diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1033_linux-4.14.34.patch | 5392 |
2 files changed, 5396 insertions, 0 deletions
diff --git a/0000_README b/0000_README index f01833fc..1342bb8f 100644 --- a/0000_README +++ b/0000_README @@ -175,6 +175,10 @@ Patch: 1032_linux-4.14.33.patch From: http://www.kernel.org Desc: Linux 4.14.33 +Patch: 1033_linux-4.14.34.patch +From: http://www.kernel.org +Desc: Linux 4.14.34 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1033_linux-4.14.34.patch b/1033_linux-4.14.34.patch new file mode 100644 index 00000000..e16b6b37 --- /dev/null +++ b/1033_linux-4.14.34.patch @@ -0,0 +1,5392 @@ +diff --git a/Makefile b/Makefile +index 00dd6af8eab4..a6906dfb112e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 33 ++SUBLEVEL = 34 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index 9319e1f0f1d8..379b4a03cfe2 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -155,7 +155,7 @@ + }; + + esdhc: esdhc@1560000 { +- compatible = "fsl,esdhc"; ++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc"; + reg = <0x0 0x1560000 0x0 0x10000>; + interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>; + clock-frequency = <0>; +diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile +index 12fd81af1d1c..93dbf4889eb6 100644 +--- a/arch/arm64/crypto/Makefile ++++ b/arch/arm64/crypto/Makefile +@@ -24,7 +24,7 @@ obj-$(CONFIG_CRYPTO_CRC32_ARM64_CE) += crc32-ce.o + crc32-ce-y:= crc32-ce-core.o crc32-ce-glue.o + + obj-$(CONFIG_CRYPTO_AES_ARM64_CE) += aes-ce-cipher.o +-CFLAGS_aes-ce-cipher.o += -march=armv8-a+crypto ++aes-ce-cipher-y := aes-ce-core.o aes-ce-glue.o + + obj-$(CONFIG_CRYPTO_AES_ARM64_CE_CCM) += aes-ce-ccm.o + aes-ce-ccm-y := aes-ce-ccm-glue.o aes-ce-ccm-core.o +diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c +deleted file mode 100644 +index 6a75cd75ed11..000000000000 +--- a/arch/arm64/crypto/aes-ce-cipher.c ++++ /dev/null +@@ -1,281 +0,0 @@ +-/* +- * aes-ce-cipher.c - core AES cipher using ARMv8 Crypto Extensions +- * +- * Copyright (C) 2013 - 2017 Linaro Ltd <ard.biesheuvel@linaro.org> +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +- +-#include <asm/neon.h> +-#include <asm/simd.h> +-#include <asm/unaligned.h> +-#include <crypto/aes.h> +-#include <linux/cpufeature.h> +-#include <linux/crypto.h> +-#include <linux/module.h> +- +-#include "aes-ce-setkey.h" +- +-MODULE_DESCRIPTION("Synchronous AES cipher using ARMv8 Crypto Extensions"); +-MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>"); +-MODULE_LICENSE("GPL v2"); +- +-asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); +-asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); +- +-struct aes_block { +- u8 b[AES_BLOCK_SIZE]; +-}; +- +-static int num_rounds(struct crypto_aes_ctx *ctx) +-{ +- /* +- * # of rounds specified by AES: +- * 128 bit key 10 rounds +- * 192 bit key 12 rounds +- * 256 bit key 14 rounds +- * => n byte key => 6 + (n/4) rounds +- */ +- return 6 + ctx->key_length / 4; +-} +- +-static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- struct aes_block *out = (struct aes_block *)dst; +- struct aes_block const *in = (struct aes_block *)src; +- void *dummy0; +- int dummy1; +- +- if (!may_use_simd()) { +- __aes_arm64_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); +- return; +- } +- +- kernel_neon_begin(); +- +- __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.4s}, [%[key]], #16 ;" +- " cmp %w[rounds], #10 ;" +- " bmi 0f ;" +- " bne 3f ;" +- " mov v3.16b, v1.16b ;" +- " b 2f ;" +- "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- "1: aese v0.16b, v2.16b ;" +- " aesmc v0.16b, v0.16b ;" +- "2: ld1 {v1.4s}, [%[key]], #16 ;" +- " aese v0.16b, v3.16b ;" +- " aesmc v0.16b, v0.16b ;" +- "3: ld1 {v2.4s}, [%[key]], #16 ;" +- " subs %w[rounds], %w[rounds], #3 ;" +- " aese v0.16b, v1.16b ;" +- " aesmc v0.16b, v0.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- " bpl 1b ;" +- " aese v0.16b, v2.16b ;" +- " eor v0.16b, v0.16b, v3.16b ;" +- " st1 {v0.16b}, %[out] ;" +- +- : [out] "=Q"(*out), +- [key] "=r"(dummy0), +- [rounds] "=r"(dummy1) +- : [in] "Q"(*in), +- "1"(ctx->key_enc), +- "2"(num_rounds(ctx) - 2) +- : "cc"); +- +- kernel_neon_end(); +-} +- +-static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- struct aes_block *out = (struct aes_block *)dst; +- struct aes_block const *in = (struct aes_block *)src; +- void *dummy0; +- int dummy1; +- +- if (!may_use_simd()) { +- __aes_arm64_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); +- return; +- } +- +- kernel_neon_begin(); +- +- __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.4s}, [%[key]], #16 ;" +- " cmp %w[rounds], #10 ;" +- " bmi 0f ;" +- " bne 3f ;" +- " mov v3.16b, v1.16b ;" +- " b 2f ;" +- "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- "1: aesd v0.16b, v2.16b ;" +- " aesimc v0.16b, v0.16b ;" +- "2: ld1 {v1.4s}, [%[key]], #16 ;" +- " aesd v0.16b, v3.16b ;" +- " aesimc v0.16b, v0.16b ;" +- "3: ld1 {v2.4s}, [%[key]], #16 ;" +- " subs %w[rounds], %w[rounds], #3 ;" +- " aesd v0.16b, v1.16b ;" +- " aesimc v0.16b, v0.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- " bpl 1b ;" +- " aesd v0.16b, v2.16b ;" +- " eor v0.16b, v0.16b, v3.16b ;" +- " st1 {v0.16b}, %[out] ;" +- +- : [out] "=Q"(*out), +- [key] "=r"(dummy0), +- [rounds] "=r"(dummy1) +- : [in] "Q"(*in), +- "1"(ctx->key_dec), +- "2"(num_rounds(ctx) - 2) +- : "cc"); +- +- kernel_neon_end(); +-} +- +-/* +- * aes_sub() - use the aese instruction to perform the AES sbox substitution +- * on each byte in 'input' +- */ +-static u32 aes_sub(u32 input) +-{ +- u32 ret; +- +- __asm__("dup v1.4s, %w[in] ;" +- "movi v0.16b, #0 ;" +- "aese v0.16b, v1.16b ;" +- "umov %w[out], v0.4s[0] ;" +- +- : [out] "=r"(ret) +- : [in] "r"(input) +- : "v0","v1"); +- +- return ret; +-} +- +-int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, +- unsigned int key_len) +-{ +- /* +- * The AES key schedule round constants +- */ +- static u8 const rcon[] = { +- 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, +- }; +- +- u32 kwords = key_len / sizeof(u32); +- struct aes_block *key_enc, *key_dec; +- int i, j; +- +- if (key_len != AES_KEYSIZE_128 && +- key_len != AES_KEYSIZE_192 && +- key_len != AES_KEYSIZE_256) +- return -EINVAL; +- +- ctx->key_length = key_len; +- for (i = 0; i < kwords; i++) +- ctx->key_enc[i] = get_unaligned_le32(in_key + i * sizeof(u32)); +- +- kernel_neon_begin(); +- for (i = 0; i < sizeof(rcon); i++) { +- u32 *rki = ctx->key_enc + (i * kwords); +- u32 *rko = rki + kwords; +- +- rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; +- rko[1] = rko[0] ^ rki[1]; +- rko[2] = rko[1] ^ rki[2]; +- rko[3] = rko[2] ^ rki[3]; +- +- if (key_len == AES_KEYSIZE_192) { +- if (i >= 7) +- break; +- rko[4] = rko[3] ^ rki[4]; +- rko[5] = rko[4] ^ rki[5]; +- } else if (key_len == AES_KEYSIZE_256) { +- if (i >= 6) +- break; +- rko[4] = aes_sub(rko[3]) ^ rki[4]; +- rko[5] = rko[4] ^ rki[5]; +- rko[6] = rko[5] ^ rki[6]; +- rko[7] = rko[6] ^ rki[7]; +- } +- } +- +- /* +- * Generate the decryption keys for the Equivalent Inverse Cipher. +- * This involves reversing the order of the round keys, and applying +- * the Inverse Mix Columns transformation on all but the first and +- * the last one. +- */ +- key_enc = (struct aes_block *)ctx->key_enc; +- key_dec = (struct aes_block *)ctx->key_dec; +- j = num_rounds(ctx); +- +- key_dec[0] = key_enc[j]; +- for (i = 1, j--; j > 0; i++, j--) +- __asm__("ld1 {v0.4s}, %[in] ;" +- "aesimc v1.16b, v0.16b ;" +- "st1 {v1.4s}, %[out] ;" +- +- : [out] "=Q"(key_dec[i]) +- : [in] "Q"(key_enc[j]) +- : "v0","v1"); +- key_dec[i] = key_enc[0]; +- +- kernel_neon_end(); +- return 0; +-} +-EXPORT_SYMBOL(ce_aes_expandkey); +- +-int ce_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, +- unsigned int key_len) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- int ret; +- +- ret = ce_aes_expandkey(ctx, in_key, key_len); +- if (!ret) +- return 0; +- +- tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; +- return -EINVAL; +-} +-EXPORT_SYMBOL(ce_aes_setkey); +- +-static struct crypto_alg aes_alg = { +- .cra_name = "aes", +- .cra_driver_name = "aes-ce", +- .cra_priority = 250, +- .cra_flags = CRYPTO_ALG_TYPE_CIPHER, +- .cra_blocksize = AES_BLOCK_SIZE, +- .cra_ctxsize = sizeof(struct crypto_aes_ctx), +- .cra_module = THIS_MODULE, +- .cra_cipher = { +- .cia_min_keysize = AES_MIN_KEY_SIZE, +- .cia_max_keysize = AES_MAX_KEY_SIZE, +- .cia_setkey = ce_aes_setkey, +- .cia_encrypt = aes_cipher_encrypt, +- .cia_decrypt = aes_cipher_decrypt +- } +-}; +- +-static int __init aes_mod_init(void) +-{ +- return crypto_register_alg(&aes_alg); +-} +- +-static void __exit aes_mod_exit(void) +-{ +- crypto_unregister_alg(&aes_alg); +-} +- +-module_cpu_feature_match(AES, aes_mod_init); +-module_exit(aes_mod_exit); +diff --git a/arch/arm64/crypto/aes-ce-core.S b/arch/arm64/crypto/aes-ce-core.S +new file mode 100644 +index 000000000000..8efdfdade393 +--- /dev/null ++++ b/arch/arm64/crypto/aes-ce-core.S +@@ -0,0 +1,87 @@ ++/* ++ * Copyright (C) 2013 - 2017 Linaro Ltd <ard.biesheuvel@linaro.org> ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#include <linux/linkage.h> ++#include <asm/assembler.h> ++ ++ .arch armv8-a+crypto ++ ++ENTRY(__aes_ce_encrypt) ++ sub w3, w3, #2 ++ ld1 {v0.16b}, [x2] ++ ld1 {v1.4s}, [x0], #16 ++ cmp w3, #10 ++ bmi 0f ++ bne 3f ++ mov v3.16b, v1.16b ++ b 2f ++0: mov v2.16b, v1.16b ++ ld1 {v3.4s}, [x0], #16 ++1: aese v0.16b, v2.16b ++ aesmc v0.16b, v0.16b ++2: ld1 {v1.4s}, [x0], #16 ++ aese v0.16b, v3.16b ++ aesmc v0.16b, v0.16b ++3: ld1 {v2.4s}, [x0], #16 ++ subs w3, w3, #3 ++ aese v0.16b, v1.16b ++ aesmc v0.16b, v0.16b ++ ld1 {v3.4s}, [x0], #16 ++ bpl 1b ++ aese v0.16b, v2.16b ++ eor v0.16b, v0.16b, v3.16b ++ st1 {v0.16b}, [x1] ++ ret ++ENDPROC(__aes_ce_encrypt) ++ ++ENTRY(__aes_ce_decrypt) ++ sub w3, w3, #2 ++ ld1 {v0.16b}, [x2] ++ ld1 {v1.4s}, [x0], #16 ++ cmp w3, #10 ++ bmi 0f ++ bne 3f ++ mov v3.16b, v1.16b ++ b 2f ++0: mov v2.16b, v1.16b ++ ld1 {v3.4s}, [x0], #16 ++1: aesd v0.16b, v2.16b ++ aesimc v0.16b, v0.16b ++2: ld1 {v1.4s}, [x0], #16 ++ aesd v0.16b, v3.16b ++ aesimc v0.16b, v0.16b ++3: ld1 {v2.4s}, [x0], #16 ++ subs w3, w3, #3 ++ aesd v0.16b, v1.16b ++ aesimc v0.16b, v0.16b ++ ld1 {v3.4s}, [x0], #16 ++ bpl 1b ++ aesd v0.16b, v2.16b ++ eor v0.16b, v0.16b, v3.16b ++ st1 {v0.16b}, [x1] ++ ret ++ENDPROC(__aes_ce_decrypt) ++ ++/* ++ * __aes_ce_sub() - use the aese instruction to perform the AES sbox ++ * substitution on each byte in 'input' ++ */ ++ENTRY(__aes_ce_sub) ++ dup v1.4s, w0 ++ movi v0.16b, #0 ++ aese v0.16b, v1.16b ++ umov w0, v0.s[0] ++ ret ++ENDPROC(__aes_ce_sub) ++ ++ENTRY(__aes_ce_invert) ++ ld1 {v0.4s}, [x1] ++ aesimc v1.16b, v0.16b ++ st1 {v1.4s}, [x0] ++ ret ++ENDPROC(__aes_ce_invert) +diff --git a/arch/arm64/crypto/aes-ce-glue.c b/arch/arm64/crypto/aes-ce-glue.c +new file mode 100644 +index 000000000000..e6b3227bbf57 +--- /dev/null ++++ b/arch/arm64/crypto/aes-ce-glue.c +@@ -0,0 +1,190 @@ ++/* ++ * aes-ce-cipher.c - core AES cipher using ARMv8 Crypto Extensions ++ * ++ * Copyright (C) 2013 - 2017 Linaro Ltd <ard.biesheuvel@linaro.org> ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#include <asm/neon.h> ++#include <asm/simd.h> ++#include <asm/unaligned.h> ++#include <crypto/aes.h> ++#include <linux/cpufeature.h> ++#include <linux/crypto.h> ++#include <linux/module.h> ++ ++#include "aes-ce-setkey.h" ++ ++MODULE_DESCRIPTION("Synchronous AES cipher using ARMv8 Crypto Extensions"); ++MODULE_AUTHOR("Ard Biesheuvel <ard.biesheuvel@linaro.org>"); ++MODULE_LICENSE("GPL v2"); ++ ++asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++ ++struct aes_block { ++ u8 b[AES_BLOCK_SIZE]; ++}; ++ ++asmlinkage void __aes_ce_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++asmlinkage void __aes_ce_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++ ++asmlinkage u32 __aes_ce_sub(u32 l); ++asmlinkage void __aes_ce_invert(struct aes_block *out, ++ const struct aes_block *in); ++ ++static int num_rounds(struct crypto_aes_ctx *ctx) ++{ ++ /* ++ * # of rounds specified by AES: ++ * 128 bit key 10 rounds ++ * 192 bit key 12 rounds ++ * 256 bit key 14 rounds ++ * => n byte key => 6 + (n/4) rounds ++ */ ++ return 6 + ctx->key_length / 4; ++} ++ ++static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ ++ if (!may_use_simd()) { ++ __aes_arm64_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); ++ return; ++ } ++ ++ kernel_neon_begin(); ++ __aes_ce_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); ++ kernel_neon_end(); ++} ++ ++static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ ++ if (!may_use_simd()) { ++ __aes_arm64_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); ++ return; ++ } ++ ++ kernel_neon_begin(); ++ __aes_ce_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); ++ kernel_neon_end(); ++} ++ ++int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, ++ unsigned int key_len) ++{ ++ /* ++ * The AES key schedule round constants ++ */ ++ static u8 const rcon[] = { ++ 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, ++ }; ++ ++ u32 kwords = key_len / sizeof(u32); ++ struct aes_block *key_enc, *key_dec; ++ int i, j; ++ ++ if (key_len != AES_KEYSIZE_128 && ++ key_len != AES_KEYSIZE_192 && ++ key_len != AES_KEYSIZE_256) ++ return -EINVAL; ++ ++ ctx->key_length = key_len; ++ for (i = 0; i < kwords; i++) ++ ctx->key_enc[i] = get_unaligned_le32(in_key + i * sizeof(u32)); ++ ++ kernel_neon_begin(); ++ for (i = 0; i < sizeof(rcon); i++) { ++ u32 *rki = ctx->key_enc + (i * kwords); ++ u32 *rko = rki + kwords; ++ ++ rko[0] = ror32(__aes_ce_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; ++ rko[1] = rko[0] ^ rki[1]; ++ rko[2] = rko[1] ^ rki[2]; ++ rko[3] = rko[2] ^ rki[3]; ++ ++ if (key_len == AES_KEYSIZE_192) { ++ if (i >= 7) ++ break; ++ rko[4] = rko[3] ^ rki[4]; ++ rko[5] = rko[4] ^ rki[5]; ++ } else if (key_len == AES_KEYSIZE_256) { ++ if (i >= 6) ++ break; ++ rko[4] = __aes_ce_sub(rko[3]) ^ rki[4]; ++ rko[5] = rko[4] ^ rki[5]; ++ rko[6] = rko[5] ^ rki[6]; ++ rko[7] = rko[6] ^ rki[7]; ++ } ++ } ++ ++ /* ++ * Generate the decryption keys for the Equivalent Inverse Cipher. ++ * This involves reversing the order of the round keys, and applying ++ * the Inverse Mix Columns transformation on all but the first and ++ * the last one. ++ */ ++ key_enc = (struct aes_block *)ctx->key_enc; ++ key_dec = (struct aes_block *)ctx->key_dec; ++ j = num_rounds(ctx); ++ ++ key_dec[0] = key_enc[j]; ++ for (i = 1, j--; j > 0; i++, j--) ++ __aes_ce_invert(key_dec + i, key_enc + j); ++ key_dec[i] = key_enc[0]; ++ ++ kernel_neon_end(); ++ return 0; ++} ++EXPORT_SYMBOL(ce_aes_expandkey); ++ ++int ce_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, ++ unsigned int key_len) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ int ret; ++ ++ ret = ce_aes_expandkey(ctx, in_key, key_len); ++ if (!ret) ++ return 0; ++ ++ tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; ++ return -EINVAL; ++} ++EXPORT_SYMBOL(ce_aes_setkey); ++ ++static struct crypto_alg aes_alg = { ++ .cra_name = "aes", ++ .cra_driver_name = "aes-ce", ++ .cra_priority = 250, ++ .cra_flags = CRYPTO_ALG_TYPE_CIPHER, ++ .cra_blocksize = AES_BLOCK_SIZE, ++ .cra_ctxsize = sizeof(struct crypto_aes_ctx), ++ .cra_module = THIS_MODULE, ++ .cra_cipher = { ++ .cia_min_keysize = AES_MIN_KEY_SIZE, ++ .cia_max_keysize = AES_MAX_KEY_SIZE, ++ .cia_setkey = ce_aes_setkey, ++ .cia_encrypt = aes_cipher_encrypt, ++ .cia_decrypt = aes_cipher_decrypt ++ } ++}; ++ ++static int __init aes_mod_init(void) ++{ ++ return crypto_register_alg(&aes_alg); ++} ++ ++static void __exit aes_mod_exit(void) ++{ ++ crypto_unregister_alg(&aes_alg); ++} ++ ++module_cpu_feature_match(AES, aes_mod_init); ++module_exit(aes_mod_exit); +diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h +index 55520cec8b27..6cf0e4cb7b97 100644 +--- a/arch/x86/include/asm/microcode.h ++++ b/arch/x86/include/asm/microcode.h +@@ -37,7 +37,13 @@ struct cpu_signature { + + struct device; + +-enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND }; ++enum ucode_state { ++ UCODE_OK = 0, ++ UCODE_NEW, ++ UCODE_UPDATED, ++ UCODE_NFOUND, ++ UCODE_ERROR, ++}; + + struct microcode_ops { + enum ucode_state (*request_microcode_user) (int cpu, +@@ -54,7 +60,7 @@ struct microcode_ops { + * are being called. + * See also the "Synchronization" section in microcode_core.c. + */ +- int (*apply_microcode) (int cpu); ++ enum ucode_state (*apply_microcode) (int cpu); + int (*collect_cpu_info) (int cpu, struct cpu_signature *csig); + }; + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 15fc074bd628..3222c7746cb1 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -968,4 +968,5 @@ bool xen_set_default_idle(void); + + void stop_this_cpu(void *dummy); + void df_debug(struct pt_regs *regs, long error_code); ++void microcode_check(void); + #endif /* _ASM_X86_PROCESSOR_H */ +diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c +index f5d92bc3b884..2c4d5ece7456 100644 +--- a/arch/x86/kernel/aperture_64.c ++++ b/arch/x86/kernel/aperture_64.c +@@ -30,6 +30,7 @@ + #include <asm/dma.h> + #include <asm/amd_nb.h> + #include <asm/x86_init.h> ++#include <linux/crash_dump.h> + + /* + * Using 512M as goal, in case kexec will load kernel_big +@@ -56,6 +57,33 @@ int fallback_aper_force __initdata; + + int fix_aperture __initdata = 1; + ++#ifdef CONFIG_PROC_VMCORE ++/* ++ * If the first kernel maps the aperture over e820 RAM, the kdump kernel will ++ * use the same range because it will remain configured in the northbridge. ++ * Trying to dump this area via /proc/vmcore may crash the machine, so exclude ++ * it from vmcore. ++ */ ++static unsigned long aperture_pfn_start, aperture_page_count; ++ ++static int gart_oldmem_pfn_is_ram(unsigned long pfn) ++{ ++ return likely((pfn < aperture_pfn_start) || ++ (pfn >= aperture_pfn_start + aperture_page_count)); ++} ++ ++static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++{ ++ aperture_pfn_start = aper_base >> PAGE_SHIFT; ++ aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT; ++ WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram)); ++} ++#else ++static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++{ ++} ++#endif ++ + /* This code runs before the PCI subsystem is initialized, so just + access the northbridge directly. */ + +@@ -435,8 +463,16 @@ int __init gart_iommu_hole_init(void) + + out: + if (!fix && !fallback_aper_force) { +- if (last_aper_base) ++ if (last_aper_base) { ++ /* ++ * If this is the kdump kernel, the first kernel ++ * may have allocated the range over its e820 RAM ++ * and fixed up the northbridge ++ */ ++ exclude_from_vmcore(last_aper_base, last_aper_order); ++ + return 1; ++ } + return 0; + } + +@@ -473,6 +509,14 @@ int __init gart_iommu_hole_init(void) + return 0; + } + ++ /* ++ * If this is the kdump kernel _and_ the first kernel did not ++ * configure the aperture in the northbridge, this range may ++ * overlap with the first kernel's memory. We can't access the ++ * range through vmcore even though it should be part of the dump. ++ */ ++ exclude_from_vmcore(aper_alloc, aper_order); ++ + /* Fix up the north bridges */ + for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) { + int bus, dev_base, dev_limit; +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 651b7afed4da..cf6380200dc2 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1724,3 +1724,33 @@ static int __init init_cpu_syscore(void) + return 0; + } + core_initcall(init_cpu_syscore); ++ ++/* ++ * The microcode loader calls this upon late microcode load to recheck features, ++ * only when microcode has been updated. Caller holds microcode_mutex and CPU ++ * hotplug lock. ++ */ ++void microcode_check(void) ++{ ++ struct cpuinfo_x86 info; ++ ++ perf_check_microcode(); ++ ++ /* Reload CPUID max function as it might've