_to_unuse = 0; +- int uninitialized_var(type), ret; ++ int type, ret; + + /* + * we don't want to hold swap_lock while doing a very +diff --git a/mm/ksm.c b/mm/ksm.c +index 0bbae78aaaa0a..93e1898cd705e 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -2388,7 +2388,7 @@ next_mm: + static void ksm_do_scan(unsigned int scan_npages) + { + struct rmap_item *rmap_item; +- struct page *uninitialized_var(page); ++ struct page *page; + + while (scan_npages-- && likely(!freezing(current))) { + cond_resched(); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 16beae167d8c5..0140629b7cb20 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -1044,7 +1044,7 @@ struct mem_cgroup *mem_cgroup_iter(struct mem_cgroup *root, + struct mem_cgroup *prev, + struct mem_cgroup_reclaim_cookie *reclaim) + { +- struct mem_cgroup_reclaim_iter *uninitialized_var(iter); ++ struct mem_cgroup_reclaim_iter *iter; + struct cgroup_subsys_state *css = NULL; + struct mem_cgroup *memcg = NULL; + struct mem_cgroup *pos = NULL; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 36c2a9619ba56..2bf4ab7b2713d 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1160,7 +1160,7 @@ int do_migrate_pages(struct mm_struct *mm, const nodemask_t *from, + static struct page *new_page(struct page *page, unsigned long start) + { + struct vm_area_struct *vma; +- unsigned long uninitialized_var(address); ++ unsigned long address; + + vma = find_vma(current->mm, start); + while (vma) { +@@ -1555,7 +1555,7 @@ static int kernel_get_mempolicy(int __user *policy, + unsigned long flags) + { + int err; +- int uninitialized_var(pval); ++ int pval; + nodemask_t nodes; + + addr = untagged_addr(addr); +diff --git a/mm/percpu.c b/mm/percpu.c +index 806bc16f88eb8..2e4b286c88c89 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -2536,7 +2536,7 @@ static struct pcpu_alloc_info * __init pcpu_build_alloc_info( + const size_t static_size = __per_cpu_end - __per_cpu_start; + int nr_groups = 1, nr_units = 0; + size_t size_sum, min_unit_size, alloc_size; +- int upa, max_upa, uninitialized_var(best_upa); /* units_per_alloc */ ++ int upa, max_upa, best_upa; /* units_per_alloc */ + int last_allocs, group, unit; + unsigned int cpu, tcpu; + struct pcpu_alloc_info *ai; +diff --git a/mm/slub.c b/mm/slub.c +index 17e663cf38f69..e978f647e92aa 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1198,7 +1198,7 @@ static noinline int free_debug_processing( + struct kmem_cache_node *n = get_node(s, page_to_nid(page)); + void *object = head; + int cnt = 0; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + int ret = 0; + + spin_lock_irqsave(&n->list_lock, flags); +@@ -2888,7 +2888,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page, + struct page new; + unsigned long counters; + struct kmem_cache_node *n = NULL; +- unsigned long uninitialized_var(flags); ++ unsigned long flags; + + stat(s, FREE_SLOWPATH); + +diff --git a/mm/swap.c b/mm/swap.c +index 38c3fa4308e21..1c5021b57e2cd 100644 +--- a/mm/swap.c ++++ b/mm/swap.c +@@ -763,8 +763,8 @@ void release_pages(struct page **pages, int nr) + LIST_HEAD(pages_to_free); + struct pglist_data *locked_pgdat = NULL; + struct lruvec *lruvec; +- unsigned long uninitialized_var(flags); +- unsigned int uninitialized_var(lock_batch); ++ unsigned long flags; ++ unsigned int lock_batch; + + for (i = 0; i < nr; i++) { + struct page *page = pages[i]; +diff --git a/net/atm/resources.c b/net/atm/resources.c +index 889349c6d90db..04b2235c5c261 100644 +--- a/net/atm/resources.c ++++ b/net/atm/resources.c +@@ -443,6 +443,7 @@ done: + return error; + } + ++#ifdef CONFIG_PROC_FS + void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos) + { + mutex_lock(&atm_dev_mutex); +@@ -458,3 +459,4 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos) + { + return seq_list_next(v, &atm_devs, pos); + } ++#endif +diff --git a/net/core/sock.c b/net/core/sock.c +index 7f6f1a0bf8a13..5e1dccbd61a60 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1938,7 +1938,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) + { + u32 max_segs = 1; + +- sk_dst_set(sk, dst); + sk->sk_route_caps = dst->dev->features | sk->sk_route_forced_caps; + if (sk->sk_route_caps & NETIF_F_GSO) + sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE; +@@ -1953,6 +1952,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) + } + } + sk->sk_gso_max_segs = max_segs; ++ sk_dst_set(sk, dst); + } + EXPORT_SYMBOL_GPL(sk_setup_caps); + +diff --git a/net/dccp/options.c b/net/dccp/options.c +index 3b42f5c6a63dd..9fed0ae21e63e 100644 +--- a/net/dccp/options.c ++++ b/net/dccp/options.c +@@ -56,7 +56,7 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq, + (dh->dccph_doff * 4); + struct dccp_options_received *opt_recv = &dp->dccps_options_received; + unsigned char opt, len; +- unsigned char *uninitialized_var(value); ++ unsigned char *value; + u32 elapsed_time; + __be32 opt_val; + int rc; +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index 3c6412cb4b486..a3f77ac173b53 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -578,6 +578,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias) + + add_wait_queue(sk_sleep(sk), &wait); + sk->sk_write_pending += writebias; ++ sk->sk_wait_pending++; + + /* Basic assumption: if someone sets sk->sk_err, he _must_ + * change state of the socket from TCP_SYN_*. +@@ -593,6 +594,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias) + } + remove_wait_queue(sk_sleep(sk), &wait); + sk->sk_write_pending -= writebias; ++ sk->sk_wait_pending--; + return timeo; + } + +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 04593893e0c63..374a0c3f39cc1 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -824,6 +824,7 @@ struct sock *inet_csk_clone_lock(const struct sock *sk, + if (newsk) { + struct inet_connection_sock *newicsk = inet_csk(newsk); + ++ newsk->sk_wait_pending = 0; + inet_sk_set_state(newsk, TCP_SYN_RECV); + newicsk->icsk_bind_hash = NULL; + +diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c +index 36a28d46149c8..1b669e9a3ca78 100644 +--- a/net/ipv4/netfilter/nf_socket_ipv4.c ++++ b/net/ipv4/netfilter/nf_socket_ipv4.c +@@ -92,11 +92,11 @@ nf_socket_get_sock_v4(struct net *net, struct sk_buff *skb, const int doff, + struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb, + const struct net_device *indev) + { +- __be32 uninitialized_var(daddr), uninitialized_var(saddr); +- __be16 uninitialized_var(dport), uninitialized_var(sport); ++ __be32 daddr, saddr; ++ __be16 dport, sport; + const struct iphdr *iph = ip_hdr(skb); + struct sk_buff *data_skb = NULL; +- u8 uninitialized_var(protocol); ++ u8 protocol; + #if IS_ENABLED(CONFIG_NF_CONNTRACK) + enum ip_conntrack_info ctinfo; + struct nf_conn const *ct; +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index a74965a6a54f4..fdf2ddc4864df 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2581,6 +2581,12 @@ int tcp_disconnect(struct sock *sk, int flags) + int old_state = sk->sk_state; + u32 seq; + ++ /* Deny disconnect if other threads are blocked in sk_wait_event() ++ * or inet_wait_for_connect(). ++ */ ++ if (sk->sk_wait_pending) ++ return -EBUSY; ++ + if (old_state != TCP_CLOSE) + tcp_set_state(sk, TCP_CLOSE); + +@@ -3445,7 +3451,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level, + switch (optname) { + case TCP_MAXSEG: + val = tp->mss_cache; +- if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) ++ if (tp->rx_opt.user_mss && ++ ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + val = tp->rx_opt.user_mss; + if (tp->repair) + val = tp->rx_opt.mss_clamp; +diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c +index d64b83e856428..e6e1190a6ed9e 100644 +--- a/net/ipv6/ip6_flowlabel.c ++++ b/net/ipv6/ip6_flowlabel.c +@@ -535,7 +535,7 @@ int ipv6_flowlabel_opt_get(struct sock *sk, struct in6_flowlabel_req *freq, + + int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen) + { +- int uninitialized_var(err); ++ int err; + struct net *net = sock_net(sk); + struct ipv6_pinfo *np = inet6_sk(sk); + struct in6_flowlabel_req freq; +diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c +index 69c021704abd7..aa5bb8789ba0b 100644 +--- a/net/ipv6/netfilter/nf_socket_ipv6.c ++++ b/net/ipv6/netfilter/nf_socket_ipv6.c +@@ -97,7 +97,7 @@ nf_socket_get_sock_v6(struct net *net, struct sk_buff *skb, int doff, + struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, + const struct net_device *indev) + { +- __be16 uninitialized_var(dport), uninitialized_var(sport); ++ __be16 dport, sport; + const struct in6_addr *daddr = NULL, *saddr = NULL; + struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var; + struct sk_buff *data_skb = NULL; +diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c +index 9eca90414bb70..b22801f97bcec 100644 +--- a/net/netfilter/nf_conntrack_ftp.c ++++ b/net/netfilter/nf_conntrack_ftp.c +@@ -382,7 +382,7 @@ static int help(struct sk_buff *skb, + int ret; + u32 seq; + int dir = CTINFO2DIR(ctinfo); +- unsigned int uninitialized_var(matchlen), uninitialized_var(matchoff); ++ unsigned int matchlen, matchoff; + struct nf_ct_ftp_master *ct_ftp_info = nfct_help_data(ct); + struct nf_conntrack_expect *exp; + union nf_inet_addr *daddr; +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 754f473ce3de4..4328d10ad1bc3 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -2704,7 +2704,9 @@ nla_put_failure: + return -1; + } + ++#if IS_ENABLED(CONFIG_NF_NAT) + static const union nf_inet_addr any_addr; ++#endif + + static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp) + { +@@ -3204,10 +3206,12 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x, + return 0; + } + ++#if IS_ENABLED(CONFIG_NF_NAT) + static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = { + [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 }, + [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED }, + }; ++#endif + + static int + ctnetlink_parse_expect_nat(const struct nlattr *attr, +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index b36af4741ad3c..33c13edbca4bb 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -689,7 +689,7 @@ nfulnl_log_packet(struct net *net, + struct nfnl_log_net *log = nfnl_log_pernet(net); + const struct nfnl_ct_hook *nfnl_ct = NULL; + struct nf_conn *ct = NULL; +- enum ip_conntrack_info uninitialized_var(ctinfo); ++ enum ip_conntrack_info ctinfo; + + if (li_user && li_user->type == NF_LOG_TYPE_ULOG) + li = li_user; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index 581bd1353a447..ad88904ee3f90 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -388,7 +388,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, + struct net_device *indev; + struct net_device *outdev; + struct nf_conn *ct = NULL; +- enum ip_conntrack_info uninitialized_var(ctinfo); ++ enum ip_conntrack_info ctinfo; + struct nfnl_ct_hook *nfnl_ct; + bool csum_verify; + char *secdata = NULL; +@@ -1188,7 +1188,7 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, + struct nfqnl_instance *queue; + unsigned int verdict; + struct nf_queue_entry *entry; +- enum ip_conntrack_info uninitialized_var(ctinfo); ++ enum ip_conntrack_info ctinfo; + struct nfnl_ct_hook *nfnl_ct; + struct nf_conn *ct = NULL; + struct nfnl_queue_net *q = nfnl_queue_pernet(net); +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 31a3a562854fc..bf7e300e8c25d 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1780,7 +1780,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + break; + } + } +- if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) ++ if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen)) + err = -EFAULT; + netlink_unlock_table(); + return err; +diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c +index 3f99b432ea707..e2d2af924cff4 100644 +--- a/net/netrom/nr_subr.c ++++ b/net/netrom/nr_subr.c +@@ -123,7 +123,7 @@ void nr_write_internal(struct sock *sk, int frametype) + unsigned char *dptr; + int len, timeout; + +- len = NR_NETWORK_LEN + NR_TRANSPORT_LEN; ++ len = NR_TRANSPORT_LEN; + + switch (frametype & 0x0F) { + case NR_CONNREQ: +@@ -141,7 +141,8 @@ void nr_write_internal(struct sock *sk, int frametype) + return; + } + +- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL) ++ skb = alloc_skb(NR_NETWORK_LEN + len, GFP_ATOMIC); ++ if (!skb) + return; + + /* +@@ -149,7 +150,7 @@ void nr_write_internal(struct sock *sk, int frametype) + */ + skb_reserve(skb, NR_NETWORK_LEN); + +- dptr = skb_put(skb, skb_tailroom(skb)); ++ dptr = skb_put(skb, len); + + switch (frametype & 0x0F) { + case NR_CONNREQ: +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 7a940f2f30671..fbe3434dcdc1e 