changed. */ ++ info.cpuid_level = cpuid_eax(0); ++ ++ /* ++ * Copy all capability leafs to pick up the synthetic ones so that ++ * memcmp() below doesn't fail on that. The ones coming from CPUID will ++ * get overwritten in get_cpu_cap(). ++ */ ++ memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)); ++ ++ get_cpu_cap(&info); ++ ++ if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability))) ++ return; ++ ++ pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); ++ pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); ++} +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 330b8462d426..48179928ff38 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -339,7 +339,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + return -EINVAL; + + ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); +- if (ret != UCODE_OK) ++ if (ret > UCODE_UPDATED) + return -EINVAL; + + return 0; +@@ -498,7 +498,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size, + return patch_size; + } + +-static int apply_microcode_amd(int cpu) ++static enum ucode_state apply_microcode_amd(int cpu) + { + struct cpuinfo_x86 *c = &cpu_data(cpu); + struct microcode_amd *mc_amd; +@@ -512,7 +512,7 @@ static int apply_microcode_amd(int cpu) + + p = find_patch(cpu); + if (!p) +- return 0; ++ return UCODE_NFOUND; + + mc_amd = p->data; + uci->mc = p->data; +@@ -523,13 +523,13 @@ static int apply_microcode_amd(int cpu) + if (rev >= mc_amd->hdr.patch_id) { + c->microcode = rev; + uci->cpu_sig.rev = rev; +- return 0; ++ return UCODE_OK; + } + + if (__apply_microcode_amd(mc_amd)) { + pr_err("CPU%d: update failed for patch_level=0x%08x\n", + cpu, mc_amd->hdr.patch_id); +- return -1; ++ return UCODE_ERROR; + } + pr_info("CPU%d: new patch_level=0x%08x\n", cpu, + mc_amd->hdr.patch_id); +@@ -537,7 +537,7 @@ static int apply_microcode_amd(int cpu) + uci->cpu_sig.rev = mc_amd->hdr.patch_id; + c->microcode = mc_amd->hdr.patch_id; + +- return 0; ++ return UCODE_UPDATED; + } + + static int install_equiv_cpu_table(const u8 *buf) +@@ -683,27 +683,35 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, + static enum ucode_state + load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + { ++ struct ucode_patch *p; + enum ucode_state ret; + + /* free old equiv table */ + free_equiv_cpu_table(); + + ret = __load_microcode_amd(family, data, size); +- +- if (ret != UCODE_OK) ++ if (ret != UCODE_OK) { + cleanup(); ++ return ret; ++ } + +-#ifdef CONFIG_X86_32 +- /* save BSP's matching patch for early load */ +- if (save) { +- struct ucode_patch *p = find_patch(0); +- if (p) { +- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); +- memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), +- PATCH_MAX_SIZE)); +- } ++ p = find_patch(0); ++ if (!p) { ++ return ret; ++ } else { ++ if (boot_cpu_data.microcode == p->patch_id) ++ return ret; ++ ++ ret = UCODE_NEW; + } +-#endif ++ ++ /* save BSP's matching patch for early load */ ++ if (!save) ++ return ret; ++ ++ memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); ++ memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE)); ++ + return ret; + } + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index e4fc595cd6ea..021c90464cc2 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -22,13 +22,16 @@ + #define pr_fmt(fmt) "microcode: " fmt + + #include <linux/platform_device.h> ++#include <linux/stop_machine.h> + #include <linux/syscore_ops.h> + #include <linux/miscdevice.h> + #include <linux/capability.h> + #include <linux/firmware.h> + #include <linux/kernel.h> ++#include <linux/delay.h> + #include <linux/mutex.h> + #include <linux/cpu.h> ++#include <linux/nmi.h> + #include <linux/fs.h> + #include <linux/mm.h> + +@@ -64,6 +67,11 @@ LIST_HEAD(microcode_cache); + */ + static DEFINE_MUTEX(microcode_mutex); + ++/* ++ * Serialize late loading so that CPUs get updated one-by-one. ++ */ ++static DEFINE_SPINLOCK(update_lock); ++ + struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; + + struct cpu_info_ctx { +@@ -373,26 +381,23 @@ static int collect_cpu_info(int cpu) + return ret; + } + +-struct apply_microcode_ctx { +- int err; +-}; +- + static void apply_microcode_local(void *arg) + { +- struct apply_microcode_ctx *ctx = arg; ++ enum ucode_state *err = arg; + +- ctx->err = microcode_ops->apply_microcode(smp_processor_id()); ++ *err = microcode_ops->apply_microcode(smp_processor_id()); + } + + static int apply_microcode_on_target(int cpu) + { +- struct apply_microcode_ctx ctx = { .err = 0 }; ++ enum ucode_state err; + int ret; + +- ret = smp_call_function_single(cpu, apply_microcode_local, &ctx, 1); +- if (!ret) +- ret = ctx.err; +- ++ ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1); ++ if (!ret) { ++ if (err == UCODE_ERROR) ++ ret = 1; ++ } + return ret; + } + +@@ -489,31 +494,124 @@ static void __exit microcode_dev_exit(void) + /* fake device for request_firmware */ + static struct platform_device *microcode_pdev; + +-static int reload_for_cpu(int cpu) ++/* ++ * Late loading dance. Why the heavy-handed stomp_machine effort? ++ * ++ * - HT siblings must be idle and not execute other code while the other sibling ++ * is loading microcode in order to avoid any negative interactions caused by ++ * the loading. ++ * ++ * - In addition, microcode update on the cores must be serialized until this ++ * requirement can be relaxed in the future. Right now, this is conservative ++ * and good. ++ */ ++#define SPINUNIT 100 /* 100 nsec */ ++ ++static int check_online_cpus(void) + { +- struct ucode_cpu_info *uci = ucode_cpu_info + cpu; +- enum ucode_state ustate; +- int err = 0; ++ if (num_online_cpus() == num_present_cpus()) ++ return 0; + +- if (!uci->valid) +- return err; ++ pr_err("Not all CPUs online, aborting microcode update.\n"); + +- ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, true); +- if (ustate == UCODE_OK) +- apply_microcode_on_target(cpu); +- else +- if (ustate == UCODE_ERROR) +- err = -EINVAL; +- return err; ++ return -EINVAL; ++} ++ ++static atomic_t late_cpus_in; ++static atomic_t late_cpus_out; ++ ++static int __wait_for_cpus(atomic_t *t, long long timeout) ++{ ++ int all_cpus = num_online_cpus(); ++ ++ atomic_inc(t); ++ ++ while (atomic_read(t) < all_cpus) { ++ if (timeout < SPINUNIT) { ++ pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n", ++ all_cpus - atomic_read(t)); ++ return 1; ++ } ++ ++ ndelay(SPINUNIT); ++ timeout -= SPINUNIT; ++ ++ touch_nmi_watchdog(); ++ } ++ return 0; ++} ++ ++/* ++ * Returns: ++ * < 0 - on error ++ * 0 - no update done ++ * 1 - microcode was updated ++ */ ++static int __reload_late(void *info) ++{ ++ int cpu = smp_processor_id(); ++ enum ucode_state err; ++ int ret = 0; ++ ++ /* ++ * Wait for all CPUs to arrive. A load will not be attempted unless all ++ * CPUs show up. ++ * */ ++ if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) ++ return -1; ++ ++ spin_lock(&update_lock); ++ apply_microcode_local(&err); ++ spin_unlock(&update_lock); ++ ++ if (err > UCODE_NFOUND) { ++ pr_warn("Error reloading microcode on CPU %d\n", cpu); ++ return -1; ++ /* siblings return UCODE_OK because their engine got updated already */ ++ } else if (err == UCODE_UPDATED || err == UCODE_OK) { ++ ret = 1; ++ } else { ++ return ret; ++ } ++ ++ /* ++ * Increase the wait timeout to a safe value here since we're ++ * serializing the microcode update and that could take a while on a ++ * large number of CPUs. And that is fine as the *actual* timeout will ++ * be determined by the last CPU finished updating and thus cut short. ++ */ ++ if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC * num_online_cpus())) ++ panic("Timeout during microcode update!\n"); ++ ++ return ret; ++} ++ ++/* ++ * Reload microcode late on all CPUs. Wait for a sec until they ++ * all gather together. ++ */ ++static int microcode_reload_late(void) ++{ ++ int ret; ++ ++ atomic_set(&late_cpus_in, 0); ++ atomic_set(&late_cpus_out, 0); ++ ++ ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); ++ if (ret > 0) ++ microcode_check(); ++ ++ return ret; + } + + static ssize_t reload_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t size) + { ++ enum ucode_state tmp_ret = UCODE_OK; ++ int bsp = boot_cpu_data.cpu_index; + unsigned long val; +- int cpu; +- ssize_t ret = 0, tmp_ret; ++ ssize_t ret = 0; + + ret = kstrtoul(buf, 0, &val); + if (ret) +@@ -522,23 +620,24 @@ static ssize_t reload_store(struct device *dev, + if (val != 1) + return size; + ++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); ++ if (tmp_ret != UCODE_NEW) ++ return size; ++ + get_online_cpus(); +- mutex_lock(µcode_mutex); +- for_each_online_cpu(cpu) { +- tmp_ret = reload_for_cpu(cpu); +- if (tmp_ret != 0) +- pr_warn("Error reloading microcode on CPU %d\n", cpu); + +- /* save retval of the first encountered reload error */ +- if (!ret) +- ret = tmp_ret; +- } +- if (!ret) +- perf_check_microcode(); ++ ret = check_online_cpus(); ++ if (ret) ++ goto put; ++ ++ mutex_lock(µcode_mutex); ++ ret = microcode_reload_late(); + mutex_unlock(µcode_mutex); ++ ++put: + put_online_cpus(); + +- if (!ret) ++ if (ret >= 0) + ret = size; + + return ret; +@@ -606,10 +705,8 @@ static enum ucode_state microcode_init_cpu(int cpu, bool refresh_fw) + if (system_state != SYSTEM_RUNNING) + return UCODE_NFOUND; + +- ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, +- refresh_fw); +- +- if (ustate == UCODE_OK) { ++ ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, refresh_fw); ++ if (ustate == UCODE_NEW) { + pr_debug("CPU%d updated upon init\n", cpu); + apply_microcode_on_target(cpu); + } +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index a15db2b4e0d6..32b8e5724f96 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -589,6 +589,23 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early) + if (!mc) + return 0; + ++ /* ++ * Save us the MSR write below - which is a particular expensive ++ * operation - when the other hyperthread has updated the microcode ++ * already. ++ */ ++ rev = intel_get_microcode_revision(); ++ if (rev >= mc->hdr.rev) { ++ uci->cpu_sig.rev = rev; ++ return UCODE_OK; ++ } ++ ++ /* ++ * Writeback and invalidate caches before updating microcode to avoid ++ * internal issues depending on what the microcode is updating. ++ */ ++ native_wbinvd(); ++ + /* write microcode via MSR 0x79 */ + native_wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); + +@@ -772,27 +789,44 @@ static int collect_cpu_info(int cpu_num, struct cpu_signature *csig) + return 0; + } + +-static int apply_microcode_intel(int cpu) ++static enum ucode_state apply_microcode_intel(int cpu) + { ++ struct ucode_cpu_info *uci = ucode_cpu_info + cpu; ++ struct cpuinfo_x86 *c = &cpu_data(cpu); + struct microcode_intel *mc; +- struct ucode_cpu_info *uci; +- struct cpuinfo_x86 *c; + static int prev_rev; + u32 rev; + + /* We should bind the task to the CPU */ + if (WARN_ON(raw_smp_processor_id() != cpu)) +- return -1; ++ return UCODE_ERROR; + +- uci = ucode_cpu_info + cpu; +- mc = uci->mc; ++ /* Look for a newer patch in our cache: */ ++ mc = find_patch(uci); + if (!mc) { +- /* Look for a newer patch in our cache: */ +- mc = find_patch(uci); ++ mc = uci->mc; + if (!mc) +- return 0; ++ return UCODE_NFOUND; + } + ++ /* ++ * Save us the MSR write below - which is a particular expensive ++ * operation - when the other hyperthread has updated the microcode ++ * already. ++ */ ++ rev = intel_get_microcode_revision(); ++ if (rev >= mc->hdr.rev) { ++ uci->cpu_sig.rev = rev; ++ c->microcode = rev; ++ return UCODE_OK; ++ } ++ ++ /* ++ * Writeback and invalidate caches before updating microcode to avoid ++ * internal issues depending on what the microcode is updating. ++ */ ++ native_wbinvd(); ++ + /* write microcode via MSR 0x79 */ + wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); + +@@ -801,7 +835,7 @@ static int apply_microcode_intel(int cpu) + if (rev != mc->hdr.rev) { + pr_err("CPU%d update to revision 0x%x failed\n", + cpu, mc->hdr.rev); +- return -1; ++ return UCODE_ERROR; + } + + if (rev != prev_rev) { +@@ -813,12 +847,10 @@ static int apply_microcode_intel(int cpu) + prev_rev = rev; + } + +- c = &cpu_data(cpu); +- + uci->cpu_sig.rev = rev; + c->microcode = rev; + +- return 0; ++ return UCODE_UPDATED; + } + + static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, +@@ -830,6 +862,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + unsigned int leftover = size; + unsigned int curr_mc_size = 0, new_mc_size = 0; + unsigned int csig, cpf; ++ enum ucode_state ret = UCODE_OK; + + while (leftover) { + struct microcode_header_intel mc_header; +@@ -871,6 +904,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + new_mc = mc; + new_mc_size = mc_size; + mc = NULL; /* trigger new vmalloc */ ++ ret = UCODE_NEW; + } + + ucode_ptr += mc_size; +@@ -900,7 +934,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n", + cpu, new_rev, uci->cpu_sig.rev); + +- return UCODE_OK; ++ return ret; + } + + static int get_ucode_fw(void *to, const void *from, size_t n) +diff --git a/arch/x86/xen/mmu_hvm.c b/arch/x86/xen/mmu_hvm.c +index 2cfcfe4f6b2a..dd2ad82eee80 100644 +--- a/arch/x86/xen/mmu_hvm.c ++++ b/arch/x86/xen/mmu_hvm.c +@@ -75,6 +75,6 @@ void __init xen_hvm_init_mmu_ops(void) + if (is_pagetable_dying_supported()) + pv_mmu_ops.exit_mmap = xen_hvm_exit_mmap; + #ifdef CONFIG_PROC_VMCORE +- register_oldmem_pfn_is_ram(&xen_oldmem_pfn_is_ram); ++ WARN_ON(register_oldmem_pfn_is_ram(&xen_oldmem_pfn_is_ram)); + #endif + } +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index ceefb9a706d6..5d53e504acae 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -749,10 +749,11 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) + unsigned long flags; + int i; + ++ spin_lock_irqsave(&bfqd->lock, flags); ++ + if (!entity) /* root group */ +- return; ++ goto put_async_queues; + +- spin_lock_irqsave(&bfqd->lock, flags); + /* + * Empty all service_trees belonging to this group before + * deactivating the group itself. +@@ -783,6 +784,8 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) + } + + __bfq_deactivate_entity(entity, false); ++ ++put_async_queues: + bfq_put_async_queues(bfqd, bfqg); + + spin_unlock_irqrestore(&bfqd->lock, flags); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index f1fb126a3be5..6f899669cbdd 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1928,7 +1928,8 @@ static void blk_mq_exit_hctx(struct request_queue *q, + { + blk_mq_debugfs_unregister_hctx(hctx); + +- blk_mq_tag_idle(hctx); ++ if (blk_mq_hw_queue_mapped(hctx)) ++ blk_mq_tag_idle(hctx); + + if (set->ops->exit_request) + set->ops->exit_request(set, hctx->fq->flush_rq, hctx_idx); +@@ -2314,6 +2315,9 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, + struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx; + + blk_mq_sysfs_unregister(q); ++ ++ /* protect against switching io scheduler */ ++ mutex_lock(&q->sysfs_lock); + for (i = 0; i < set->nr_hw_queues; i++) { + int node; + +@@ -2358,6 +2362,7 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, + } + } + q->nr_hw_queues = i; ++ mutex_unlock(&q->sysfs_lock); + blk_mq_sysfs_register(q); + } + +@@ -2528,9 +2533,27 @@ static int blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set) + + static int blk_mq_update_queue_map(struct blk_mq_tag_set *set) + { +- if (set->ops->map_queues) ++ if (set->ops->map_queues) { ++ int cpu; ++ /* ++ * transport .map_queues is usually done in the following ++ * way: ++ * ++ * for (queue = 0; queue < set->nr_hw_queues; queue++) { ++ * mask = get_cpu_mask(queue) ++ * for_each_cpu(cpu, mask) ++ * set->mq_map[cpu] = queue; ++ * } ++ * ++ * When we need to remap, the table has to be cleared for ++ * killing stale mapping since one CPU may not be mapped ++ * to any hw queue. ++ */ ++ for_each_possible_cpu(cpu) ++ set->mq_map[cpu] = 0; ++ + return set->ops->map_queues(set); +- else ++ } else + return blk_mq_map_queues(set); + } + +diff --git a/crypto/Makefile b/crypto/Makefile +index da190be60ce2..adaf2c63baeb 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -98,6 +98,7 @@ obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o + obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o + CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_AES) += aes_generic.o ++CFLAGS_aes_generic.o := $(call cc-ifversion, -ge, 0701, -Os) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83356 + obj-$(CONFIG_CRYPTO_AES_TI) += aes_ti.o + obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o + obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 0972ec0e2eb8..f53ccc680238 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -80,8 +80,8 @@ MODULE_PARM_DESC(report_key_events, + static bool device_id_scheme = false; + module_param(device_id_scheme, bool, 0444); + +-static bool only_lcd = false; +-module_param(only_lcd, bool, 0444); ++static int only_lcd = -1; ++module_param(only_lcd, int, 0444); + + static int register_count; + static DEFINE_MUTEX(register_count_mutex); +@@ -2136,6 +2136,16 @@ int acpi_video_register(void) + goto leave; + } + ++ /* ++ * We're seeing a lot of bogus backlight interfaces on newer machines ++ * without a LCD such as desktops, servers and HDMI sticks. Checking ++ * the lcd flag fixes this, so enable this on any machines which are ++ * win8 ready (where we also prefer the native backlight driver, so ++ * normally the acpi_video code should not register there anyways). ++ */ ++ if (only_lcd == -1) ++ only_lcd = acpi_osi_is_win8(); ++ + dmi_check_system(video_dmi_table); + + ret = acpi_bus_register_driver(&acpi_video_bus); +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index df842465634a..6adcda057b36 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1516,7 +1516,7 @@ static int acpi_ec_setup(struct acpi_ec *ec, bool handle_events) + } + + acpi_handle_info(ec->handle, +- "GPE=0x%lx, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", ++ "GPE=0x%x, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", + ec->gpe, ec->command_addr, ec->data_addr); + return ret; + } +diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c +index 6c7dd7af789e..dd70d6c2bca0 100644 +--- a/drivers/acpi/ec_sys.c ++++ b/drivers/acpi/ec_sys.c +@@ -128,7 +128,7 @@ static int acpi_ec_add_debugfs(struct acpi_ec *ec, unsigned int ec_device_count) + return -ENOMEM; + } + +- if (!debugfs_create_x32("gpe", 0444, dev_dir, (u32 *)&first_ec->gpe)) ++ if (!debugfs_create_x32("gpe", 0444, dev_dir, &first_ec->gpe)) + goto error; + if (!debugfs_create_bool("use_global_lock", 0444, dev_dir, + &first_ec->global_lock)) +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index ede83d38beed..2cd2ae152ab7 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -159,7 +159,7 @@ static inline void acpi_early_processor_osc(void) {} + -------------------------------------------------------------------------- */ + struct acpi_ec { + acpi_handle handle; +- unsigned long gpe; ++ u32 gpe; + unsigned long command_addr; + unsigned long data_addr; + bool global_lock; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b2c0306f97ed..e9dff868c028 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -277,6 +277,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, ++ { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, + + /* Broadcom BCM2035 */ +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 5294442505cb..0f1dc35e7078 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -328,7 +328,7 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, + } + EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); + +-static bool tpm_validate_command(struct tpm_chip *chip, ++static int tpm_validate_command(struct tpm_chip *chip, + struct tpm_space *space, + const u8 *cmd, + size_t len) +@@ -340,10 +340,10 @@ static bool tpm_validate_command(struct tpm_chip *chip, + unsigned int nr_handles; + + if (len < TPM_HEADER_SIZE) +- return false; ++ return -EINVAL; + + if (!space) +- return true; ++ return 0; + + if (chip->flags & TPM_CHIP_FLAG_TPM2 && chip->nr_commands) { + cc = be32_to_cpu(header->ordinal); +@@ -352,7 +352,7 @@ static bool tpm_validate_command(struct tpm_chip *chip, + if (i < 0) { + dev_dbg(&chip->dev, "0x%04X is an invalid command\n", + cc); +- return false; ++ return -EOPNOTSUPP; + } + + attrs = chip->cc_attrs_tbl[i]; +@@ -362,11 +362,11 @@ static bool tpm_validate_command(struct tpm_chip *chip, + goto err_len; + } + +- return true; ++ return 0; + err_len: + dev_dbg(&chip->dev, + "%s: insufficient command length %zu", __func__, len); +- return false; ++ return -EINVAL; + } + + /** +@@ -391,8 +391,20 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + unsigned long stop; + bool need_locality; + +- if (!tpm_validate_command(chip, space, buf, bufsiz)) +- return -EINVAL; ++ rc = tpm_validate_command(chip, space, buf, bufsiz); ++ if (rc == -EINVAL) ++ return rc; ++ /* ++ * If the command is not implemented by the TPM, synthesize a ++ * response with a TPM2_RC_COMMAND_CODE return for user-space. ++ */ ++ if (rc == -EOPNOTSUPP) { ++ header->length = cpu_to_be32(sizeof(*header)); ++ header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS); ++ header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE | ++ TSS2_RESMGR_TPM_RC_LAYER); ++ return bufsiz; ++ } + + if (bufsiz > TPM_BUFSIZE) + bufsiz = TPM_BUFSIZE; +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 2d5466a72e40..0b5b499f726a 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -93,12 +93,17 @@ enum tpm2_structures { + TPM2_ST_SESSIONS = 0x8002, + }; + ++/* Indicates from what layer of the software stack the error comes from */ ++#define TSS2_RC_LAYER_SHIFT 16 ++#define TSS2_RESMGR_TPM_RC_LAYER (11 << TSS2_RC_LAYER_SHIFT) ++ + enum tpm2_return_codes { + TPM2_RC_SUCCESS = 0x0000, + TPM2_RC_HASH = 0x0083, /* RC_FMT1 */ + TPM2_RC_HANDLE = 0x008B, + TPM2_RC_INITIALIZE = 0x0100, /* RC_VER1 */ + TPM2_RC_DISABLED = 0x0120, ++ TPM2_RC_COMMAND_CODE = 0x0143, + TPM2_RC_TESTING = 0x090A, /* RC_WARN */ + TPM2_RC_REFERENCE_H0 = 0x0910, + }; +diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c +index 4ed516cb7276..b49942b9fe50 100644 +--- a/drivers/clk/clk-divider.c ++++ b/drivers/clk/clk-divider.c +@@ -118,12 +118,11 @@ static unsigned int _get_val(const struct clk_div_table *table, + unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, + unsigned int val, + const struct clk_div_table *table, +- unsigned long flags) ++ unsigned long flags, unsigned long width) + { +- struct clk_divider *divider = to_clk_divider(hw); + unsigned int div; + +- div = _get_div(table, val, flags, divider->width); ++ div = _get_div(table, val, flags, width); + if (!div) { + WARN(!(flags & CLK_DIVIDER_ALLOW_ZERO), + "%s: Zero divisor and CLK_DIVIDER_ALLOW_ZERO not set\n", +@@ -145,7 +144,7 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw, + val &= div_mask(divider->width); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, +- divider->flags); ++ divider->flags, divider->width); + } + + static bool _is_valid_table_div(const struct clk_div_table *table, +diff --git a/drivers/clk/hisilicon/clkdivider-hi6220.c b/drivers/clk/hisilicon/clkdivider-hi6220.c +index a1c1f684ad58..9f46cf9dcc65 100644 +--- a/drivers/clk/hisilicon/clkdivider-hi6220.c ++++ b/drivers/clk/hisilicon/clkdivider-hi6220.c +@@ -56,7 +56,7 @@ static unsigned long hi6220_clkdiv_recalc_rate(struct clk_hw *hw, + val &= div_mask(dclk->width); + + return divider_recalc_rate(hw, parent_rate, val, dclk->table, +- CLK_DIVIDER_ROUND_CLOSEST); ++ CLK_DIVIDER_ROUND_CLOSEST, dclk->width); + } + + static long hi6220_clkdiv_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/clk/meson/clk-mpll.c b/drivers/clk/meson/clk-mpll.c +index 44a5a535ca63..5144360e2c80 100644 +--- a/drivers/clk/meson/clk-mpll.c ++++ b/drivers/clk/meson/clk-mpll.c +@@ -98,7 +98,7 @@ static void params_from_rate(unsigned long requested_rate, + *sdm = SDM_DEN - 1; + } else { + *n2 = div; +- *sdm = DIV_ROUND_UP(rem * SDM_DEN, requested_rate); ++ *sdm = DIV_ROUND_UP_ULL((u64)rem * SDM_DEN, requested_rate); + } + } + +diff --git a/drivers/clk/nxp/clk-lpc32xx.c b/drivers/clk/nxp/clk-lpc32xx.c +index 7b359afd620e..a6438f50e6db 100644 +--- a/drivers/clk/nxp/clk-lpc32xx.c ++++ b/drivers/clk/nxp/clk-lpc32xx.c +@@ -956,7 +956,7 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw, + val &= div_mask(divider->width); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, +- divider->flags); ++ divider->flags, divider->width); + } + + static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/clk/qcom/clk-regmap-divider.c b/drivers/clk/qcom/clk-regmap-divider.c +index 53484912301e..928fcc16ee27 100644 +--- a/drivers/clk/qcom/clk-regmap-divider.c ++++ b/drivers/clk/qcom/clk-regmap-divider.c +@@ -59,7 +59,7 @@ static unsigned long div_recalc_rate(struct clk_hw *hw, + div &= BIT(divider->width) - 1; + + return divider_recalc_rate(hw, parent_rate, div, NULL, +- CLK_DIVIDER_ROUND_CLOSEST); ++ CLK_DIVIDER_ROUND_CLOSEST, divider->width); + } + + const struct clk_ops clk_regmap_div_ops = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c +index f8203115a6bc..c10160d7a556 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c +@@ -493,8 +493,8 @@ static SUNXI_CCU_MUX_WITH_GATE(tcon0_clk, "tcon0", tcon0_parents, + 0x118, 24, 3, BIT(31), CLK_SET_RATE_PARENT); + + static const char * const tcon1_parents[] = { "pll-video1" }; +-static SUNXI_CCU_MUX_WITH_GATE(tcon1_clk, "tcon1", tcon1_parents, +- 0x11c, 24, 3, BIT(31), CLK_SET_RATE_PARENT); ++static SUNXI_CCU_M_WITH_MUX_GATE(tcon1_clk, "tcon1", tcon1_parents, ++ 0x11c, 0, 4, 24, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_GATE(csi_misc_clk, "csi-misc", "osc24M", 0x130, BIT(16), 0); + +diff --git a/drivers/clk/sunxi-ng/ccu_div.c b/drivers/clk/sunxi-ng/ccu_div.c +index baa3cf96507b..302a18efd39f 100644 +--- a/drivers/clk/sunxi-ng/ccu_div.c ++++ b/drivers/clk/sunxi-ng/ccu_div.c +@@ -71,7 +71,7 @@ static unsigned long ccu_div_recalc_rate(struct clk_hw *hw, + parent_rate); + + val = divider_recalc_rate(hw, parent_rate, val, cd->div.table, +- cd->div.flags); ++ cd->div.flags, cd->div.width); + + if (cd->common.features & CCU_FEATURE_FIXED_POSTDIV) + val /= cd->fixed_post_div; +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index 7e1e5bbcf430..6b3a63545619 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -41,11 +41,9 @@ + #define POWERNV_MAX_PSTATES 256 + #define PMSR_PSAFE_ENABLE (1UL << 30) + #define PMSR_SPR_EM_DISABLE (1UL << 31) +-#define PMSR_MAX(x) ((x >> 32) & 0xFF) ++#define MAX_PSTATE_SHIFT 32 + #define LPSTATE_SHIFT 48 + #define GPSTATE_SHIFT 56 +-#define GET_LPSTATE(x) (((x) >> LPSTATE_SHIFT) & 0xFF) +-#define GET_GPSTATE(x) (((x) >> GPSTATE_SHIFT) & 0xFF) + + #define MAX_RAMP_DOWN_TIME 5120 + /* +@@ -93,6 +91,7 @@ struct global_pstate_info { + }; + + static struct cpufreq_frequency_table powernv_freqs[POWERNV_MAX_PSTATES+1]; ++u32 pstate_sign_prefix; + static bool rebooting, throttled, occ_reset; + + static const char * const throttle_reason[] = { +@@ -147,6 +146,20 @@ static struct powernv_pstate_info { + bool wof_enabled; + } powernv_pstate_info; + ++static inline int extract_pstate(u64 pmsr_val, unsigned int shift) ++{ ++ int ret = ((pmsr_val >> shift) & 0xFF); ++ ++ if (!ret) ++ return ret; ++ ++ return (pstate_sign_prefix | ret); ++} ++ ++#define extract_local_pstate(x) extract_pstate(x, LPSTATE_SHIFT) ++#define extract_global_pstate(x) extract_pstate(x, GPSTATE_SHIFT) ++#define extract_max_pstate(x) extract_pstate(x, MAX_PSTATE_SHIFT) ++ + /* Use following macros for conversions between pstate_id and index */ + static inline int idx_to_pstate(unsigned int i) + { +@@ -277,6 +290,9 @@ static int init_powernv_pstates(void) + + powernv_pstate_info.nr_pstates = nr_pstates; + pr_debug("NR PStates %d\n", nr_pstates); ++ ++ pstate_sign_prefix = pstate_min & ~0xFF; ++ + for (i = 0; i < nr_pstates; i++) { + u32 id = be32_to_cpu(pstate_ids[i]); + u32 freq = be32_to_cpu(pstate_freqs[i]); +@@ -437,17 +453,10 @@ struct powernv_smp_call_data { + static void powernv_read_cpu_freq(void *arg) + { + unsigned long pmspr_val; +- s8 local_pstate_id; + struct powernv_smp_call_data *freq_data = arg; + + pmspr_val = get_pmspr(SPRN_PMSR); +- +- /* +- * The local pstate id corresponds bits 48..55 in the PMSR. +- * Note: Watch out for the sign! +- */ +- local_pstate_id = (pmspr_val >> 48) & 0xFF; +- freq_data->pstate_id = local_pstate_id; ++ freq_data->pstate_id = extract_local_pstate(pmspr_val); + freq_data->freq = pstate_id_to_freq(freq_data->pstate_id); + + pr_debug("cpu %d pmsr %016lX pstate_id %d frequency %d kHz\n", +@@ -521,7 +530,7 @@ static void powernv_cpufreq_throttle_check(void *data) + chip = this_cpu_read(chip_info); + + /* Check for Pmax Capping */ +- pmsr_pmax = (s8)PMSR_MAX(pmsr); ++ pmsr_pmax = extract_max_pstate(pmsr); + pmsr_pmax_idx = pstate_to_idx(pmsr_pmax); + if (pmsr_pmax_idx != powernv_pstate_info.max) { + if (chip->throttled) +@@ -644,8 +653,8 @@ void gpstate_timer_handler(unsigned long data) + * value. Hence, read from PMCR to get correct data. + */ + val = get_pmspr(SPRN_PMCR); +- freq_data.gpstate_id = (s8)GET_GPSTATE(val); +- freq_data.pstate_id = (s8)GET_LPSTATE(val); ++ freq_data.gpstate_id = extract_global_pstate(val); ++ freq_data.pstate_id = extract_local_pstate(val); + if (freq_data.gpstate_id == freq_data.pstate_id) { + reset_gpstates(policy); + spin_unlock(&gpstates->gpstate_lock); +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 202476fbbc4c..8a411514a7c5 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -935,7 +935,8 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr, + if (df->governor == governor) { + ret = 0; + goto out; +- } else if (df->governor->immutable || governor->immutable) { ++ } else if ((df->governor && df->governor->immutable) || ++ governor->immutable) { + ret = -EINVAL; + goto out; + } +diff --git a/drivers/edac/mv64x60_edac.c b/drivers/edac/mv64x60_edac.c +index ec5d695bbb72..3c68bb525d5d 100644 +--- a/drivers/edac/mv64x60_edac.c ++++ b/drivers/edac/mv64x60_edac.c +@@ -758,7 +758,7 @@ static int mv64x60_mc_err_probe(struct platform_device *pdev) + /* Non-ECC RAM? */ + printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__); + res = -ENODEV; +- goto err2; ++ goto err; + } + + edac_dbg(3, "init mci\n"); +diff --git a/drivers/gpio/gpio-thunderx.c b/drivers/gpio/gpio-thunderx.c +index 57efb251f9c4..10523ce00c38 100644 +--- a/drivers/gpio/gpio-thunderx.c ++++ b/drivers/gpio/gpio-thunderx.c +@@ -566,8 +566,10 @@ static int thunderx_gpio_probe(struct pci_dev *pdev, + txgpio->irqd = irq_domain_create_hierarchy(irq_get_irq_data(txgpio->msix_entries[0].vector)->domain, + 0, 0, of_node_to_fwnode(dev->of_node), + &thunderx_gpio_irqd_ops, txgpio); +- if (!txgpio->irqd) ++ if (!txgpio->irqd) { ++ err = -ENOMEM; + goto out; ++ } + + /* Push on irq_data and the domain for each line. */ + for (i = 0; i < ngpio; i++) { +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index bdd68ff197dc..b4c8b25453a6 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -3340,7 +3340,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + return desc; + } + +- status = gpiod_request(desc, con_id); ++ /* If a connection label was passed use that, else use the device name as label */ ++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev)); + if (status < 0) + return ERR_PTR(status); + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c +index fe15aa64086f..71fe60e5f01f 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c +@@ -698,7 +698,7 @@ static unsigned long dsi_pll_14nm_postdiv_recalc_rate(struct clk_hw *hw, + val &= div_mask(width); + + return divider_recalc_rate(hw, parent_rate, val, NULL, +- postdiv->flags); ++ postdiv->flags, width); + } + + static long dsi_pll_14nm_postdiv_round_rate(struct clk_hw *hw, +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index 62e38fa8cda2..e362a932fe8c 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -95,18 +95,20 @@ enum ina2xx_ids { ina219, ina226 }; + + struct ina2xx_config { + u16 config_default; +- int calibration_factor; ++ int calibration_value; + int registers; + int shunt_div; + int bus_voltage_shift; + int bus_voltage_lsb; /* uV */ +- int power_lsb; /* uW */ ++ int power_lsb_factor; + }; + + struct ina2xx_data { + const struct ina2xx_config *config; + + long rshunt; ++ long current_lsb_uA; ++ long power_lsb_uW; + struct mutex config_lock; + struct regmap *regmap; + +@@ -116,21 +118,21 @@ struct ina2xx_data { + static const struct ina2xx_config ina2xx_config[] = { + [ina219] = { + .config_default = INA219_CONFIG_DEFAULT, +- .calibration_factor = 40960000, ++ .calibration_value = 4096, + .registers = INA219_REGISTERS, + .shunt_div = 100, + .bus_voltage_shift = 3, + .bus_voltage_lsb = 4000, +- .power_lsb = 20000, ++ .power_lsb_factor = 20, + }, + [ina226] = { + .config_default = INA226_CONFIG_DEFAULT, +- .calibration_factor = 5120000, ++ .calibration_value = 2048, + .registers = INA226_REGISTERS, + .shunt_div = 400, + .bus_voltage_shift = 0, + .bus_voltage_lsb = 1250, +- .power_lsb = 25000, ++ .power_lsb_factor = 25, + }, + }; + +@@ -169,12 +171,16 @@ static u16 ina226_interval_to_reg(int interval) + return INA226_SHIFT_AVG(avg_bits); + } + ++/* ++ * Calibration register is set to the best value, which eliminates ++ * truncation errors on calculating current register in hardware. ++ * According to datasheet (eq. 3) the best values are 2048 for ++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value. ++ */ + static int ina2xx_calibrate(struct ina2xx_data *data) + { +- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- data->rshunt); +- +- return regmap_write(data->regmap, INA2XX_CALIBRATION, val); ++ return regmap_write(data->regmap, INA2XX_CALIBRATION, ++ data->config->calibration_value); + } + + /* +@@ -187,10 +193,6 @@ static int ina2xx_init(struct ina2xx_data *data) + if (ret < 0) + return ret; + +- /* +- * Set current LSB to 1mA, shunt is in uOhms +- * (equation 13 in datasheet). +- */ + return ina2xx_calibrate(data); + } + +@@ -268,15 +270,15 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg, + val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_POWER: +- val = regval * data->config->power_lsb; ++ val = regval * data->power_lsb_uW; + break; + case INA2XX_CURRENT: +- /* signed register, LSB=1mA (selected), in mA */ +- val = (s16)regval; ++ /* signed register, result in mA */ ++ val = regval * data->current_lsb_uA; ++ val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_CALIBRATION: +- val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- regval); ++ val = regval; + break; + default: + /* programmer goofed */ +@@ -304,9 +306,32 @@ static ssize_t ina2xx_show_value(struct device *dev, + ina2xx_get_value(data, attr->index, regval)); + } + +-static ssize_t ina2xx_set_shunt(struct device *dev, +- struct device_attribute *da, +- const char *buf, size_t count) ++/* ++ * In order to keep calibration register value fixed, the product ++ * of current_lsb and shunt_resistor should also be fixed and equal ++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order ++ * to keep the scale. ++ */ ++static int ina2xx_set_shunt(struct ina2xx_data *data, long val) ++{ ++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000, ++ data->config->shunt_div); ++ if (val <= 0 || val > dividend) ++ return -EINVAL; ++ ++ mutex_lock(&data->config_lock); ++ data->rshunt = val; ++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val); ++ data->power_lsb_uW = data->config->power_lsb_factor * ++ data->current_lsb_uA; ++ mutex_unlock(&data->config_lock); ++ ++ return 0; ++} ++ ++static ssize_t ina2xx_store_shunt(struct device *dev, ++ struct device_attribute *da, ++ const char *buf, size_t count) + { + unsigned long val; + int status; +@@ -316,18 +341,9 @@ static ssize_t ina2xx_set_shunt(struct device *dev, + if (status < 0) + return status; + +- if (val == 0 || +- /* Values greater than the calibration factor make no sense. */ +- val > data->config->calibration_factor) +- return -EINVAL; +- +- mutex_lock(&data->config_lock); +- data->rshunt = val; +- status = ina2xx_calibrate(data); +- mutex_unlock(&data->config_lock); ++ status = ina2xx_set_shunt(data, val); + if (status < 0) + return status; +- + return count; + } + +@@ -387,7 +403,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_set_shunt, ++ ina2xx_show_value, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +@@ -448,10 +464,7 @@ static int ina2xx_probe(struct i2c_client *client, + val = INA2XX_RSHUNT_DEFAULT; + } + +- if (val <= 0 || val > data->config->calibration_factor) +- return -ENODEV; +- +- data->rshunt = val; ++ ina2xx_set_shunt(data, val); + + ina2xx_regmap_config.max_register = data->config->registers; + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6cae00ecc905..25de7cc9f49f 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4453,6 +4453,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb) + id_stats->qp_type = id->qp_type; + + i_id++; ++ nlmsg_end(skb, nlh); + } + + cb->args[1] = 0; +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 722235bed075..d6fa38f8604f 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -914,13 +914,14 @@ static ssize_t ucma_query_path(struct ucma_context *ctx, + + resp->path_data[i].flags = IB_PATH_GMP | IB_PATH_PRIMARY | + IB_PATH_BIDIRECTIONAL; +- if (rec->rec_type == SA_PATH_REC_TYPE_IB) { +- ib_sa_pack_path(rec, &resp->path_data[i].path_rec); +- } else { ++ if (rec->rec_type == SA_PATH_REC_TYPE_OPA) { + struct sa_path_rec ib; + + sa_convert_path_opa_to_ib(&ib, rec); + ib_sa_pack_path(&ib, &resp->path_data[i].path_rec); ++ ++ } else { ++ ib_sa_pack_path(rec, &resp->path_data[i].path_rec); + } + } + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c +index d6a1a308c6a0..b7f1ce5333cb 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c +@@ -125,7 +125,8 @@ static u8 i40iw_derive_hw_ird_setting(u16 cm_ird) + * @conn_ird: connection IRD + * @conn_ord: connection ORD + */ +-static void i40iw_record_ird_ord(struct i40iw_cm_node *cm_node, u16 conn_ird, u16 conn_ord) ++static void i40iw_record_ird_ord(struct i40iw_cm_node *cm_node, u32 conn_ird, ++ u32 conn_ord) + { + if (conn_ird > I40IW_MAX_IRD_SIZE) + conn_ird = I40IW_MAX_IRD_SIZE; +@@ -3841,7 +3842,7 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + } + + cm_node->apbvt_set = true; +- i40iw_record_ird_ord(cm_node, (u16)conn_param->ird, (u16)conn_param->ord); ++ i40iw_record_ird_ord(cm_node, conn_param->ird, conn_param->ord); + if (cm_node->send_rdma0_op == SEND_RDMA_READ_ZERO && + !cm_node->ord_size) + cm_node->ord_size = 1; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +index d86f3e670804..472ef4d6e858 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -3875,8 +3875,10 @@ enum i40iw_status_code i40iw_config_fpm_values(struct i40iw_sc_dev *dev, u32 qp_ + hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].cnt = 1; + hmc_info->hmc_obj[I40IW_HMC_IW_MR].cnt = mrwanted; + +- hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt = I40IW_MAX_WQ_ENTRIES * qpwanted; +- hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt = 4 * I40IW_MAX_IRD_SIZE * qpwanted; ++ hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt = ++ roundup_pow_of_two(I40IW_MAX_WQ_ENTRIES * qpwanted); ++ hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt = ++ roundup_pow_of_two(2 * I40IW_MAX_IRD_SIZE * qpwanted); + hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].cnt = + hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt / hmc_fpm_misc->xf_block_size; + hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].cnt = +diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h +index 