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3128,6 +3128,9 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, + + lock_sock(sk); + spin_lock(&po->bind_lock); ++ if (!proto) ++ proto = po->num; ++ + rcu_read_lock(); + + if (po->fanout) { +@@ -3230,7 +3233,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); + name[sizeof(uaddr->sa_data)] = 0; + +- return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); ++ return packet_do_bind(sk, name, 0, 0); + } + + static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) +@@ -3247,8 +3250,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len + if (sll->sll_family != AF_PACKET) + return -EINVAL; + +- return packet_do_bind(sk, NULL, sll->sll_ifindex, +- sll->sll_protocol ? : pkt_sk(sk)->num); ++ return packet_do_bind(sk, NULL, sll->sll_ifindex, sll->sll_protocol); + } + + static struct proto packet_proto = { +diff --git a/net/packet/diag.c b/net/packet/diag.c +index d704c7bf51b20..a68a84574c739 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -143,7 +143,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + rp = nlmsg_data(nlh); + rp->pdiag_family = AF_PACKET; + rp->pdiag_type = sk->sk_type; +- rp->pdiag_num = ntohs(po->num); ++ rp->pdiag_num = ntohs(READ_ONCE(po->num)); + rp->pdiag_ino = sk_ino; + sock_diag_save_cookie(sk, rp->pdiag_cookie); + +diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c +index ab53a93b2f2ba..87398af2715a3 100644 +--- a/net/sched/cls_flow.c ++++ b/net/sched/cls_flow.c +@@ -225,7 +225,7 @@ static u32 flow_get_skgid(const struct sk_buff *skb) + + static u32 flow_get_vlan_tag(const struct sk_buff *skb) + { +- u16 uninitialized_var(tag); ++ u16 tag; + + if (vlan_get_tag(skb, &tag) < 0) + return 0; +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 007fbc1993522..f21c97f02d361 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -270,14 +270,16 @@ static struct cls_fl_filter *fl_lookup_range(struct fl_flow_mask *mask, + return NULL; + } + +-static struct cls_fl_filter *fl_lookup(struct fl_flow_mask *mask, +- struct fl_flow_key *mkey, +- struct fl_flow_key *key) ++static noinline_for_stack ++struct cls_fl_filter *fl_mask_lookup(struct fl_flow_mask *mask, struct fl_flow_key *key) + { ++ struct fl_flow_key mkey; ++ ++ fl_set_masked_key(&mkey, key, mask); + if ((mask->flags & TCA_FLOWER_MASK_FLAGS_RANGE)) +- return fl_lookup_range(mask, mkey, key); ++ return fl_lookup_range(mask, &mkey, key); + +- return __fl_lookup(mask, mkey); ++ return __fl_lookup(mask, &mkey); + } + + static u16 fl_ct_info_to_flower_map[] = { +@@ -297,7 +299,6 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp, + struct tcf_result *res) + { + struct cls_fl_head *head = rcu_dereference_bh(tp->root); +- struct fl_flow_key skb_mkey; + struct fl_flow_key skb_key; + struct fl_flow_mask *mask; + struct cls_fl_filter *f; +@@ -317,9 +318,7 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp, + ARRAY_SIZE(fl_ct_info_to_flower_map)); + skb_flow_dissect(skb, &mask->dissector, &skb_key, 0); + +- fl_set_masked_key(&skb_mkey, &skb_key, mask); +- +- f = fl_lookup(mask, &skb_mkey, &skb_key); ++ f = fl_mask_lookup(mask, &skb_key); + if (f && !tc_skip_sw(f->flags)) { + *res = f->res; + return tcf_exts_exec(skb, &f->exts, res); +@@ -870,6 +869,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key, + if (option_len > sizeof(struct geneve_opt)) + data_len = option_len - sizeof(struct geneve_opt); + ++ if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4) ++ return -ERANGE; ++ + opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len]; + memset(opt, 0xff, option_len); + opt->length = data_len / 4; +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index 67d6bc97e5fe9..6ca0cba8aad16 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1214,7 +1214,12 @@ static struct Qdisc *qdisc_create(struct net_device *dev, + sch->parent = parent; + + if (handle == TC_H_INGRESS) { +- sch->flags |= TCQ_F_INGRESS; ++ if (!