24eabcad5e40..019ad3b939f9 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -93,6 +93,7 @@ + #define RDMA_OPCODE_MASK 0x0f + #define RDMA_READ_REQ_OPCODE 1 + #define Q2_BAD_FRAME_OFFSET 72 ++#define Q2_FPSN_OFFSET 64 + #define CQE_MAJOR_DRV 0x8000 + + #define I40IW_TERM_SENT 0x01 +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c +index 59f70676f0e0..14d38d733cb4 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c +@@ -1376,7 +1376,7 @@ static void i40iw_ieq_handle_exception(struct i40iw_puda_rsrc *ieq, + u32 *hw_host_ctx = (u32 *)qp->hw_host_ctx; + u32 rcv_wnd = hw_host_ctx[23]; + /* first partial seq # in q2 */ +- u32 fps = qp->q2_buf[16]; ++ u32 fps = *(u32 *)(qp->q2_buf + Q2_FPSN_OFFSET); + struct list_head *rxlist = &pfpdu->rxlist; + struct list_head *plist; + +diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c +index 97d71e49c092..88fa4d44ab5f 100644 +--- a/drivers/infiniband/sw/rdmavt/cq.c ++++ b/drivers/infiniband/sw/rdmavt/cq.c +@@ -198,7 +198,7 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev, + return ERR_PTR(-EINVAL); + + /* Allocate the completion queue structure. */ +- cq = kzalloc(sizeof(*cq), GFP_KERNEL); ++ cq = kzalloc_node(sizeof(*cq), GFP_KERNEL, rdi->dparms.node); + if (!cq) + return ERR_PTR(-ENOMEM); + +@@ -214,7 +214,9 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev, + sz += sizeof(struct ib_uverbs_wc) * (entries + 1); + else + sz += sizeof(struct ib_wc) * (entries + 1); +- wc = vmalloc_user(sz); ++ wc = udata ? ++ vmalloc_user(sz) : ++ vzalloc_node(sz, rdi->dparms.node); + if (!wc) { + ret = ERR_PTR(-ENOMEM); + goto bail_cq; +@@ -369,7 +371,9 @@ int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) + sz += sizeof(struct ib_uverbs_wc) * (cqe + 1); + else + sz += sizeof(struct ib_wc) * (cqe + 1); +- wc = vmalloc_user(sz); ++ wc = udata ? ++ vmalloc_user(sz) : ++ vzalloc_node(sz, rdi->dparms.node); + if (!wc) + return -ENOMEM; + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index b3bbad7d2282..5dafafad6351 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -808,8 +808,10 @@ static int __maybe_unused goodix_suspend(struct device *dev) + int error; + + /* We need gpio pins to suspend/resume */ +- if (!ts->gpiod_int || !ts->gpiod_rst) ++ if (!ts->gpiod_int || !ts->gpiod_rst) { ++ disable_irq(client->irq); + return 0; ++ } + + wait_for_completion(&ts->firmware_loading_complete); + +@@ -849,8 +851,10 @@ static int __maybe_unused goodix_resume(struct device *dev) + struct goodix_ts_data *ts = i2c_get_clientdata(client); + int error; + +- if (!ts->gpiod_int || !ts->gpiod_rst) ++ if (!ts->gpiod_int || !ts->gpiod_rst) { ++ enable_irq(client->irq); + return 0; ++ } + + /* + * Exit sleep mode by outputting HIGH level to INT pin +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index ae9ff72e83ee..848fcdf6a112 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -1297,6 +1297,10 @@ gic_acpi_parse_madt_gicc(struct acpi_subtable_header *header, + u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2; + void __iomem *redist_base; + ++ /* GICC entry which has !ACPI_MADT_ENABLED is not unusable so skip */ ++ if (!(gicc->flags & ACPI_MADT_ENABLED)) ++ return 0; ++ + redist_base = ioremap(gicc->gicr_base_address, size); + if (!redist_base) + return -ENOMEM; +@@ -1346,6 +1350,13 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header, + if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) + return 0; + ++ /* ++ * It's perfectly valid firmware can pass disabled GICC entry, driver ++ * should not treat as errors, skip the entry instead of probe fail. ++ */ ++ if (!(gicc->flags & ACPI_MADT_ENABLED)) ++ return 0; ++ + return -ENODEV; + } + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 934b1fce4ce1..f0dc8e2aee65 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -515,15 +515,21 @@ struct open_bucket { + + /* + * We keep multiple buckets open for writes, and try to segregate different +- * write streams for better cache utilization: first we look for a bucket where +- * the last write to it was sequential with the current write, and failing that +- * we look for a bucket that was last used by the same task. ++ * write streams for better cache utilization: first we try to segregate flash ++ * only volume write streams from cached devices, secondly we look for a bucket ++ * where the last write to it was sequential with the current write, and ++ * failing that we look for a bucket that was last used by the same task. + * + * The ideas is if you've got multiple tasks pulling data into the cache at the + * same time, you'll get better cache utilization if you try to segregate their + * data and preserve locality. + * +- * For example, say you've starting Firefox at the same time you're copying a ++ * For example, dirty sectors of flash only volume is not reclaimable, if their ++ * dirty sectors mixed with dirty sectors of cached device, such buckets will ++ * be marked as dirty and won't be reclaimed, though the dirty data of cached ++ * device have been written back to backend device. ++ * ++ * And say you've starting Firefox at the same time you're copying a + * bunch of files. Firefox will likely end up being fairly hot and stay in the + * cache awhile, but the data you copied might not be; if you wrote all that + * data to the same buckets it'd get invalidated at the same time. +@@ -540,7 +546,10 @@ static struct open_bucket *pick_data_bucket(struct cache_set *c, + struct open_bucket *ret, *ret_task = NULL; + + list_for_each_entry_reverse(ret, &c->data_buckets, list) +- if (!bkey_cmp(&ret->key, search)) ++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) != ++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)])) ++ continue; ++ else if (!bkey_cmp(&ret->key, search)) + goto found; + else if (ret->last_write_point == write_point) + ret_task = ret; +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index e9fbf2bcd122..f34ad8720756 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -568,6 +568,7 @@ static void cache_lookup(struct closure *cl) + { + struct search *s = container_of(cl, struct search, iop.cl); + struct bio *bio = &s->bio.bio; ++ struct cached_dev *dc; + int ret; + + bch_btree_op_init(&s->op, -1); +@@ -580,6 +581,27 @@ static void cache_lookup(struct closure *cl) + return; + } + ++ /* ++ * We might meet err when searching the btree, If that happens, we will ++ * get negative ret, in this scenario we should not recover data from ++ * backing device (when cache device is dirty) because we don't know ++ * whether bkeys the read request covered are all clean. ++ * ++ * And after that happened, s->iop.status is still its initial value ++ * before we submit s->bio.bio ++ */ ++ if (ret < 0) { ++ BUG_ON(ret == -EINTR); ++ if (s->d && s->d->c && ++ !UUID_FLASH_ONLY(&s->d->c->uuids[s->d->id])) { ++ dc = container_of(s->d, struct cached_dev, disk); ++ if (dc && atomic_read(&dc->has_dirty)) ++ s->recoverable = false; ++ } ++ if (!s->iop.status) ++ s->iop.status = BLK_STS_IOERR; ++ } ++ + closure_return(cl); + } + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 9417170f180a..5d0430777dda 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -893,6 +893,12 @@ static void cached_dev_detach_finish(struct work_struct *w) + + mutex_lock(&bch_register_lock); + ++ cancel_delayed_work_sync(&dc->writeback_rate_update); ++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) { ++ kthread_stop(dc->writeback_thread); ++ dc->writeback_thread = NULL; ++ } ++ + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index cb115ba6a1d2..6d9adcaa26ba 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -332,6 +332,10 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory, + struct vb2_buffer *vb; + int ret; + ++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ ++ num_buffers = min_t(unsigned int, num_buffers, ++ VB2_MAX_FRAME - q->num_buffers); ++ + for (buffer = 0; buffer < num_buffers; ++buffer) { + /* Allocate videobuf buffer structures */ + vb = kzalloc(q->buf_struct_size, GFP_KERNEL); +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 070f5da06fd2..5bedf4b7f0f7 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -806,6 +806,8 @@ static int intel_mrfld_mmc_probe_slot(struct sdhci_pci_slot *slot) + slot->host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V; + break; + case INTEL_MRFLD_SDIO: ++ /* Advertise 2.0v for compatibility with the SDIO card's OCR */ ++ slot->host->ocr_mask = MMC_VDD_20_21 | MMC_VDD_165_195; + slot->host->mmc->caps |= MMC_CAP_NONREMOVABLE | + MMC_CAP_POWER_OFF_CARD; + break; +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 90cc1977b792..d35deb79965d 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1470,6 +1470,13 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode, + if (mode != MMC_POWER_OFF) { + switch (1 << vdd) { + case MMC_VDD_165_195: ++ /* ++ * Without a regulator, SDHCI does not support 2.0v ++ * so we only get here if the driver deliberately ++ * added the 2.0v range to ocr_avail. Map it to 1.8v ++ * for the purpose of turning on the power. ++ */ ++ case MMC_VDD_20_21: + pwr = SDHCI_POWER_180; + break; + case MMC_VDD_29_30: +diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c +index 1cb3f7758fb6..766b2c385682 100644 +--- a/drivers/mtd/tests/oobtest.c ++++ b/drivers/mtd/tests/oobtest.c +@@ -193,6 +193,9 @@ static int verify_eraseblock(int ebnum) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != use_len) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -227,6 +230,9 @@ static int verify_eraseblock(int ebnum) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != mtd->oobavail) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -286,6 +292,9 @@ static int verify_eraseblock_in_one_go(int ebnum) + + /* read entire block's OOB at one go */ + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != len) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -527,6 +536,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to start read past end of OOB\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, addr0, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -571,6 +583,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to read past end of device\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -615,6 +630,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to read past end of device\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -684,6 +702,9 @@ static int __init mtd_oobtest_init(void) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) + goto out; + if (memcmpshow(addr, readbuf, writebuf, +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b2db581131b2..82f28ffccddf 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1524,39 +1524,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_close; + } + +- /* If the mode uses primary, then the following is handled by +- * bond_change_active_slave(). +- */ +- if (!bond_uses_primary(bond)) { +- /* set promiscuity level to new slave */ +- if (bond_dev->flags & IFF_PROMISC) { +- res = dev_set_promiscuity(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- /* set allmulti level to new slave */ +- if (bond_dev->flags & IFF_ALLMULTI) { +- res = dev_set_allmulti(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- netif_addr_lock_bh(bond_dev); +- +- dev_mc_sync_multiple(slave_dev, bond_dev); +- dev_uc_sync_multiple(slave_dev, bond_dev); +- +- netif_addr_unlock_bh(bond_dev); +- } +- +- if (BOND_MODE(bond) == BOND_MODE_8023AD) { +- /* add lacpdu mc addr to mc list */ +- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +- +- dev_mc_add(slave_dev, lacpdu_multicast); +- } +- + res = vlan_vids_add_by_dev(slave_dev, bond_dev); + if (res) { + netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", +@@ -1721,6 +1688,40 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_upper_unlink; + } + ++ /* If the mode uses primary, then the following is handled by ++ * bond_change_active_slave(). ++ */ ++ if (!bond_uses_primary(bond)) { ++ /* set promiscuity level to new slave */ ++ if (bond_dev->flags & IFF_PROMISC) { ++ res = dev_set_promiscuity(slave_dev, 1); ++ if (res) ++ goto err_sysfs_del; ++ } ++ ++ /* set allmulti level to new slave */ ++ if (bond_dev->flags & IFF_ALLMULTI) { ++ res = dev_set_allmulti(slave_dev, 1); ++ if (res) { ++ if (bond_dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(slave_dev, -1); ++ goto err_sysfs_del; ++ } ++ } ++ ++ netif_addr_lock_bh(bond_dev); ++ dev_mc_sync_multiple(slave_dev, bond_dev); ++ dev_uc_sync_multiple(slave_dev, bond_dev); ++ netif_addr_unlock_bh(bond_dev); ++ ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) { ++ /* add lacpdu mc addr to mc list */ ++ u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; ++ ++ dev_mc_add(slave_dev, lacpdu_multicast); ++ } ++ } ++ + bond->slave_cnt++; + bond_compute_features(bond); + bond_set_carrier(bond); +@@ -1744,6 +1745,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + return 0; + + /* Undo stages on error */ ++err_sysfs_del: ++ bond_sysfs_slave_del(new_slave); ++ + err_upper_unlink: + bond_upper_dev_unlink(bond, new_slave); + +@@ -1751,9 +1755,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + netdev_rx_handler_unregister(slave_dev); + + err_detach: +- if (!bond_uses_primary(bond)) +- bond_hw_addr_flush(bond_dev, slave_dev); +- + vlan_vids_del_by_dev(slave_dev, bond_dev); + if (rcu_access_pointer(bond->primary_slave) == new_slave) + RCU_INIT_POINTER(bond->primary_slave, NULL); +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +index 05498e7f2840..6246003f9922 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +@@ -2619,8 +2619,8 @@ void t4vf_sge_stop(struct adapter *adapter) + int t4vf_sge_init(struct adapter *adapter) + { + struct sge_params *sge_params = &adapter->params.sge; +- u32 fl0 = sge_params->sge_fl_buffer_size[0]; +- u32 fl1 = sge_params->sge_fl_buffer_size[1]; ++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0]; ++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1]; + struct sge *s = &adapter->sge; + + /* +@@ -2628,9 +2628,20 @@ int t4vf_sge_init(struct adapter *adapter) + * the Physical Function Driver. Ideally we should be able to deal + * with _any_ configuration. Practice is different ... + */ +- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) { ++ ++ /* We only bother using the Large Page logic if the Large Page Buffer ++ * is larger than our Page Size Buffer. ++ */ ++ if (fl_large_pg <= fl_small_pg) ++ fl_large_pg = 0; ++ ++ /* The Page Size Buffer must be exactly equal to our Page Size and the ++ * Large Page Size Buffer should be 0 (per above) or a power of 2. ++ */ ++ if (fl_small_pg != PAGE_SIZE || ++ (fl_large_pg & (fl_large_pg - 1)) != 0) { + dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n", +- fl0, fl1); ++ fl_small_pg, fl_large_pg); + return -EINVAL; + } + if ((sge_params->sge_control & RXPKTCPLMODE_F) != +@@ -2642,8 +2653,8 @@ int t4vf_sge_init(struct adapter *adapter) + /* + * Now translate the adapter parameters into our internal forms. + */ +- if (fl1) +- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT; ++ if (fl_large_pg) ++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT; + s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F) + ? 128 : 64); + s->pktshift = PKTSHIFT_G(sge_params->sge_control); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index a0ef97e7f3c9..ff7a70ffafc6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2092,6 +2092,10 @@ static int hclge_get_autoneg(struct hnae3_handle *handle) + { + struct hclge_vport *vport = hclge_get_vport(handle); + struct hclge_dev *hdev = vport->back; ++ struct phy_device *phydev = hdev->hw.mac.phydev; ++ ++ if (phydev) ++ return phydev->autoneg; + + hclge_query_autoneg_result(hdev); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +index 186772493711..d1e4dcec5db2 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +@@ -1060,6 +1060,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + u64 rx_bytes = 0; + u64 tx_pkts = 0; + u64 rx_pkts = 0; ++ u64 tx_drop = 0; ++ u64 rx_drop = 0; + + for (idx = 0; idx < queue_num; idx++) { + /* fetch the tx stats */ +@@ -1068,6 +1070,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + start = u64_stats_fetch_begin_irq(&ring->syncp); + tx_bytes += ring->stats.tx_bytes; + tx_pkts += ring->stats.tx_pkts; ++ tx_drop += ring->stats.tx_busy; ++ tx_drop += ring->stats.sw_err_cnt; + } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + + /* fetch the rx stats */ +@@ -1076,6 +1080,9 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + start = u64_stats_fetch_begin_irq(&ring->syncp); + rx_bytes += ring->stats.rx_bytes; + rx_pkts += ring->stats.rx_pkts; ++ rx_drop += ring->stats.non_vld_descs; ++ rx_drop += ring->stats.err_pkt_len; ++ rx_drop += ring->stats.l2_err; + } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + } + +@@ -1091,8 +1098,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + stats->rx_missed_errors = netdev->stats.rx_missed_errors; + + stats->tx_errors = netdev->stats.tx_errors; +- stats->rx_dropped = netdev->stats.rx_dropped; +- stats->tx_dropped = netdev->stats.tx_dropped; ++ stats->rx_dropped = rx_drop + netdev->stats.rx_dropped; ++ stats->tx_dropped = tx_drop + netdev->stats.tx_dropped; + stats->collisions = netdev->stats.collisions; + stats->rx_over_errors = netdev->stats.rx_over_errors; + stats->rx_frame_errors = netdev->stats.rx_frame_errors; +@@ -1306,6 +1313,8 @@ static int hns3_nic_change_mtu(struct net_device *netdev, int new_mtu) + return ret; + } + ++ netdev->mtu = new_mtu; ++ + /* if the netdev was running earlier, bring it up again */ + if (if_running && hns3_nic_net_open(netdev)) + ret = -EINVAL; +@@ -2687,8 +2696,12 @@ static int hns3_uninit_all_ring(struct hns3_nic_priv *priv) + h->ae_algo->ops->reset_queue(h, i); + + hns3_fini_ring(priv->ring_data[i].ring); ++ devm_kfree(priv->dev, priv->ring_data[i].ring); + hns3_fini_ring(priv->ring_data[i + h->kinfo.num_tqps].ring); ++ devm_kfree(priv->dev, ++ priv->ring_data[i + h->kinfo.num_tqps].ring); + } ++ devm_kfree(priv->dev, priv->ring_data); + + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c +index e590d96e434a..a64a5a413d4d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c +@@ -22,7 +22,8 @@ struct hns3_stats { + #define HNS3_TQP_STAT(_string, _member) { \ + .stats_string = _string, \ + .stats_size = FIELD_SIZEOF(struct ring_stats, _member), \ +- .stats_offset = offsetof(struct hns3_enet_ring, stats), \ ++ .stats_offset = offsetof(struct hns3_enet_ring, stats) +\ ++ offsetof(struct ring_stats, _member), \ + } \ + + static const struct hns3_stats hns3_txq_stats[] = { +@@ -189,13 +190,13 @@ static u64 *hns3_get_stats_tqps(struct hnae3_handle *handle, u64 *data) + struct hnae3_knic_private_info *kinfo = &handle->kinfo; + struct hns3_enet_ring *ring; + u8 *stat; +- u32 i; ++ int i, j; + + /* get stats for Tx */ + for (i = 0; i < kinfo->num_tqps; i++) { + ring = nic_priv->ring_data[i].ring; +- for (i = 0; i < HNS3_TXQ_STATS_COUNT; i++) { +- stat = (u8 *)ring + hns3_txq_stats[i].stats_offset; ++ for (j = 0; j < HNS3_TXQ_STATS_COUNT; j++) { ++ stat = (u8 *)ring + hns3_txq_stats[j].stats_offset; + *data++ = *(u64 *)stat; + } + } +@@ -203,8 +204,8 @@ static u64 *hns3_get_stats_tqps(struct hnae3_handle *handle, u64 *data) + /* get stats for Rx */ + for (i = 0; i < kinfo->num_tqps; i++) { + ring = nic_priv->ring_data[i + kinfo->num_tqps].ring; +- for (i = 0; i < HNS3_RXQ_STATS_COUNT; i++) { +- stat = (u8 *)ring + hns3_rxq_stats[i].stats_offset; ++ for (j = 0; j < HNS3_RXQ_STATS_COUNT; j++) { ++ stat = (u8 *)ring + hns3_rxq_stats[j].stats_offset; + *data++ = *(u64 *)stat; + } + } +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 3b0db01ead1f..3ae02b0620bc 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2209,6 +2209,12 @@ static irqreturn_t ibmvnic_interrupt_rx(int