(sch->flags & TCQ_F_INGRESS)) { ++ NL_SET_ERR_MSG(extack, ++ "Specified parent ID is reserved for ingress and clsact Qdiscs"); ++ err = -EINVAL; ++ goto err_out3; ++ } + handle = TC_H_MAKE(TC_H_INGRESS, 0); + } else { + if (handle == 0) { +@@ -1574,11 +1579,20 @@ replay: + NL_SET_ERR_MSG(extack, "Invalid qdisc name"); + return -EINVAL; + } ++ if (q->flags & TCQ_F_INGRESS) { ++ NL_SET_ERR_MSG(extack, ++ "Cannot regraft ingress or clsact Qdiscs"); ++ return -EINVAL; ++ } + if (q == p || + (p && check_loop(q, p, 0))) { + NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected"); + return -ELOOP; + } ++ if (clid == TC_H_INGRESS) { ++ NL_SET_ERR_MSG(extack, "Ingress cannot graft directly"); ++ return -EINVAL; ++ } + qdisc_refcount_inc(q); + goto graft; + } else { +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 9e5e7fda0f4a9..7ee0b57b3ed4c 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -1660,7 +1660,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, + { + struct cake_sched_data *q = qdisc_priv(sch); + int len = qdisc_pkt_len(skb); +- int uninitialized_var(ret); ++ int ret; + struct sk_buff *ack = NULL; + ktime_t now = ktime_get(); + struct cake_tin_data *b; +diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c +index 12893dac84616..e6b84de418619 100644 +--- a/net/sched/sch_cbq.c ++++ b/net/sched/sch_cbq.c +@@ -361,7 +361,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct sk_buff **to_free) + { + struct cbq_sched_data *q = qdisc_priv(sch); +- int uninitialized_var(ret); ++ int ret; + struct cbq_class *cl = cbq_classify(skb, sch, &ret); + + #ifdef CONFIG_NET_CLS_ACT +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 86fb2f953bd5b..30796bb549728 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -188,7 +188,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct fq_codel_sched_data *q = qdisc_priv(sch); + unsigned int idx, prev_backlog, prev_qlen; + struct fq_codel_flow *flow; +- int uninitialized_var(ret); ++ int ret; + unsigned int pkt_len; + bool memory_limited; + +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index 433f2190960fe..92ad4115e473c 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1533,7 +1533,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) + { + unsigned int len = qdisc_pkt_len(skb); + struct hfsc_class *cl; +- int uninitialized_var(err); ++ int err; + bool first; + + cl = hfsc_classify(skb, sch, &err); +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index 27cb82b6237da..4cdf2dd04701f 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -582,7 +582,7 @@ static inline void htb_deactivate(struct htb_sched *q, struct htb_class *cl) + static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct sk_buff **to_free) + { +- int uninitialized_var(ret); ++ int ret; + unsigned int len = qdisc_pkt_len(skb); + struct htb_sched *q = qdisc_priv(sch); + struct htb_class *cl = htb_classify(skb, sch, &ret); +diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c +index bf56aa5197974..28168799ca1b8 100644 +--- a/net/sched/sch_ingress.c ++++ b/net/sched/sch_ingress.c +@@ -79,6 +79,9 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt, + struct ingress_sched_data *q = qdisc_priv(sch); + struct net_device *dev = qdisc_dev(sch); + ++ if (sch->parent != TC_H_INGRESS) ++ return -EOPNOTSUPP; ++ + net_inc_ingress_queue(); + + mini_qdisc_pair_init(&q->miniqp, sch, &dev->miniq_ingress); +@@ -94,6 +97,9 @@ static void ingress_destroy(struct Qdisc *sch) + { + struct ingress_sched_data *q = qdisc_priv(sch); + ++ if (sch->parent != TC_H_INGRESS) ++ return; ++ + tcf_block_put_ext(q->block, sch, &q->block_info); + net_dec_ingress_queue(); + } +@@ -127,7 +133,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = { + .cl_ops = &ingress_class_ops, + .id = "ingress", + .priv_size = sizeof(struct ingress_sched_data), +- .static_flags = TCQ_F_CPUSTATS, ++ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, + .init = ingress_init, + .destroy = ingress_destroy, + .dump = ingress_dump, +@@ -212,6 +218,9 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt, + struct net_device *dev = qdisc_dev(sch); + int err; + ++ if (sch->parent != TC_H_CLSACT) ++ return -EOPNOTSUPP; ++ + net_inc_ingress_queue(); + net_inc_egress_queue(); + +@@ -239,6 +248,9 @@ static void clsact_destroy(struct Qdisc *sch) + { + struct clsact_sched_data *q = qdisc_priv(sch); + ++ if (sch->parent != TC_H_CLSACT) ++ return; ++ + tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info); + tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info); + +@@ -260,7 +272,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = { + .cl_ops = &clsact_class_ops, + .id = "clsact", + .priv_size = sizeof(struct clsact_sched_data), +- .static_flags = TCQ_F_CPUSTATS, ++ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, + .init = clsact_init, + .destroy = clsact_destroy, + .dump = ingress_dump, +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index b92bafaf83f36..d7f910610de97 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -349,7 +349,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) + unsigned int hash, dropped; + sfq_index x, qlen; + struct sfq_slot *slot; +- int uninitialized_var(ret); ++ int ret; + struct sk_buff *head; + int delta; + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 81f0e03b71b6d..3095442b03822 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -496,8 +496,8 @@ xs_read_stream_request(struct sock_xprt *transport, struct msghdr *msg, + int flags, struct rpc_rqst *req) + { + struct xdr_buf *buf = &req->rq_private_buf; +- size_t want, uninitialized_var(read); +- ssize_t uninitialized_var(ret); ++ size_t want, read; ++ ssize_t ret; + + xs_read_header(transport, buf); + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 7614dec1e60cf..f4091fba4c722 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -677,7 +677,7 @@ static int tls_push_record(struct sock *sk, int flags, + struct tls_prot_info *prot = &tls_ctx->prot_info; + struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx); + struct tls_rec *rec = ctx->open_rec, *tmp = NULL; +- u32 i, split_point, uninitialized_var(orig_end); ++ u32 i, split_point, orig_end; + struct sk_msg *msg_pl, *msg_en; + struct aead_request *req; + bool split; +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 6f58be5a17711..9d4b405659058 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3223,7 +3223,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl) + + static inline int + xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, +- unsigned short family) ++ unsigned short family, u32 if_id) + { + if (xfrm_state_kern(x)) + return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family); +@@ -3234,7 +3234,8 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, + (tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) || + !(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) && + !(x->props.mode != XFRM_MODE_TRANSPORT && +- xfrm_state_addr_cmp(tmpl, x, family)); ++ xfrm_state_addr_cmp(tmpl, x, family)) && ++ (if_id == 0 || if_id == x->if_id); + } + + /* +@@ -3246,7 +3247,7 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x, + */ + static inline int + xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start, +- unsigned short family) ++ unsigned short family, u32 if_id) + { + int idx = start; + +@@ -3256,7 +3257,7 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int star + } else + start = -1; + for (; idx < sp->len; idx++) { +- if (xfrm_state_ok(tmpl, sp->xvec[idx], family)) ++ if (xfrm_state_ok(tmpl, sp->xvec[idx], family, if_id)) + return ++idx; + if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) { + if (start == -1) +@@ -3666,7 +3667,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, + * are implied between each two transformations. + */ + for (i = xfrm_nr-1, k = 0; i >= 0; i--) { +- k = xfrm_policy_ok(tpp[i], sp, k, family); ++ k = xfrm_policy_ok(tpp[i], sp, k, family, if_id); + if (k < 0) { + if (k < -1) + /* "-2 - errored_index" returned */ +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index c371634f35a3b..b8798cd58aee3 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -22,5 +22,9 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE ++# once make >= 4.3 is required, we can use grouped targets in the rule below, ++# which basically involves adding both headers and a '&' before the colon, see ++# the example below: ++# $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/... ++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c +index ccc7f3d78f626..766679037a700 100644 +--- a/sound/core/control_compat.c ++++ b/sound/core/control_compat.c +@@ -223,7 +223,7 @@ static