irq, void *instance) + struct ibmvnic_sub_crq_queue *scrq = instance; + struct ibmvnic_adapter *adapter = scrq->adapter; + ++ /* When booting a kdump kernel we can hit pending interrupts ++ * prior to completing driver initialization. ++ */ ++ if (unlikely(adapter->state != VNIC_OPEN)) ++ return IRQ_NONE; ++ + adapter->rx_stats_buffers[scrq->scrq_num].interrupts++; + + if (napi_schedule_prep(&adapter->napi[scrq->scrq_num])) { +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index 1ccad6f30ebf..4eb6ff60e8fc 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -1775,7 +1775,11 @@ static void i40evf_disable_vf(struct i40evf_adapter *adapter) + + adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED; + +- if (netif_running(adapter->netdev)) { ++ /* We don't use netif_running() because it may be true prior to ++ * ndo_open() returning, so we can't assume it means all our open ++ * tasks have finished, since we're not holding the rtnl_lock here. ++ */ ++ if (adapter->state == __I40EVF_RUNNING) { + set_bit(__I40E_VSI_DOWN, adapter->vsi.state); + netif_carrier_off(adapter->netdev); + netif_tx_disable(adapter->netdev); +@@ -1833,6 +1837,7 @@ static void i40evf_reset_task(struct work_struct *work) + struct i40evf_mac_filter *f; + u32 reg_val; + int i = 0, err; ++ bool running; + + while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, + &adapter->crit_section)) +@@ -1892,7 +1897,13 @@ static void i40evf_reset_task(struct work_struct *work) + } + + continue_reset: +- if (netif_running(netdev)) { ++ /* We don't use netif_running() because it may be true prior to ++ * ndo_open() returning, so we can't assume it means all our open ++ * tasks have finished, since we're not holding the rtnl_lock here. ++ */ ++ running = (adapter->state == __I40EVF_RUNNING); ++ ++ if (running) { + netif_carrier_off(netdev); + netif_tx_stop_all_queues(netdev); + adapter->link_up = false; +@@ -1936,7 +1947,10 @@ static void i40evf_reset_task(struct work_struct *work) + + mod_timer(&adapter->watchdog_timer, jiffies + 2); + +- if (netif_running(adapter->netdev)) { ++ /* We were running when the reset started, so we need to restore some ++ * state here. ++ */ ++ if (running) { + /* allocate transmit descriptors */ + err = i40evf_setup_all_tx_resources(adapter); + if (err) +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index 1145cde2274a..b12e3a4f9439 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -5087,7 +5087,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + INIT_WORK(&hw->restart_work, sky2_restart); + + pci_set_drvdata(pdev, hw); +- pdev->d3_delay = 150; ++ pdev->d3_delay = 200; + + return 0; + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c +index 5f41dc92aa68..752a72499b4f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c +@@ -156,57 +156,63 @@ static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num) + static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev) + { + struct mlx4_en_priv *priv = netdev_priv(netdev); ++ struct mlx4_en_port_profile *prof = priv->prof; + struct mlx4_en_dev *mdev = priv->mdev; ++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp; + + if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) + return 1; + + if (priv->cee_config.pfc_state) { + int tc; ++ rx_ppp = prof->rx_ppp; ++ tx_ppp = prof->tx_ppp; + +- priv->prof->rx_pause = 0; +- priv->prof->tx_pause = 0; + for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) { + u8 tc_mask = 1 << tc; + + switch (priv->cee_config.dcb_pfc[tc]) { + case pfc_disabled: +- priv->prof->tx_ppp &= ~tc_mask; +- priv->prof->rx_ppp &= ~tc_mask; ++ tx_ppp &= ~tc_mask; ++ rx_ppp &= ~tc_mask; + break; + case pfc_enabled_full: +- priv->prof->tx_ppp |= tc_mask; +- priv->prof->rx_ppp |= tc_mask; ++ tx_ppp |= tc_mask; ++ rx_ppp |= tc_mask; + break; + case pfc_enabled_tx: +- priv->prof->tx_ppp |= tc_mask; +- priv->prof->rx_ppp &= ~tc_mask; ++ tx_ppp |= tc_mask; ++ rx_ppp &= ~tc_mask; + break; + case pfc_enabled_rx: +- priv->prof->tx_ppp &= ~tc_mask; +- priv->prof->rx_ppp |= tc_mask; ++ tx_ppp &= ~tc_mask; ++ rx_ppp |= tc_mask; + break; + default: + break; + } + } +- en_dbg(DRV, priv, "Set pfc on\n"); ++ rx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->rx_pause; ++ tx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->tx_pause; + } else { +- priv->prof->rx_pause = 1; +- priv->prof->tx_pause = 1; +- en_dbg(DRV, priv, "Set pfc off\n"); ++ rx_ppp = 0; ++ tx_ppp = 0; ++ rx_pause = prof->rx_pause; ++ tx_pause = prof->tx_pause; + } + + if (mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- priv->prof->tx_pause, +- priv->prof->tx_ppp, +- priv->prof->rx_pause, +- priv->prof->rx_ppp)) { ++ tx_pause, tx_ppp, rx_pause, rx_ppp)) { + en_err(priv, "Failed setting pause params\n"); + return 1; + } + ++ prof->tx_ppp = tx_ppp; ++ prof->rx_ppp = rx_ppp; ++ prof->tx_pause = tx_pause; ++ prof->rx_pause = rx_pause; ++ + return 0; + } + +@@ -310,6 +316,7 @@ static int mlx4_en_ets_validate(struct mlx4_en_priv *priv, struct ieee_ets *ets) + } + + switch (ets->tc_tsa[i]) { ++ case IEEE_8021QAZ_TSA_VENDOR: + case IEEE_8021QAZ_TSA_STRICT: + break; + case IEEE_8021QAZ_TSA_ETS: +@@ -347,6 +354,10 @@ static int mlx4_en_config_port_scheduler(struct mlx4_en_priv *priv, + /* higher TC means higher priority => lower pg */ + for (i = IEEE_8021QAZ_MAX_TCS - 1; i >= 0; i--) { + switch (ets->tc_tsa[i]) { ++ case IEEE_8021QAZ_TSA_VENDOR: ++ pg[i] = MLX4_EN_TC_VENDOR; ++ tc_tx_bw[i] = MLX4_EN_BW_MAX; ++ break; + case IEEE_8021QAZ_TSA_STRICT: + pg[i] = num_strict++; + tc_tx_bw[i] = MLX4_EN_BW_MAX; +@@ -403,6 +414,7 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev, + struct mlx4_en_priv *priv = netdev_priv(dev); + struct mlx4_en_port_profile *prof = priv->prof; + struct mlx4_en_dev *mdev = priv->mdev; ++ u32 tx_pause, tx_ppp, rx_pause, rx_ppp; + int err; + + en_dbg(DRV, priv, "cap: 0x%x en: 0x%x mbc: 0x%x delay: %d\n", +@@ -411,23 +423,26 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev, + pfc->mbc, + pfc->delay); + +- prof->rx_pause = !pfc->pfc_en; +- prof->tx_pause = !pfc->pfc_en; +- prof->rx_ppp = pfc->pfc_en; +- prof->tx_ppp = pfc->pfc_en; ++ rx_pause = prof->rx_pause && !pfc->pfc_en; ++ tx_pause = prof->tx_pause && !pfc->pfc_en; ++ rx_ppp = pfc->pfc_en; ++ tx_ppp = pfc->pfc_en; + + err = mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- prof->tx_pause, +- prof->tx_ppp, +- prof->rx_pause, +- prof->rx_ppp); +- if (err) ++ tx_pause, tx_ppp, rx_pause, rx_ppp); ++ if (err) { + en_err(priv, "Failed setting pause params\n"); +- else +- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, +- prof->rx_ppp, prof->rx_pause, +- prof->tx_ppp, prof->tx_pause); ++ return err; ++ } ++ ++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, ++ rx_ppp, rx_pause, tx_ppp, tx_pause); ++ ++ prof->tx_ppp = tx_ppp; ++ prof->rx_ppp = rx_ppp; ++ prof->rx_pause = rx_pause; ++ prof->tx_pause = tx_pause; + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index 3d4e4a5d00d1..67f74fcb265e 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1046,27 +1046,32 @@ static int mlx4_en_set_pauseparam(struct net_device *dev, + { + struct mlx4_en_priv *priv = netdev_priv(dev); + struct mlx4_en_dev *mdev = priv->mdev; ++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp; + int err; + + if (pause->autoneg) + return -EINVAL; + +- priv->prof->tx_pause = pause->tx_pause != 0; +- priv->prof->rx_pause = pause->rx_pause != 0; ++ tx_pause = !!(pause->tx_pause); ++ rx_pause = !!(pause->rx_pause); ++ rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause); ++ tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause); ++ + err = mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- priv->prof->tx_pause, +- priv->prof->tx_ppp, +- priv->prof->rx_pause, +- priv->prof->rx_ppp); +- if (err) +- en_err(priv, "Failed setting pause params\n"); +- else +- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, +- priv->prof->rx_ppp, +- priv->prof->rx_pause, +- priv->prof->tx_ppp, +- priv->prof->tx_pause); ++ tx_pause, tx_ppp, rx_pause, rx_ppp); ++ if (err) { ++ en_err(priv, "Failed setting pause params, err = %d\n", err); ++ return err; ++ } ++ ++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, ++ rx_ppp, rx_pause, tx_ppp, tx_pause); ++ ++ priv->prof->tx_pause = tx_pause; ++ priv->prof->rx_pause = rx_pause; ++ priv->prof->tx_ppp = tx_ppp; ++ priv->prof->rx_ppp = rx_ppp; + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c +index 686e18de9a97..6b2f7122b3ab 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c +@@ -163,9 +163,9 @@ static void mlx4_en_get_profile(struct mlx4_en_dev *mdev) + params->udp_rss = 0; + } + for (i = 1; i <= MLX4_MAX_PORTS; i++) { +- params->prof[i].rx_pause = 1; ++ params->prof[i].rx_pause = !(pfcrx || pfctx); + params->prof[i].rx_ppp = pfcrx; +- params->prof[i].tx_pause = 1; ++ params->prof[i].tx_pause = !(pfcrx || pfctx); + params->prof[i].tx_ppp = pfctx; + params->prof[i].tx_ring_size = MLX4_EN_DEF_TX_RING_SIZE; + params->prof[i].rx_ring_size = MLX4_EN_DEF_RX_RING_SIZE; +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 9c218f1cfc6c..c097eef41a9c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -3335,6 +3335,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + priv->msg_enable = MLX4_EN_MSG_LEVEL; + #ifdef CONFIG_MLX4_EN_DCB + if (!mlx4_is_slave(priv->mdev->dev)) { ++ u8 prio; ++ ++ for (prio = 0; prio < IEEE_8021QAZ_MAX_TCS; ++prio) { ++ priv->ets.prio_tc[prio] = prio; ++ priv->ets.tc_tsa[prio] = IEEE_8021QAZ_TSA_VENDOR; ++ } ++ + priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST | + DCB_CAP_DCBX_VER_IEEE; + priv->flags |= MLX4_EN_DCB_ENABLED; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index fdb3ad0cbe54..2c1a5ff6acfa 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -476,6 +476,7 @@ struct mlx4_en_frag_info { + #define MLX4_EN_BW_MIN 1 + #define MLX4_EN_BW_MAX 100 /* Utilize 100% of the line */ + ++#define MLX4_EN_TC_VENDOR 0 + #define MLX4_EN_TC_ETS 7 + + enum dcb_pfc_type { +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index fabb53379727..a069fcc823c3 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -5089,6 +5089,7 @@ static void rem_slave_fs_rule(struct mlx4_dev *dev, int slave) + &tracker->res_tree[RES_FS_RULE]); + list_del(&fs_rule->com.list); + spin_unlock_irq(mlx4_tlock(dev)); ++ kfree(fs_rule->mirr_mbox); + kfree(fs_rule); + state = 0; + break; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index a863572882b2..225b2ad3e15f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2718,6 +2718,9 @@ int mlx5e_open(struct net_device *netdev) + mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_UP); + mutex_unlock(&priv->state_lock); + ++ if (mlx5e_vxlan_allowed(priv->mdev)) ++ udp_tunnel_get_rx_info(netdev); ++ + return err; + } + +@@ -4276,13 +4279,6 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv) + if (netdev->reg_state != NETREG_REGISTERED) + return; + +- /* Device already registered: sync netdev system state */ +- if (mlx5e_vxlan_allowed(mdev)) { +- rtnl_lock(); +- udp_tunnel_get_rx_info(netdev); +- rtnl_unlock(); +- } +- + queue_work(priv->wq, &priv->set_rx_mode_work); + + rtnl_lock(); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 45e03c427faf..5ffd1db4e797 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -43,6 +43,11 @@ + #include "en_tc.h" + #include "fs_core.h" + ++#define MLX5E_REP_PARAMS_LOG_SQ_SIZE \ ++ max(0x6, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE) ++#define MLX5E_REP_PARAMS_LOG_RQ_SIZE \ ++ max(0x6, MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE) ++ + static const char mlx5e_rep_driver_name[] = "mlx5e_rep"; + + static void mlx5e_rep_get_drvinfo(struct net_device *dev, +@@ -230,7 +235,7 @@ void mlx5e_remove_sqs_fwd_rules(struct mlx5e_priv *priv) + static void mlx5e_rep_neigh_update_init_interval(struct mlx5e_rep_priv *rpriv) + { + #if IS_ENABLED(CONFIG_IPV6) +- unsigned long ipv6_interval = NEIGH_VAR(&ipv6_stub->nd_tbl->parms, ++ unsigned long ipv6_interval = NEIGH_VAR(&nd_tbl.parms, + DELAY_PROBE_TIME); + #else + unsigned long ipv6_interval = ~0UL; +@@ -366,7 +371,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb, + case NETEVENT_NEIGH_UPDATE: + n = ptr; + #if IS_ENABLED(CONFIG_IPV6) +- if (n->tbl != ipv6_stub->nd_tbl && n->tbl != &arp_tbl) ++ if (n->tbl != &nd_tbl && n->tbl != &arp_tbl) + #else + if (n->tbl != &arp_tbl) + #endif +@@ -414,7 +419,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb, + * done per device delay prob time parameter. + */ + #if IS_ENABLED(CONFIG_IPV6) +- if (!p->dev || (p->tbl != ipv6_stub->nd_tbl && p->tbl != &arp_tbl)) ++ if (!p->dev || (p->tbl != &nd_tbl && p->tbl != &arp_tbl)) + #else + if (!p->dev || p->tbl != &arp_tbl) + #endif +@@ -610,7 +615,6 @@ static int mlx5e_rep_open(struct net_device *dev) + struct mlx5e_priv *priv = netdev_priv(dev); + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch_rep *rep = rpriv->rep; +- struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + int err; + + mutex_lock(&priv->state_lock); +@@ -618,8 +622,9 @@ static int mlx5e_rep_open(struct net_device *dev) + if (err) + goto unlock; + +- if (!mlx5_eswitch_set_vport_state(esw, rep->vport, +- MLX5_ESW_VPORT_ADMIN_STATE_UP)) ++ if (!mlx5_modify_vport_admin_state(priv->mdev, ++ MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT, ++ rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_UP)) + netif_carrier_on(dev); + + unlock: +@@ -632,11 +637,12 @@ static int mlx5e_rep_close(struct net_device *dev) + struct mlx5e_priv *priv = netdev_priv(dev); + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch_rep *rep = rpriv->rep; +- struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + int ret; + + mutex_lock(&priv->state_lock); +- (void)mlx5_eswitch_set_vport_state(esw, rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN); ++ mlx5_modify_vport_admin_state(priv->mdev, ++ MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT, ++ rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN); + ret = mlx5e_close_locked(dev); + mutex_unlock(&priv->state_lock); + return ret; +@@ -797,9 +803,9 @@ static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev, + MLX5_CQ_PERIOD_MODE_START_FROM_CQE : + MLX5_CQ_PERIOD_MODE_START_FROM_EQE; + +- params->log_sq_size = MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE; ++ params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE; + params->rq_wq_type = MLX5_WQ_TYPE_LINKED_LIST; +- params->log_rq_size = MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE; ++ params->log_rq_size = MLX5E_REP_PARAMS_LOG_RQ_SIZE; + + params->rx_am_enabled = MLX5_CAP_GEN(mdev, cq_moderation); + mlx5e_set_rx_cq_mode_params(params, cq_period_mode); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 9ba1f72060aa..42bab73a9f40 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -484,7 +484,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe) + tbl = &arp_tbl; + #if IS_ENABLED(CONFIG_IPV6) + else if (m_neigh->family == AF_INET6) +- tbl = ipv6_stub->nd_tbl; ++ tbl = &nd_tbl; + #endif + else + return; +@@ -2091,19 +2091,19 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, + if (err != -EAGAIN) + flow->flags |= MLX5E_TC_FLOW_OFFLOADED; + ++ if (!(flow->flags & MLX5E_TC_FLOW_ESWITCH) || ++ !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)) ++ kvfree(parse_attr); ++ + err = rhashtable_insert_fast(&tc->ht, &flow->node, + tc->ht_params); +- if (err) +- goto err_del_rule; ++ if (err) { ++ mlx5e_tc_del_flow(priv, flow); ++ kfree(flow); ++ } + +- if (flow->flags & MLX5E_TC_FLOW_ESWITCH && +- !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)) +- kvfree(parse_attr); + return err; + +-err_del_rule: +- mlx5e_tc_del_flow(priv, flow); +- + err_free: + kvfree(parse_attr); + kfree(flow); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +index a1296a62497d..71153c0f1605 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +@@ -36,6 +36,9 @@ + #include <linux/mlx5/vport.h> + #include "mlx5_core.h" + ++/* Mutex to hold while enabling or disabling RoCE */ ++static DEFINE_MUTEX(mlx5_roce_en_lock); ++ + static int _mlx5_query_vport_state(struct mlx5_core_dev *mdev, u8 opmod, + u16 vport, u32 *out, int outlen) + { +@@ -998,17 +1001,35 @@ static int mlx5_nic_vport_update_roce_state(struct mlx5_core_dev *mdev, + + int mlx5_nic_vport_enable_roce(struct mlx5_core_dev *mdev) + { +- if (atomic_inc_return(&mdev->roce.roce_en) != 1) +- return 0; +- return mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_ENABLED); ++ int err = 0; ++ ++ mutex_lock(&mlx5_roce_en_lock); ++ if (!mdev->roce.roce_en) ++ err = mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_ENABLED); ++ ++ if (!err) ++ mdev->roce.roce_en++; ++ mutex_unlock(&mlx5_roce_en_lock); ++ ++ return err; + } + EXPORT_SYMBOL_GPL(mlx5_nic_vport_enable_roce); + + int mlx5_nic_vport_disable_roce(struct mlx5_core_dev *mdev) + { +- if (atomic_dec_return(&mdev->roce.roce_en) != 0) +- return 0; +- return mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_DISABLED); ++ int err = 0; ++ ++ mutex_lock(&mlx5_roce_en_lock); ++ if (mdev->roce.roce_en) { ++ mdev->roce.roce_en--; ++ if (mdev->roce.roce_en == 0) ++ err = mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_DISABLED); ++ ++ if (err) ++ mdev->roce.roce_en++; ++ } ++ mutex_unlock(&mlx5_roce_en_lock); ++ return err; + } + EXPORT_SYMBOL_GPL(mlx5_nic_vport_disable_roce); + +diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +index 37364555c42b..f88ff3f4b661 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +@@ -68,10 +68,11 @@ + /* CPP address to retrieve the data from */ + #define NSP_BUFFER 0x10 + #define NSP_BUFFER_CPP GENMASK_ULL(63, 40) +-#define NSP_BUFFER_PCIE GENMASK_ULL(39, 38) +-#define NSP_BUFFER_ADDRESS GENMASK_ULL(37, 0) ++#define NSP_BUFFER_ADDRESS GENMASK_ULL(39, 0) + + #define NSP_DFLT_BUFFER 0x18 ++#define NSP_DFLT_BUFFER_CPP GENMASK_ULL(63, 40) ++#define NSP_DFLT_BUFFER_ADDRESS GENMASK_ULL(39, 0) + + #define NSP_DFLT_BUFFER_CONFIG 0x20 + #define NSP_DFLT_BUFFER_SIZE_MB GENMASK_ULL(7, 0) +@@ -412,8 +413,8 @@ static int nfp_nsp_command_buf(struct nfp_nsp *nsp, u16 code, u32 option, + if (err < 0) + return err; + +- cpp_id = FIELD_GET(NSP_BUFFER_CPP, reg) << 8; +- cpp_buf = FIELD_GET(NSP_BUFFER_ADDRESS, reg); ++ cpp_id = FIELD_GET(NSP_DFLT_BUFFER_CPP, reg) << 8; ++ cpp_buf = FIELD_GET(NSP_DFLT_BUFFER_ADDRESS, reg); + + if (in_buf && in_size) { + err = nfp_cpp_write(cpp, cpp_id, cpp_buf, in_buf, in_size); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 619a1b7281a0..db553d4e8d22 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8466,12 +8466,12 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_out_msi_5; + } + ++ pci_set_drvdata(pdev, dev); ++ + rc = register_netdev(dev); + if (rc < 0) + goto err_out_cnt_6; + +- pci_set_drvdata(pdev, dev); +- + netif_info(tp, probe, dev, "%s at 0x%p, %pM, XID %08x IRQ %d\n", + rtl_chip_infos[chipset].name, ioaddr, dev->dev_addr, + (u32)(RTL_R32(TxConfig) & 0x9cf0f8ff), pdev->irq); +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 6dde9a0cfe76..9b70a3af678e 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -464,7 +464,6 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.mtu = dst_mtu(&rt->dst); + if (!po->chan.mtu) + po->chan.mtu = PPP_MRU; +- ip_rt_put(rt); + po->chan.mtu -= PPTP_HEADER_OVERHEAD; + + po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 23cd41c82210..2a366554c503 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1197,11 +1197,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_dev_open; + } + +- netif_addr_lock_bh(dev); +- dev_uc_sync_multiple(port_dev, dev); +- dev_mc_sync_multiple(port_dev, dev); +- netif_addr_unlock_bh(dev); +- + err = vlan_vids_add_by_dev(port_dev, dev); + if (err) { + netdev_err(dev, "Failed to add vlan ids to device %s\n", +@@ -1241,6 +1236,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_option_port_add; + } + ++ netif_addr_lock_bh(dev); ++ dev_uc_sync_multiple(port_dev, dev); ++ dev_mc_sync_multiple(port_dev, dev); ++ netif_addr_unlock_bh(dev); ++ + port->index = -1; + list_add_tail_rcu(&port->list, &team->port_list); + team_port_enable(team, port); +@@ -1265,8 +1265,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + vlan_vids_del_by_dev(port_dev, dev); + + err_vids_add: +- dev_uc_unsync(port_dev, dev); +- dev_mc_unsync(port_dev, dev); + dev_close(port_dev); + + err_dev_open: +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index a8dd1c7a08cb..89d82c4ee8df 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2863,8 +2863,7 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + if (ret < 0) { + netdev_warn(dev->net, + "lan78xx_setup_irq_domain() failed : %d", ret); +- kfree(pdata); +- return ret; ++ goto out1; + } + + dev->net->hard_header_len += TX_OVERHEAD; +@@ -2872,14 +2871,32 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + + /* Init all registers */ + ret = lan78xx_reset(dev); ++ if (ret) { ++ netdev_warn(dev->net, "Registers INIT FAILED...."); ++ goto out2; ++ } + + ret = lan78xx_mdio_init(dev); ++ if (ret) { ++ netdev_warn(dev->net, "MDIO INIT FAILED....."); ++ goto out2; ++ } + + dev->net->flags |= IFF_MULTICAST; + + pdata->wol = WAKE_MAGIC; + + return ret; ++ ++out2: ++ lan78xx_remove_irq_domain(dev); ++ ++out1: ++ netdev_warn(dev->net, "Bind routine FAILED"); ++ cancel_work_sync(&pdata->set_multicast); ++ cancel_work_sync(&pdata->set_vlan); ++ kfree(pdata); ++ return ret; + } + + static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf) +@@ -2891,6 +2908,8 @@ static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf) + lan78xx_remove_mdio(dev); + + if (pdata) { ++ cancel_work_sync(&pdata->set_multicast); ++ cancel_work_sync(&pdata->set_vlan); + netif_dbg(dev, ifdown, dev->net, "free pdata"); + kfree(pdata); + pdata = NULL; +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 67ecf2425b88..5c6a8ef54aec 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -579,12 +579,13 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + if (!IS_ERR(neigh)) { + sock_confirm_neigh(skb, neigh); + ret = neigh_output(neigh, skb); ++ rcu_read_unlock_bh(); ++ return ret; + } + + rcu_read_unlock_bh(); + err: +- if (unlikely(ret < 0)) +- vrf_tx_error(skb->dev, skb); ++ vrf_tx_error(skb->dev, skb); + return ret; + } + +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +index ecc96312a370..6fe0c6abe0d6 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +@@ -142,15 +142,25 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, + if (!rt2x00dev->ops->hw->set_rts_threshold && + (tx_info->control.rates[0].flags & (IEEE80211_TX_RC_USE_RTS_CTS | + IEEE80211_TX_RC_USE_CTS_PROTECT))) { +- if (rt2x00queue_available(queue) <= 1) +- goto exit_fail; ++ if (rt2x00queue_available(queue) <= 1) { ++ /* ++ * Recheck for full queue under lock to avoid race ++ * conditions with rt2x00lib_txdone(). ++ */ ++ spin_lock(&queue->tx_lock); ++ if (rt2x00queue_threshold(queue)) ++ rt2x00queue_pause_queue(queue); ++ spin_unlock(&queue->tx_lock); ++ ++ goto exit_free_skb; ++ } + + if (rt2x00mac_tx_rts_cts(rt2x00dev, queue, skb)) +- goto exit_fail; ++ goto exit_free_skb; + } + + if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false))) +- goto exit_fail; ++ goto exit_free_skb; + + /* + * Pausing queue has to be serialized with rt2x00lib_txdone(). Note +@@ -164,10 +174,6 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, + + return; + +- exit_fail: +- spin_lock(&queue->tx_lock); +- rt2x00queue_pause_queue(queue); +- spin_unlock(&queue->tx_lock); + exit_free_skb: + ieee80211_free_txskb(hw, skb); + } +diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c +index 6d02c660b4ab..037defd10b91 100644 +--- a/drivers/net/wireless/ti/wl1251/main.c ++++ b/drivers/net/wireless/ti/wl1251/main.c +@@ -1200,8 +1200,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw, + WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS); + + enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc; +- wl1251_acx_arp_ip_filter(wl, enable, addr); +- ++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr); + if (ret < 0) + goto out_sleep; + } +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 7b75d9de55ab..c0080f6ab2f5 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -204,6 +204,10 @@ struct fcloop_lport { + struct completion unreg_done; + }; + ++struct fcloop_lport_priv { ++ struct fcloop_lport *lport; ++}; ++ + struct fcloop_rport { + struct nvme_fc_remote_port *remoteport; + struct nvmet_fc_target_port *targetport; +@@ -370,6 +374,7 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) + + spin_lock(&tfcp_req->reqlock); + fcpreq = tfcp_req->fcpreq; ++ tfcp_req->fcpreq = NULL; + spin_unlock(&tfcp_req->reqlock); + + if (tport->remoteport && fcpreq) { +@@ -611,11 +616,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + + if (!tfcp_req) + /* abort has already been called */ +- return; +- +- if (rport->targetport) +- nvmet_fc_rcv_fcp_abort(rport->targetport, +- &tfcp_req->tgt_fcp_req); ++ goto finish; + + /* break initiator/target relationship for io */ + spin_lock(&tfcp_req->reqlock); +@@ -623,6 +624,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + tfcp_req->fcpreq = NULL; + spin_unlock(&tfcp_req->reqlock); + ++ if (rport->targetport) ++ nvmet_fc_rcv_fcp_abort(rport->targetport, ++ &tfcp_req->tgt_fcp_req); ++ ++finish: + /* post the aborted io completion */ + fcpreq->status = -ECANCELED; + schedule_work(&inireq->iniwork); +@@ -657,7 +663,8 @@ fcloop_nport_get(struct fcloop_nport *nport) + static void + fcloop_localport_delete(struct nvme_fc_local_port *localport) + { +- struct fcloop_lport *lport = localport->private; ++ struct fcloop_lport_priv *lport_priv = localport->private; ++ struct fcloop_lport *lport = lport_priv->lport; + + /* release any threads waiting for the unreg to complete */ + complete(&lport->unreg_done); +@@ -697,7 +704,7 @@ static struct nvme_fc_port_template fctemplate = { + .max_dif_sgl_segments = FCLOOP_SGL_SEGS, + .dma_boundary = FCLOOP_DMABOUND_4G, + /* sizes of additional private data for data structures */ +- .local_priv_sz = sizeof(struct fcloop_lport), ++ .local_priv_sz = sizeof(struct fcloop_lport_priv), + .remote_priv_sz = sizeof(struct fcloop_rport), + .lsrqst_priv_sz = sizeof(struct fcloop_lsreq), + .fcprqst_priv_sz = sizeof(struct fcloop_ini_fcpreq), +@@ -728,11 +735,17 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr, + struct fcloop_ctrl_options *opts; + struct nvme_fc_local_port *localport; + struct fcloop_lport *lport; +- int ret; ++ struct fcloop_lport_priv *lport_priv; ++ unsigned long flags; ++ int ret = -ENOMEM; ++ ++ lport = kzalloc(sizeof(*lport), GFP_KERNEL); ++ if (!lport) ++ return -ENOMEM; + + opts = kzalloc(sizeof(*opts), GFP_KERNEL); + if (!opts) +- return -ENOMEM; ++ goto out_free_lport; + + ret = fcloop_parse_options(opts, buf); + if (ret) +@@ -752,23 +765,25 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr, + + ret = nvme_fc_register_localport(&pinfo, &fctemplate, NULL, &localport); + if (!ret) { +- unsigned long flags; +- + /* success */ +- lport = localport->private; ++ lport_priv = localport->private; ++ lport_priv->lport = lport; ++ + lport->localport = localport; + INIT_LIST_HEAD(&lport->lport_list); + + spin_lock_irqsave(&fcloop_lock, flags); + list_add_tail(&lport->lport_list, &fcloop_lports); + spin_unlock_irqrestore(&fcloop_lock, flags); +- +- /* mark all of the input buffer consumed */ +- ret = count; + } + + out_free_opts: + kfree(opts); ++out_free_lport: ++ /* free only if we're going to fail */ ++ if (ret) ++ kfree(lport); ++ + return ret ? ret : count; + } + +@@ -790,6 +805,8 @@ __wait_localport_unreg(struct fcloop_lport *lport) + + wait_for_completion(&lport->unreg_done); + ++ kfree(lport); ++ + return ret; + } + +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 0f3a02495aeb..beeb7cbb5015 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -46,6 +46,9 @@ + #define BYT_TRIG_POS BIT(25) + #define BYT_TRIG_LVL BIT(24) + #define BYT_DEBOUNCE_EN BIT(20) ++#define BYT_GLITCH_FILTER_EN BIT(19) ++#define BYT_GLITCH_F_SLOW_CLK BIT(17) ++#define BYT_GLITCH_F_FAST_CLK BIT(16) + #define BYT_PULL_STR_SHIFT 9 + #define BYT_PULL_STR_MASK (3 << BYT_PULL_STR_SHIFT) + #define BYT_PULL_STR_2K (0 << BYT_PULL_STR_SHIFT) +@@ -1579,6 +1582,9 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + */ + value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG | + BYT_TRIG_LVL); ++ /* Enable glitch filtering */ ++ value |= BYT_GLITCH_FILTER_EN | BYT_GLITCH_F_SLOW_CLK | ++ BYT_GLITCH_F_FAST_CLK; + + writel(value, reg); + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index d51ebd1da65e..9dc7590e07cb 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -785,6 +785,14 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + return 0; + } + ++static void axp288_charger_cancel_work(void *data) ++{ ++ struct axp288_chrg_info *info = data; ++ ++ cancel_work_sync(&info->otg.work); ++ cancel_work_sync(&info->cable.work); ++} ++ + static int axp288_charger_probe(struct platform_device *pdev) + { + int ret, i, pirq; +@@ -836,6 +844,11 @@ static int axp288_charger_probe(struct platform_device *pdev) + return ret; + } + ++ /* Cancel our work on cleanup, register this before the notifiers */ ++ ret = devm_add_action(dev, axp288_charger_cancel_work, info); ++ if (ret) ++ return ret; ++ + /* Register for extcon notification */ + INIT_WORK(&info->cable.work, axp288_charger_extcon_evt_worker); + info->cable.nb[0].notifier_call = axp288_charger_handle_cable0_evt; +diff --git a/drivers/rtc/rtc-ac100.c b/drivers/rtc/rtc-ac100.c +index 0e358d4b6738..8ff9dc3fe5bf 100644 +--- a/drivers/rtc/rtc-ac100.c ++++ b/drivers/rtc/rtc-ac100.c +@@ -137,13 +137,15 @@ static unsigned long ac100_clkout_recalc_rate(struct clk_hw *hw, + div = (reg >> AC100_CLKOUT_PRE_DIV_SHIFT) & + ((1 << AC100_CLKOUT_PRE_DIV_WIDTH) - 1); + prate = divider_recalc_rate(hw, prate, div, +- ac100_clkout_prediv, 0); ++ ac100_clkout_prediv, 0, ++ AC100_CLKOUT_PRE_DIV_WIDTH); + } + + div = (reg >> AC100_CLKOUT_DIV_SHIFT) & + (BIT(AC100_CLKOUT_DIV_WIDTH) - 1); + return divider_recalc_rate(hw, prate, div, NULL, +- CLK_DIVIDER_POWER_OF_TWO); ++ CLK_DIVIDER_POWER_OF_TWO, ++ AC100_CLKOUT_DIV_WIDTH); + } + + static long ac100_clkout_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index f8dc1601efd5..bddbe2da5283 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1696,6 +1696,15 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) + */ + switch (session->state) { + case ISCSI_STATE_FAILED: ++ /* ++ * cmds should fail during shutdown, if the session ++ * state is bad, allowing completion to happen ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ reason = FAILURE_SESSION_FAILED; ++ sc->result = DID_NO_CONNECT << 16; ++ break; ++ } + case ISCSI_STATE_IN_RECOVERY: + reason = FAILURE_SESSION_IN_RECOVERY; + sc->result = DID_IMM_RETRY << 16; +@@ -1980,6 +1989,19 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + } + + if (session->state != ISCSI_STATE_LOGGED_IN) { ++ /* ++ * During shutdown, if session is prematurely disconnected, ++ * recovery won't happen and there will be hung cmds. Not ++ * handling cmds would trigger EH, also bad in this case. ++ * Instead, handle cmd, allow completion to happen and let ++ * upper layer to deal with the result. ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ sc->result = DID_NO_CONNECT << 16; ++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n"); ++ rc = BLK_EH_HANDLED; ++ goto done; ++ } + /* + * We are probably in the middle of iscsi recovery so let + * that complete and handle the error. +@@ -2084,7 +2106,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + task->last_timeout = jiffies; + spin_unlock(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? +- "timer reset" : "nh"); ++ "timer reset" : "shutdown or nh"); + return rc; + } + EXPORT_SYMBOL_GPL(iscsi_eh_cmd_timed_out); +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 324d8d8c62de..e2ea389fbec3 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -293,6 +293,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp) + phy->phy->minimum_linkrate = dr->pmin_linkrate; + phy->phy->maximum_linkrate = dr->pmax_linkrate; + phy->phy->negotiated_linkrate = phy->linkrate; ++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED); + + skip: + if (new_phy) +@@ -686,7 +687,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + res = smp_execute_task(dev, req, RPEL_REQ_SIZE, + resp, RPEL_RESP_SIZE); + +- if (!res) ++ if (res) + goto out; + + phy->invalid_dword_count = scsi_to_u32(&resp[12]); +@@ -695,6 +696,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + phy->phy_reset_problem_count = scsi_to_u32(&resp[24]); + + out: ++ kfree(req); + kfree(resp); + return res; + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index e518dadc8161..4beb4dd2bee8 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -6605,7 +6605,6 @@ static void megasas_detach_one(struct pci_dev *pdev) + u32 pd_seq_map_sz; + + instance = pci_get_drvdata(pdev); +- instance->unload = 1; + host = instance->host; + fusion = instance->ctrl_context; + +@@ -6616,6 +6615,7 @@ static void megasas_detach_one(struct pci_dev *pdev) + if (instance->fw_crash_state != UNAVAILABLE) + megasas_free_host_crash_buffer(instance); + scsi_remove_host(instance->host); ++ instance->unload = 1; + + if (megasas_wait_for_adapter_operational(instance)) + goto skip_firing_dcmds; +diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c +index ecc699a65bac..08945142b9f8 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -168,7 +168,7 @@ static struct MR_LD_SPAN *MR_LdSpanPtrGet(u32 ld, u32 span, + /* + * This function will Populate Driver Map using firmware raid map + */ +-void MR_PopulateDrvRaidMap(struct megasas_instance *instance) ++static int MR_PopulateDrvRaidMap(struct megasas_instance *instance) + { + struct fusion_context *fusion = instance->ctrl_context; + struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL; +@@ -259,7 +259,7 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + ld_count = (u16)le16_to_cpu(fw_map_ext->ldCount); + if (ld_count > MAX_LOGICAL_DRIVES_EXT) { + dev_dbg(&instance->pdev->dev, "megaraid_sas: LD count exposed in RAID map in not valid\n"); +- return; ++ return 1; + } + + pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); +@@ -285,6 +285,12 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + fusion->ld_map[(instance->map_id & 1)]; + pFwRaidMap = &fw_map_old->raidMap; + ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount); ++ if (ld_count > MAX_LOGICAL_DRIVES) { ++ dev_dbg(&instance->pdev->dev, ++ "LD count exposed in RAID map in not valid\n"); ++ return 1; ++ } ++ + pDrvRaidMap->totalSize = pFwRaidMap->totalSize; + pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); + pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec; +@@ -300,6 +306,8 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + sizeof(struct MR_DEV_HANDLE_INFO) * + MAX_RAIDMAP_PHYSICAL_DEVICES); + } ++ ++ return 0; + } + + /* +@@ -317,8 +325,8 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance) + u16 ld; + u32 expected_size; + +- +- MR_PopulateDrvRaidMap(instance); ++ if (MR_PopulateDrvRaidMap(instance)) ++ return 0; + + fusion = instance->ctrl_context; + drv_map = fusion->ld_drv_map[(instance->map_id & 1)]; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index beb4bf8fe9b0..139219c994e9 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -4106,19 +4106,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + return 0; + } + +- /* +- * Bug work around for firmware SATL handling. The loop +- * is based on atomic operations and ensures consistency +- * since we're lockless at this point +- */ +- do { +- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { +- scmd->result = SAM_STAT_BUSY; +- scmd->scsi_done(scmd); +- return 0; +- } +- } while (_scsih_set_satl_pending(scmd, true)); +- + sas_target_priv_data = sas_device_priv_data->sas_target; + + /* invalid device handle */ +@@ -4144,6 +4131,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + sas_device_priv_data->block) + return SCSI_MLQUEUE_DEVICE_BUSY; + ++ /* ++ * Bug work around for firmware SATL handling. The loop ++ * is based on atomic operations and ensures consistency ++ * since we're lockless at this point ++ */ ++ do { ++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { ++ scmd->result = SAM_STAT_BUSY; ++ scmd->scsi_done(scmd); ++ return 0; ++ } ++ } while (_scsih_set_satl_pending(scmd, true)); ++ + if (scmd->sc_data_direction == DMA_FROM_DEVICE) + mpi_control = MPI2_SCSIIO_CONTROL_READ; + else if (scmd->sc_data_direction == DMA_TO_DEVICE) +@@ -4170,6 +4170,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (!smid) { + pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", + ioc->name, __func__); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); +@@ -4200,6 +4201,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (mpi_request->DataLength) { + if (ioc->build_sg_scmd(ioc, scmd, smid)) { + mpt3sas_base_free_smid(ioc, smid); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + } else +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 092a5fc85b9a..2770fbd4ce49 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -797,11 +797,21 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx, + goto stop_dma; + } + +- /* wait for tx fifo to be emptied / rx fifo to be filled */ ++ /* wait for tx/rx DMA completion */ + ret = sh_msiof_wait_for_completion(p); + if (ret) + goto stop_reset; + ++ if (!rx) { ++ reinit_completion(&p->done); ++ sh_msiof_write(p, IER, IER_TEOFE); ++ ++ /* wait for tx fifo to be emptied */ ++ ret = sh_msiof_wait_for_completion(p); ++ if (ret) ++ goto stop_reset; ++ } ++ + /* clear status bits */ + sh_msiof_reset_str(p); + +diff --git a/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c b/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c +index 2da051c0d251..a4bb93b440a5 100644 +--- a/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c ++++ b/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c +@@ -528,19 +528,20 @@ EXPORT_SYMBOL(cfs_cpt_spread_node); + int + cfs_cpt_current(struct cfs_cpt_table *cptab, int remap) + { +- int cpu = smp_processor_id(); +- int cpt = cptab->ctb_cpu2cpt[cpu]; ++ int cpu; ++ int cpt; + +- if (cpt < 0) { +- if (!remap) +- return cpt; ++ preempt_disable(); ++ cpu = smp_processor_id(); ++ cpt = cptab->ctb_cpu2cpt[cpu]; + ++ if (cpt < 0 && remap) { + /* don't return negative value for safety of upper layer, + * instead we shadow the unknown cpu to a valid partition ID + */ + cpt = cpu % cptab->ctb_nparts; + } +- ++ preempt_enable(); + return cpt; + } + EXPORT_SYMBOL(cfs_cpt_current); +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 942d094269fb..c4a5fb6f038f 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -796,6 +796,13 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd) + int ret; + DEFINE_WAIT(__wait); + ++ /* ++ * Don't leave commands partially setup because the unmap ++ * thread might need the blocks to make forward progress. ++ */ ++ tcmu_cmd_free_data(tcmu_cmd, tcmu_cmd->dbi_cur); ++ tcmu_cmd_reset_dbi_cur(tcmu_cmd); ++ + prepare_to_wait(&udev->wait_cmdr, &__wait, TASK_INTERRUPTIBLE); + + pr_debug("sleeping for ring space\n"); +diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c +index 8ee38f55c7f3..43b90fd577e4 100644 +--- a/drivers/thermal/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c +@@ -319,17 +319,21 @@ static int int3400_thermal_probe(struct platform_device *pdev) + + result = sysfs_create_group(&pdev->dev.kobj, &uuid_attribute_group); + if (result) +- goto free_zone; ++ goto free_rel_misc; + + result = acpi_install_notify_handler( + priv->adev->handle, ACPI_DEVICE_NOTIFY, int3400_notify, + (void *)priv); + if (result) +- goto free_zone; ++ goto free_sysfs; + + return 0; + +-free_zone: ++free_sysfs: ++ sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group); ++free_rel_misc: ++ if (!priv->rel_misc_dev_res) ++ acpi_thermal_rel_misc_device_remove(priv->adev->handle); + thermal_zone_device_unregister(priv->thermal); + free_art_trt: + kfree(priv->trts); +diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c +index b4d3116cfdaf..3055f9a12a17 100644 +--- a/drivers/thermal/power_allocator.c ++++ b/drivers/thermal/power_allocator.c +@@ -523,6 +523,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + struct thermal_instance *instance; + struct power_allocator_params *params = tz->governor_data; + ++ mutex_lock(&tz->lock); + list_for_each_entry(instance, &tz->thermal_instances, tz_node) { + if ((instance->trip != params->trip_max_desired_temperature) || + (!cdev_is_power_actor(instance->cdev))) +@@ -534,6 +535,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + mutex_unlock(&instance->cdev->lock); + thermal_cdev_update(instance->cdev); + } ++ mutex_unlock(&tz->lock); + } + + /** +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 0a3c9665e015..7253e8d2c6d9 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1463,6 +1463,10 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + * in which case an opening port goes back to closed and a closing port + * is simply put into closed state (any further frames from the other + * end will get a DM response) ++ * ++ * Some control dlci can stay in ADM mode with other dlci working just ++ * fine. In that case we can just keep the control dlci open after the ++ * DLCI_OPENING retries time out. + */ + + static void gsm_dlci_t1(unsigned long data) +@@ -1476,8 +1480,15 @@ static void gsm_dlci_t1(unsigned long data) + if (dlci->retries) { + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); +- } else ++ } else if (!dlci->addr && gsm->control == (DM | PF)) { ++ if (debug & 8) ++ pr_info("DLCI %d opening in ADM mode.