int copy_ctl_value_from_user(struct snd_card *card, + { + struct snd_ctl_elem_value32 __user *data32 = userdata; + int i, type, size; +- int uninitialized_var(count); ++ int count; + unsigned int indirect; + + if (copy_from_user(&data->id, &data32->id, sizeof(data->id))) +diff --git a/sound/core/oss/pcm_plugin.h b/sound/core/oss/pcm_plugin.h +index 8d2f7a4e3ab67..0e1c8cae6c5bd 100644 +--- a/sound/core/oss/pcm_plugin.h ++++ b/sound/core/oss/pcm_plugin.h +@@ -141,6 +141,14 @@ int snd_pcm_area_copy(const struct snd_pcm_channel_area *src_channel, + + void *snd_pcm_plug_buf_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t size); + void snd_pcm_plug_buf_unlock(struct snd_pcm_substream *plug, void *ptr); ++#else ++ ++static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; } ++static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; } ++static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; } ++ ++#endif ++ + snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, + const char *ptr, snd_pcm_uframes_t size, + int in_kernel); +@@ -151,14 +159,6 @@ snd_pcm_sframes_t snd_pcm_oss_writev3(struct snd_pcm_substream *substream, + snd_pcm_sframes_t snd_pcm_oss_readv3(struct snd_pcm_substream *substream, + void **bufs, snd_pcm_uframes_t frames); + +-#else +- +-static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; } +-static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; } +-static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; } +- +-#endif +- + #ifdef PLUGIN_DEBUG + #define pdprintf(fmt, args...) printk(KERN_DEBUG "plugin: " fmt, ##args) + #else +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 30021ab5e0e99..6a4051bce3a3b 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -102,7 +102,7 @@ static void info_read(struct snd_info_entry *entry, struct snd_info_buffer *buff + int snd_sb_csp_new(struct snd_sb *chip, int device, struct snd_hwdep ** rhwdep) + { + struct snd_sb_csp *p; +- int uninitialized_var(version); ++ int version; + int err; + struct snd_hwdep *hw; + +diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c +index 464a4d7873bba..b797f620e3521 100644 +--- a/sound/soc/codecs/ssm2602.c ++++ b/sound/soc/codecs/ssm2602.c +@@ -53,6 +53,18 @@ static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = { + { .reg = 0x09, .def = 0x0000 } + }; + ++/* ++ * ssm2602 register patch ++ * Workaround for playback distortions after power up: activates digital ++ * core, and then powers on output, DAC, and whole chip at the same time ++ */ ++ ++static const struct reg_sequence ssm2602_patch[] = { ++ { SSM2602_ACTIVE, 0x01 }, ++ { SSM2602_PWR, 0x07 }, ++ { SSM2602_RESET, 0x00 }, ++}; ++ + + /*Appending several "None"s just for OSS mixer use*/ + static const char *ssm2602_input_select[] = { +@@ -588,6 +600,9 @@ static int ssm260x_component_probe(struct snd_soc_component *component) + return ret; + } + ++ regmap_register_patch(ssm2602->regmap, ssm2602_patch, ++ ARRAY_SIZE(ssm2602_patch)); ++ + /* set the update bits */ + regmap_update_bits(ssm2602->regmap, SSM2602_LINVOL, + LINVOL_LRIN_BOTH, LINVOL_LRIN_BOTH); +diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c +index 65112b9d8588a..90b8814d7506a 100644 +--- a/sound/soc/dwc/dwc-i2s.c ++++ b/sound/soc/dwc/dwc-i2s.c +@@ -132,13 +132,13 @@ static irqreturn_t i2s_irq_handler(int irq, void *dev_id) + + /* Error Handling: TX */ + if (isr[i] & ISR_TXFO) { +- dev_err(dev->dev, "TX overrun (ch_id=%d)\n", i); ++ dev_err_ratelimited(dev->dev, "TX overrun (ch_id=%d)\n", i); + irq_valid = true; + } + + /* Error Handling: TX */ + if (isr[i] & ISR_RXFO) { +- dev_err(dev->dev, "RX overrun (ch_id=%d)\n", i); ++ dev_err_ratelimited(dev->dev, "RX overrun (ch_id=%d)\n", i); + irq_valid = true; + } + } +diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c +index ed52fa49d0f9f..469da45826d25 100644 +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -311,7 +311,7 @@ static void queue_pending_output_urbs(struct snd_usb_endpoint *ep) + while (test_bit(EP_FLAG_RUNNING, &ep->flags)) { + + unsigned long flags; +- struct snd_usb_packet_info *uninitialized_var(packet); ++ struct snd_usb_packet_info *packet; + struct snd_urb_ctx *ctx = NULL; + int err, i; + |