\n", ++ dlci->addr); ++ gsm_dlci_open(dlci); ++ } else { + gsm_dlci_close(dlci); ++ } ++ + break; + case DLCI_CLOSING: + dlci->retries--; +@@ -1495,8 +1506,8 @@ static void gsm_dlci_t1(unsigned long data) + * @dlci: DLCI to open + * + * Commence opening a DLCI from the Linux side. We issue SABM messages +- * to the modem which should then reply with a UA, at which point we +- * will move into open state. Opening is done asynchronously with retry ++ * to the modem which should then reply with a UA or ADM, at which point ++ * we will move into open state. Opening is done asynchronously with retry + * running off timers and the responses. + */ + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 48d5327d38d4..fe5cdda80b2c 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -124,6 +124,13 @@ hv_uio_probe(struct hv_device *dev, + if (ret) + goto fail; + ++ /* Communicating with host has to be via shared memory not hypercall */ ++ if (!dev->channel->offermsg.monitor_allocated) { ++ dev_err(&dev->device, "vmbus channel requires hypercall\n"); ++ ret = -ENOTSUPP; ++ goto fail_close; ++ } ++ + dev->channel->inbound.ring_buffer->interrupt_mask = 1; + set_channel_read_mode(dev->channel, HV_CALL_DIRECT); + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 082891dffd9d..b0d606b2d06c 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -622,7 +622,7 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk) + + if (!len && vq->busyloop_timeout) { + /* Both tx vq and rx socket were polled here */ +- mutex_lock(&vq->mutex); ++ mutex_lock_nested(&vq->mutex, 1); + vhost_disable_notify(&net->dev, vq); + + preempt_disable(); +@@ -755,7 +755,7 @@ static void handle_rx(struct vhost_net *net) + struct iov_iter fixup; + __virtio16 num_buffers; + +- mutex_lock(&vq->mutex); ++ mutex_lock_nested(&vq->mutex, 0); + sock = vq->private_data; + if (!sock) + goto out; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index a827c1a684a9..c692e0b13242 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -213,8 +213,7 @@ int vhost_poll_start(struct vhost_poll *poll, struct file *file) + if (mask) + vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); + if (mask & POLLERR) { +- if (poll->wqh) +- remove_wait_queue(poll->wqh, &poll->wait); ++ vhost_poll_stop(poll); + ret = -EINVAL; + } + +@@ -1253,14 +1252,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, + /* Caller should have vq mutex and device mutex */ + int vhost_vq_access_ok(struct vhost_virtqueue *vq) + { +- if (vq->iotlb) { +- /* When device IOTLB was used, the access validation +- * will be validated during prefetching. +- */ +- return 1; +- } +- return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) && +- vq_log_access_ok(vq, vq->log_base); ++ int ret = vq_log_access_ok(vq, vq->log_base); ++ ++ if (ret || vq->iotlb) ++ return ret; ++ ++ return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); + } + EXPORT_SYMBOL_GPL(vhost_vq_access_ok); + +diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c +index d7c239ea3d09..f5574060f9c8 100644 +--- a/drivers/video/backlight/corgi_lcd.c ++++ b/drivers/video/backlight/corgi_lcd.c +@@ -177,7 +177,7 @@ static int corgi_ssp_lcdtg_send(struct corgi_lcd *lcd, int adrs, uint8_t data) + struct spi_message msg; + struct spi_transfer xfer = { + .len = 1, +- .cs_change = 1, ++ .cs_change = 0, + .tx_buf = lcd->buf, + }; + +diff --git a/drivers/video/backlight/tdo24m.c b/drivers/video/backlight/tdo24m.c +index eab1f842f9c0..e4bd63e9db6b 100644 +--- a/drivers/video/backlight/tdo24m.c ++++ b/drivers/video/backlight/tdo24m.c +@@ -369,7 +369,7 @@ static int tdo24m_probe(struct spi_device *spi) + + spi_message_init(m); + +- x->cs_change = 1; ++ x->cs_change = 0; + x->tx_buf = &lcd->buf[0]; + spi_message_add_tail(x, m); + +diff --git a/drivers/video/backlight/tosa_lcd.c b/drivers/video/backlight/tosa_lcd.c +index 6a41ea92737a..4dc5ee8debeb 100644 +--- a/drivers/video/backlight/tosa_lcd.c ++++ b/drivers/video/backlight/tosa_lcd.c +@@ -49,7 +49,7 @@ static int tosa_tg_send(struct spi_device *spi, int adrs, uint8_t data) + struct spi_message msg; + struct spi_transfer xfer = { + .len = 1, +- .cs_change = 1, ++ .cs_change = 0, + .tx_buf = buf, + }; + +diff --git a/drivers/video/fbdev/vfb.c b/drivers/video/fbdev/vfb.c +index da653a080394..54127905bfe7 100644 +--- a/drivers/video/fbdev/vfb.c ++++ b/drivers/video/fbdev/vfb.c +@@ -239,8 +239,23 @@ static int vfb_check_var(struct fb_var_screeninfo *var, + */ + static int vfb_set_par(struct fb_info *info) + { ++ switch (info->var.bits_per_pixel) { ++ case 1: ++ info->fix.visual = FB_VISUAL_MONO01; ++ break; ++ case 8: ++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR; ++ break; ++ case 16: ++ case 24: ++ case 32: ++ info->fix.visual = FB_VISUAL_TRUECOLOR; ++ break; ++ } ++ + info->fix.line_length = get_line_length(info->var.xres_virtual, + info->var.bits_per_pixel); ++ + return 0; + } + +@@ -450,6 +465,8 @@ static int vfb_probe(struct platform_device *dev) + goto err2; + platform_set_drvdata(dev, info); + ++ vfb_set_par(info); ++ + fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n", + videomemorysize >> 10); + return 0; +diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c +index 36be987ff9ef..c2f4ff516230 100644 +--- a/drivers/watchdog/dw_wdt.c ++++ b/drivers/watchdog/dw_wdt.c +@@ -127,14 +127,27 @@ static int dw_wdt_start(struct watchdog_device *wdd) + + dw_wdt_set_timeout(wdd, wdd->timeout); + +- set_bit(WDOG_HW_RUNNING, &wdd->status); +- + writel(WDOG_CONTROL_REG_WDT_EN_MASK, + dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); + + return 0; + } + ++static int dw_wdt_stop(struct watchdog_device *wdd) ++{ ++ struct dw_wdt *dw_wdt = to_dw_wdt(wdd); ++ ++ if (!dw_wdt->rst) { ++ set_bit(WDOG_HW_RUNNING, &wdd->status); ++ return 0; ++ } ++ ++ reset_control_assert(dw_wdt->rst); ++ reset_control_deassert(dw_wdt->rst); ++ ++ return 0; ++} ++ + static int dw_wdt_restart(struct watchdog_device *wdd, + unsigned long action, void *data) + { +@@ -173,6 +186,7 @@ static const struct watchdog_info dw_wdt_ident = { + static const struct watchdog_ops dw_wdt_ops = { + .owner = THIS_MODULE, + .start = dw_wdt_start, ++ .stop = dw_wdt_stop, + .ping = dw_wdt_ping, + .set_timeout = dw_wdt_set_timeout, + .get_timeleft = dw_wdt_get_timeleft, +diff --git a/fs/dcache.c b/fs/dcache.c +index a1417787e269..c28b9c91b5cb 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -468,9 +468,11 @@ static void dentry_lru_add(struct dentry *dentry) + * d_drop() is used mainly for stuff that wants to invalidate a dentry for some + * reason (NFS timeouts or autofs deletes). + * +- * __d_drop requires dentry->d_lock. ++ * __d_drop requires dentry->d_lock ++ * ___d_drop doesn't mark dentry as "unhashed" ++ * (dentry->d_hash.pprev will be LIST_POISON2, not NULL). + */ +-void __d_drop(struct dentry *dentry) ++static void ___d_drop(struct dentry *dentry) + { + if (!d_unhashed(dentry)) { + struct hlist_bl_head *b; +@@ -486,12 +488,17 @@ void __d_drop(struct dentry *dentry) + + hlist_bl_lock(b); + __hlist_bl_del(&dentry->d_hash); +- dentry->d_hash.pprev = NULL; + hlist_bl_unlock(b); + /* After this call, in-progress rcu-walk path lookup will fail. */ + write_seqcount_invalidate(&dentry->d_seq); + } + } ++ ++void __d_drop(struct dentry *dentry) ++{ ++ ___d_drop(dentry); ++ dentry->d_hash.pprev = NULL; ++} + EXPORT_SYMBOL(__d_drop); + + void d_drop(struct dentry *dentry) +@@ -2386,7 +2393,7 @@ EXPORT_SYMBOL(d_delete); + static void __d_rehash(struct dentry *entry) + { + struct hlist_bl_head *b = d_hash(entry->d_name.hash); +- BUG_ON(!d_unhashed(entry)); ++ + hlist_bl_lock(b); + hlist_bl_add_head_rcu(&entry->d_hash, b); + hlist_bl_unlock(b); +@@ -2821,9 +2828,9 @@ static void __d_move(struct dentry *dentry, struct dentry *target, + write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED); + + /* unhash both */ +- /* __d_drop does write_seqcount_barrier, but they're OK to nest. */ +- __d_drop(dentry); +- __d_drop(target); ++ /* ___d_drop does write_seqcount_barrier, but they're OK to nest. */ ++ ___d_drop(dentry); ++ ___d_drop(target); + + /* Switch the names.. */ + if (exchange) +@@ -2835,6 +2842,8 @@ static void __d_move(struct dentry *dentry, struct dentry *target, + __d_rehash(dentry); + if (exchange) + __d_rehash(target); ++ else ++ target->d_hash.pprev = NULL; + + /* ... and switch them in the tree */ + if (IS_ROOT(dentry)) { +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 5100ec1b5d55..86eb33f67618 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -412,7 +412,7 @@ extern const struct clk_ops clk_divider_ro_ops; + + unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, + unsigned int val, const struct clk_div_table *table, +- unsigned long flags); ++ unsigned long flags, unsigned long width); + long divider_round_rate_parent(struct clk_hw *hw, struct clk_hw *parent, + unsigned long rate, unsigned long *prate, + const struct clk_div_table *table, +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index bfb4a9d962a5..f2f9e957bf1b 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -794,7 +794,7 @@ struct mlx5_core_dev { + struct mlx5e_resources mlx5e_res; + struct { + struct mlx5_rsvd_gids reserved_gids; +- atomic_t roce_en; ++ u32 roce_en; + } roce; + #ifdef CONFIG_MLX5_FPGA + struct mlx5_fpga_device *fpga; +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index f7e83f6d2e64..236452ebbd9e 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -29,6 +29,7 @@ + #include <linux/net_tstamp.h> + #include <linux/etherdevice.h> + #include <linux/ethtool.h> ++#include <linux/phy.h> + #include <net/arp.h> + #include <net/switchdev.h> + +@@ -665,8 +666,11 @@ static int vlan_ethtool_get_ts_info(struct net_device *dev, + { + const struct vlan_dev_priv *vlan = vlan_dev_priv(dev); + const struct ethtool_ops *ops = vlan->real_dev->ethtool_ops; ++ struct phy_device *phydev = vlan->real_dev->phydev; + +- if (ops->get_ts_info) { ++ if (phydev && phydev->drv && phydev->drv->ts_info) { ++ return phydev->drv->ts_info(phydev, info); ++ } else if (ops->get_ts_info) { + return ops->get_ts_info(vlan->real_dev, info); + } else { + info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE | +diff --git a/net/core/dev.c b/net/core/dev.c +index 387af3415385..4be2a4047640 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1025,7 +1025,7 @@ bool dev_valid_name(const char *name) + { + if (*name == '\0') + return false; +- if (strlen(name) >= IFNAMSIZ) ++ if (strnlen(name, IFNAMSIZ) == IFNAMSIZ) + return false; + if (!strcmp(name, ".") || !strcmp(name, "..")) + return false; +@@ -2696,7 +2696,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth) + if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) + return 0; + +- eth = (struct ethhdr *)skb_mac_header(skb); ++ eth = (struct ethhdr *)skb->data; + type = eth->h_proto; + } + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index a1d1f50e0e19..7d9cf26f4bb1 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev) + /*unsigned long now; */ + struct net *net = dev_net(dev); + +- rt = ip_route_output(net, sip, tip, 0, 0); ++ rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev)); + if (IS_ERR(rt)) + return 1; + if (rt->dst.dev != dev) { +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 1ee6c0d8dde4..f39955913d3f 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1755,18 +1755,20 @@ void fib_select_multipath(struct fib_result *res, int hash) + bool first = false; + + for_nexthops(fi) { ++ if (net->ipv4.sysctl_fib_multipath_use_neigh) { ++ if (!fib_good_nh(nh)) ++ continue; ++ if (!first) { ++ res->nh_sel = nhsel; ++ first = true; ++ } ++ } ++ + if (hash > atomic_read(&nh->nh_upper_bound)) + continue; + +- if (!net->ipv4.sysctl_fib_multipath_use_neigh || +- fib_good_nh(nh)) { +- res->nh_sel = nhsel; +- return; +- } +- if (!first) { +- res->nh_sel = nhsel; +- first = true; +- } ++ res->nh_sel = nhsel; ++ return; + } endfor_nexthops(fi); + } + #endif +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 4e90082b23a6..13f7bbc0168d 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_create(struct net *net, + struct net_device *dev; + char name[IFNAMSIZ]; + +- if (parms->name[0]) ++ err = -E2BIG; ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else { +- if (strlen(ops->kind) > (IFNAMSIZ - 3)) { +- err = -E2BIG; ++ } else { ++ if (strlen(ops->kind) > (IFNAMSIZ - 3)) + goto failed; +- } + strlcpy(name, ops->kind, IFNAMSIZ); + strncat(name, "%d", 2); + } +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e8ab306794d8..4228f3b2f347 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -319,11 +319,13 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net, + if (t || !create) + return t; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ return NULL; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "ip6gre%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6gre_tunnel_setup); + if (!dev) +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 3763dc01e374..ffbb81609016 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + return ret; + } + ++#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) ++ /* Policy lookup after SNAT yielded a new policy */ ++ if (skb_dst(skb)->xfrm) { ++ IPCB(skb)->flags |= IPSKB_REROUTED; ++ return dst_output(net, sk, skb); ++ } ++#endif ++ + if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || + dst_allfrag(skb_dst(skb)) || + (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size)) +@@ -367,6 +375,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb) + static inline int ip6_forward_finish(struct net *net, struct sock *sk, + struct sk_buff *skb) + { ++ struct dst_entry *dst = skb_dst(skb); ++ ++ __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); ++ __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); ++ + return dst_output(net, sk, skb); + } + +@@ -560,8 +573,6 @@ int ip6_forward(struct sk_buff *skb) + + hdr->hop_limit--; + +- __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); +- __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); + return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, + net, NULL, skb, skb->dev, dst->dev, + ip6_forward_finish); +@@ -1237,7 +1248,7 @@ static int __ip6_append_data(struct sock *sk, + const struct sockcm_cookie *sockc) + { + struct sk_buff *skb, *skb_prev = NULL; +- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu; ++ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu; + int exthdrlen = 0; + int dst_exthdrlen = 0; + int hh_len; +@@ -1273,6 +1284,12 @@ static int __ip6_append_data(struct sock *sk, + sizeof(struct frag_hdr) : 0) + + rt->rt6i_nfheader_len; + ++ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit ++ * the first fragment ++ */ ++ if (headersize + transhdrlen > mtu) ++ goto emsgsize; ++ + if (cork->length + length > mtu - headersize && ipc6->dontfrag && + (sk->sk_protocol == IPPROTO_UDP || + sk->sk_protocol == IPPROTO_RAW)) { +@@ -1288,9 +1305,8 @@ static int __ip6_append_data(struct sock *sk, + + if (cork->length + length > maxnonfragsize - headersize) { + emsgsize: +- ipv6_local_error(sk, EMSGSIZE, fl6, +- mtu - headersize + +- sizeof(struct ipv6hdr)); ++ pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0); ++ ipv6_local_error(sk, EMSGSIZE, fl6, pmtu); + return -EMSGSIZE; + } + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 1161fd5630c1..7e11f6a811f5 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -297,13 +297,16 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p) + struct net_device *dev; + struct ip6_tnl *t; + char name[IFNAMSIZ]; +- int err = -ENOMEM; ++ int err = -E2BIG; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6tnl%%d"); +- ++ } ++ err = -ENOMEM; + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6_tnl_dev_setup); + if (!dev) +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index bcdc2d557de1..7c0f647b5195 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -212,10 +212,13 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p + char name[IFNAMSIZ]; + int err; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6_vti%%d"); ++ } + + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, vti6_dev_setup); + if (!dev) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index a4a865c8a23c..0126d9bfa670 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -871,6 +871,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net, + struct fib6_node *fn; + struct rt6_info *rt; + ++ if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) ++ flags &= ~RT6_LOOKUP_F_IFACE; ++ + read_lock_bh(&table->tb6_lock); + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); + restart: +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index 7a78dcfda68a..f343e6f0fc95 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -16,6 +16,7 @@ + #include <linux/net.h> + #include <linux/module.h> + #include <net/ip.h> ++#include <net/ip_tunnels.h> + #include <net/lwtunnel.h> + #include <net/netevent.h> + #include <net/netns/generic.h> +@@ -211,11 +212,6 @@ static int seg6_do_srh(struct sk_buff *skb) + + tinfo = seg6_encap_lwtunnel(dst->lwtstate); + +- if (likely(!skb->encapsulation)) { +- skb_reset_inner_headers(skb); +- skb->encapsulation = 1; +- } +- + switch (tinfo->mode) { + case SEG6_IPTUN_MODE_INLINE: + if (skb->protocol != htons(ETH_P_IPV6)) +@@ -224,10 +220,12 @@ static int seg6_do_srh(struct sk_buff *skb) + err = seg6_do_srh_inline(skb, tinfo->srh); + if (err) + return err; +- +- skb_reset_inner_headers(skb); + break; + case SEG6_IPTUN_MODE_ENCAP: ++ err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6); ++ if (err) ++ return err; ++ + if (skb->protocol == htons(ETH_P_IPV6)) + proto = IPPROTO_IPV6; + else if (skb->protocol == htons(ETH_P_IP)) +@@ -239,6 +237,8 @@ static int seg6_do_srh(struct sk_buff *skb) + if (err) + return err; + ++ skb_set_inner_transport_header(skb, skb_transport_offset(skb)); ++ skb_set_inner_protocol(skb, skb->protocol); + skb->protocol = htons(ETH_P_IPV6); + break; + case SEG6_IPTUN_MODE_L2ENCAP: +@@ -262,8 +262,6 @@ static int seg6_do_srh(struct sk_buff *skb) + ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + +- skb_set_inner_protocol(skb, skb->protocol); +- + return 0; + } + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index cac815cc8600..f03c1a562135 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -244,11 +244,13 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net, + if (!create) + goto failed; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "sit%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ipip6_tunnel_setup); + if (!dev) +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index c28223d8092b..fca69c3771f5 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -765,6 +765,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || ++ (session->offset && ++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 84f757c5d91a..288640471c2f 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2373,10 +2373,17 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy, + struct ieee80211_sub_if_data *sdata; + enum nl80211_tx_power_setting txp_type = type; + bool update_txp_type = false; ++ bool has_monitor = false; + + if (wdev) { + sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); + ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) { ++ sdata = rtnl_dereference(local->monitor_sdata); ++ if (!sdata) ++ return -EOPNOTSUPP; ++ } ++ + switch (type) { + case NL80211_TX_POWER_AUTOMATIC: + sdata->user_power_level = IEEE80211_UNSET_POWER_LEVEL; +@@ -2415,15 +2422,34 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy, + + mutex_lock(&local->iflist_mtx); + list_for_each_entry(sdata, &local->interfaces, list) { ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) { ++ has_monitor = true; ++ continue; ++ } + sdata->user_power_level = local->user_power_level; + if (txp_type != sdata->vif.bss_conf.txpower_type) + update_txp_type = true; + sdata->vif.bss_conf.txpower_type = txp_type; + } +- list_for_each_entry(sdata, &local->interfaces, list) ++ list_for_each_entry(sdata, &local->interfaces, list) { ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) ++ continue; + ieee80211_recalc_txpower(sdata, update_txp_type); ++ } + mutex_unlock(&local->iflist_mtx); + ++ if (has_monitor) { ++ sdata = rtnl_dereference(local->monitor_sdata); ++ if (sdata) { ++ sdata->user_power_level = local->user_power_level; ++ if (txp_type != sdata->vif.bss_conf.txpower_type) ++ update_txp_type = true; ++ sdata->vif.bss_conf.txpower_type = txp_type; ++ ++ ieee80211_recalc_txpower(sdata, update_txp_type); ++ } ++ } ++ + return 0; + } + +diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h +index c7f93fd9ca7a..4d82fe7d627c 100644 +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -165,7 +165,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local, + if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE || + sdata->vif.type == NL80211_IFTYPE_NAN || + (sdata->vif.type == NL80211_IFTYPE_MONITOR && +- !sdata->vif.mu_mimo_owner))) ++ !sdata->vif.mu_mimo_owner && ++ !(changed & BSS_CHANGED_TXPOWER)))) + return; + + if (!check_sdata_in_driver(sdata)) +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 9219bc134109..1b86eccf94b6 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1053,6 +1053,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + if (addr->sa_family != AF_NETLINK) + return -EINVAL; + ++ if (alen < sizeof(struct sockaddr_nl)) ++ return -EINVAL; ++ + if ((nladdr->nl_groups || nladdr->nl_pid) && + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + return -EPERM; +diff --git a/net/rds/bind.c b/net/rds/bind.c +index 75d43dc8e96b..5aa3a64aa4f0 100644 +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -114,6 +114,7 @@ static int rds_add_bound(struct rds_sock *rs, __be32 addr, __be16 *port) + rs, &addr, (int)ntohs(*port)); + break; + } else { ++ rs->rs_bound_addr = 0; + rds_sock_put(rs); + ret = -ENOMEM; + break; +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index 8f2c63514956..4444d7e755e6 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -133,8 +133,10 @@ static int tcf_dump_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, + continue; + + nest = nla_nest_start(skb, n_i); +- if (!nest) ++ if (!nest) { ++ index--; + goto nla_put_failure; ++ } + err = tcf_action_dump_1(skb, p, 0, 0); + if (err < 0) { + index--; +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index c0c707eb2c96..2b087623fb1d 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -248,10 +248,14 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg) + + static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg) + { +- if (cfg->is_ebpf) +- bpf_prog_put(cfg->filter); +- else +- bpf_prog_destroy(cfg->filter); ++ struct bpf_prog *filter = cfg->filter; ++ ++ if (filter) { ++ if (cfg->is_ebpf) ++ bpf_prog_put(filter); ++ else ++ bpf_prog_destroy(filter); ++ } + + kfree(cfg->bpf_ops); + kfree(cfg->bpf_name); +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index b642ad3d39dd..6d10b3af479b 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -190,7 +190,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a, int bind) + struct tcf_skbmod_params *p; + + p = rcu_dereference_protected(d->skbmod_p, 1); +- kfree_rcu(p, rcu); ++ if (p) ++ kfree_rcu(p, rcu); + } + + static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a, +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 22bf1a376b91..7cb63616805d 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -208,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a, int bind) + struct tcf_tunnel_key_params *params; + + params = rcu_dereference_protected(t->params, 1); ++ if (params) { ++ if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) ++ dst_release(¶ms->tcft_enc_metadata->dst); + +- if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) +- dst_release(¶ms->tcft_enc_metadata->dst); +- +- kfree_rcu(params, rcu); ++ kfree_rcu(params, rcu); ++ } + } + + static int tunnel_key_dump_addresses(struct sk_buff *skb, +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index f27a9718554c..08b5705e7381 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -728,8 +728,10 @@ static int sctp_v6_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr) + sctp_v6_map_v4(addr); + } + +- if (addr->sa.sa_family == AF_INET) ++ if (addr->sa.sa_family == AF_INET) { ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + return sizeof(struct sockaddr_in); ++ } + return sizeof(struct sockaddr_in6); + } + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 6b3a862706de..2d6f612f32c3 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -337,11 +337,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, + if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + +- /* V4 mapped address are really of AF_INET family */ +- if (addr->sa.sa_family == AF_INET6 && +- ipv6_addr_v4mapped(&addr->v6.sin6_addr) && +- !opt->pf->af_supported(AF_INET, opt)) +- return NULL; ++ if (addr->sa.sa_family == AF_INET6) { ++ if (len < SIN6_LEN_RFC2133) ++ return NULL; ++ /* V4 mapped address are really of AF_INET family */ ++ if (ipv6_addr_v4mapped(&addr->v6.sin6_addr) && ++ !opt->pf->af_supported(AF_INET, opt)) ++ return NULL; ++ } + + /* If we get this far, af is valid. */ + af = sctp_get_af_specific(addr->sa.sa_family); +diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c +index c5fda15ba319..4a3a3f1331ee 100644 +--- a/net/strparser/strparser.c ++++ b/net/strparser/strparser.c +@@ -60,7 +60,7 @@ static void strp_abort_strp(struct strparser *strp, int err) + struct sock *sk = strp->sk; + + /* Report an error on the lower socket */ +- sk->sk_err = err; ++ sk->sk_err = -err; + sk->sk_error_report(sk); + } + } +@@ -458,7 +458,7 @@ static void strp_msg_timeout(struct work_struct *w) + /* Message assembly timed out */ + STRP_STATS_INCR(strp->stats.msg_timeouts); + strp->cb.lock(strp); +- strp->cb.abort_parser(strp, ETIMEDOUT); ++ strp->cb.abort_parser(strp, -ETIMEDOUT); + strp->cb.unlock(strp); + } + +diff --git a/sound/soc/intel/atom/sst/sst_stream.c b/sound/soc/intel/atom/sst/sst_stream.c +index 83d8dda15233..4eeb9afdc89f 100644 +--- a/sound/soc/intel/atom/sst/sst_stream.c ++++ b/sound/soc/intel/atom/sst/sst_stream.c +@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct intel_sst_drv *sst_drv_ctx, + sst_free_block(sst_drv_ctx, block); + out: + test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id); +- return 0; ++ return ret; + } + + /* +diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c +index 5bcde01d15e6..fbfb76ee2346 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -133,6 +133,7 @@ static const struct snd_soc_dapm_widget cht_dapm_widgets[] = { + SND_SOC_DAPM_HP("Headphone", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_MIC("Int Mic", NULL), ++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL), + SND_SOC_DAPM_SPK("Ext Spk", NULL), + SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, + platform_clock_control, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), +@@ -143,6 +144,8 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"IN1N", NULL, "Headset Mic"}, + {"DMIC L1", NULL, "Int Mic"}, + {"DMIC R1", NULL, "Int Mic"}, ++ {"IN2P", NULL, "Int Analog Mic"}, ++ {"IN2N", NULL, "Int Analog Mic"}, + {"Headphone", NULL, "HPOL"}, + {"Headphone", NULL, "HPOR"}, + {"Ext Spk", NULL, "SPOL"}, +@@ -150,6 +153,9 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"Headphone", NULL, "Platform Clock"}, + {"Headset Mic", NULL, "Platform Clock"}, + {"Int Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "micbias1"}, ++ {"Int Analog Mic", NULL, "micbias2"}, + {"Ext Spk", NULL, "Platform Clock"}, + }; + +@@ -204,6 +210,7 @@ static const struct snd_kcontrol_new cht_mc_controls[] = { + SOC_DAPM_PIN_SWITCH("Headphone"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Int Mic"), ++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"), + SOC_DAPM_PIN_SWITCH("Ext Spk"), + }; + +diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c +index 89f70133c8e4..b74a6040cd96 100644 +--- a/sound/soc/intel/skylake/skl-messages.c ++++ b/sound/soc/intel/skylake/skl-messages.c +@@ -404,7 +404,11 @@ int skl_resume_dsp(struct skl *skl) + if (skl->skl_sst->is_first_boot == true) + return 0; + ++ /* disable dynamic clock gating during fw and lib download */ ++ ctx->enable_miscbdcge(ctx->dev, false); ++ + ret = skl_dsp_wake(ctx->dsp); ++ ctx->enable_miscbdcge(ctx->dev, true); + if (ret < 0) + return ret; + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 2b1e513b1680..7fe1e8f273a0 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1332,7 +1332,11 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform) + return -EIO; + } + ++ /* disable dynamic clock gating during fw and lib download */ ++ skl->skl_sst->enable_miscbdcge(platform->dev, false); ++ + ret = ops->init_fw(platform->dev, skl->skl_sst); ++ skl->skl_sst->enable_miscbdcge(platform->dev, true); + if (ret < 0) { + dev_err(platform->dev, "Failed to boot first fw: %d\n", ret); + return ret; +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 9d01d0b1084e..c8b8b7101c6f 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -1385,6 +1385,17 @@ static int update_insn_state(struct instruction *insn, struct insn_state *state) + state->vals[op->dest.reg].offset = -state->stack_size; + } + ++ else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP && ++ cfa->base == CFI_BP) { ++ ++ /* ++ * mov %rbp, %rsp ++ * ++ * Restore the original stack pointer (Clang). ++ */ ++ state->stack_size = -state->regs[CFI_BP].offset; ++ } ++ + else if (op->dest.reg == cfa->base) { + + /* mov %reg, %rsp */ +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index 9c4e23d8c8ce..53d83d7e6a09 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -64,6 +64,14 @@ int arch__compare_symbol_names_n(const char *namea, const char *nameb, + + return strncmp(namea, nameb, n); + } ++ ++const char *arch__normalize_symbol_name(const char *name) ++{ ++ /* Skip over initial dot */ ++ if (name && *name == '.') ++ name++; ++ return name; ++} + #endif + + #if defined(_CALL_ELF) && _CALL_ELF == 2 +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 0c95ffefb6cc..1957abc1c8cf 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -1856,8 +1856,8 @@ int cmd_record(int argc, const char **argv) + goto out; + } + +- /* Enable ignoring missing threads when -u option is defined. */ +- rec->opts.ignore_missing_thread = rec->opts.target.uid != UINT_MAX; ++ /* Enable ignoring missing threads when -u/-p option is defined. */ ++ rec->opts.ignore_missing_thread = rec->opts.target.uid != UINT_MAX || rec->opts.target.pid; + + err = -ENOMEM; + if (perf_evlist__create_maps(rec->evlist, &rec->opts.target) < 0) +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index fae4b0340750..183c3ed56e08 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -162,12 +162,28 @@ static int hist_iter__branch_callback(struct hist_entry_iter *iter, + struct hist_entry *he = iter->he; + struct report *rep = arg; + struct branch_info *bi; ++ struct perf_sample *sample = iter->sample; ++ struct perf_evsel *evsel = iter->evsel; ++ int err; ++ ++ if (!ui__has_annotation()) ++ return 0; ++ ++ hist__account_cycles(sample->branch_stack, al, sample, ++ rep->nonany_branch_mode); + + bi = he->branch_info; ++ err = addr_map_symbol__inc_samples(&bi->from, sample, evsel->idx); ++ if (err) ++ goto out; ++ ++ err = addr_map_symbol__inc_samples(&bi->to, sample, evsel->idx); ++ + branch_type_count(&rep->brtype_stat, &bi->flags, + bi->from.addr, bi->to.addr); + +- return 0; ++out: ++ return err; + } + + static int process_sample_event(struct perf_tool *tool, +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 1f6beb3d0c68..ac19130c14d8 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1591,10 +1591,46 @@ static int __open_attr__fprintf(FILE *fp, const char *name, const char *val, + return fprintf(fp, " %-32s %s\n", name, val); + } + ++static void perf_evsel__remove_fd(struct perf_evsel *pos, ++ int nr_cpus, int nr_threads, ++ int thread_idx) ++{ ++ for (int cpu = 0; cpu < nr_cpus; cpu++) ++ for (int thread = thread_idx; thread < nr_threads - 1; thread++) ++ FD(pos, cpu, thread) = FD(pos, cpu, thread + 1); ++} ++ ++static int update_fds(struct perf_evsel *evsel, ++ int nr_cpus, int cpu_idx, ++ int nr_threads, int thread_idx) ++{ ++ struct perf_evsel *pos; ++ ++ if (cpu_idx >= nr_cpus || thread_idx >= nr_threads) ++ return -EINVAL; ++ ++ evlist__for_each_entry(evsel->evlist, pos) { ++ nr_cpus = pos != evsel ? nr_cpus : cpu_idx; ++ ++ perf_evsel__remove_fd(pos, nr_cpus, nr_threads, thread_idx); ++ ++ /* ++ * Since fds for next evsel has not been created, ++ * there is no need to iterate whole event list. ++ */ ++ if (pos == evsel) ++ break; ++ } ++ return 0; ++} ++ + static bool ignore_missing_thread(struct perf_evsel *evsel, ++ int nr_cpus, int cpu, + struct thread_map *threads, + int thread, int err) + { ++ pid_t ignore_pid = thread_map__pid(threads, thread); ++ + if (!evsel->ignore_missing_thread) + return false; + +@@ -1610,11 +1646,18 @@ static bool ignore_missing_thread(struct perf_evsel *evsel, + if (threads->nr == 1) + return false; + ++ /* ++ * We should remove fd for missing_thread first ++ * because thread_map__remove() will decrease threads->nr. ++ */ ++ if (update_fds(evsel, nr_cpus, cpu, threads->nr, thread)) ++ return false; ++ + if (thread_map__remove(threads, thread)) + return false; + + pr_warning("WARNING: Ignored open failure for pid %d\n", +- thread_map__pid(threads, thread)); ++ ignore_pid); + return true; + } + +@@ -1719,7 +1762,7 @@ int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus, + if (fd < 0) { + err = -errno; + +- if (ignore_missing_thread(evsel, threads, thread, err)) { ++ if (ignore_missing_thread(evsel, cpus->nr, cpu, threads, thread, err)) { + /* + * We just removed 1 thread, so take a step + * back on thread index and lower the upper +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index b7aaf9b2294d..68786bb7790e 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -2625,6 +2625,14 @@ static int get_new_event_name(char *buf, size_t len, const char *base, + + out: + free(nbase); ++ ++ /* Final validation */ ++ if (ret >= 0 && !is_c_func_name(buf)) { ++ pr_warning("Internal error: \"%s\" is an invalid event name.\n", ++ buf); ++ ret = -EINVAL; ++ } ++ + return ret; + } + +@@ -2792,16 +2800,32 @@ static int find_probe_functions(struct map *map, char *name, + int found = 0; + struct symbol *sym; + struct rb_node *tmp; ++ const char *norm, *ver; ++ char *buf = NULL; + + if (map__load(map) < 0) + return 0; + + map__for_each_symbol(map, sym, tmp) { +- if (strglobmatch(sym->name, name)) { ++ norm = arch__normalize_symbol_name(sym->name); ++ if (!norm) ++ continue; ++ ++ /* We don't care about default symbol or not */ ++ ver = strchr(norm, '@'); ++ if (ver) { ++ buf = strndup(norm, ver - norm); ++ if (!buf) ++ return -ENOMEM; ++ norm = buf; ++ } ++ if (strglobmatch(norm, name)) { + found++; + if (syms && found < probe_conf.max_probes) + syms[found - 1] = sym; + } ++ if (buf) ++ zfree(&buf); + } + + return found; +@@ -2847,7 +2871,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, + * same name but different addresses, this lists all the symbols. + */ + num_matched_functions = find_probe_functions(map, pp->function, syms); +- if (num_matched_functions == 0) { ++ if (num_matched_functions <= 0) { + pr_err("Failed to find symbol %s in %s\n", pp->function, + pev->target ? : "kernel"); + ret = -ENOENT; +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 6492ef38b090..4e8dd5fd45fd 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -93,6 +93,11 @@ static int prefix_underscores_count(const char *str) + return tail - str; + } + ++const char * __weak arch__normalize_symbol_name(const char *name) ++{ ++ return name; ++} ++ + int __weak arch__compare_symbol_names(const char *namea, const char *nameb) + { + return strcmp(namea, nameb); +diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h +index 6352022593c6..698c65e603a8 100644 +--- a/tools/perf/util/symbol.h ++++ b/tools/perf/util/symbol.h +@@ -347,6 +347,7 @@ bool elf__needs_adjust_symbols(GElf_Ehdr ehdr); + void arch__sym_update(struct symbol *s, GElf_Sym *sym); + #endif + ++const char *arch__normalize_symbol_name(const char *name); + #define SYMBOL_A 0 + #define SYMBOL_B 1 + +diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c +index 3687b720327a..cc57c246eade 100644 +--- a/tools/perf/util/util.c ++++ b/tools/perf/util/util.c +@@ -196,7 +196,7 @@ int copyfile_offset(int ifd, loff_t off_in, int ofd, loff_t off_out, u64 size) + + size -= ret; + off_in += ret; +- off_out -= ret; ++ off_out += ret; + } + munmap(ptr, off_in + size); + +diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c +index 3ab6ec403905..e11fe84de0fd 100644 +--- a/tools/testing/selftests/net/msg_zerocopy.c ++++ b/tools/testing/selftests/net/msg_zerocopy.c +@@ -259,22 +259,28 @@ static int setup_ip6h(struct ipv6hdr *ip6h, uint16_t payload_len) + return sizeof(*ip6h); + } + +-static void setup_sockaddr(int domain, const char *str_addr, void *sockaddr) ++ ++static void setup_sockaddr(int domain, const char *str_addr, ++ struct sockaddr_storage *sockaddr) + { + struct sockaddr_in6 *addr6 = (void *) sockaddr; + struct sockaddr_in *addr4 = (void *) sockaddr; + + switch (domain) { + case PF_INET: ++ memset(addr4, 0, sizeof(*addr4)); + addr4->sin_family = AF_INET; + addr4->sin_port = htons(cfg_port); +- if (inet_pton(AF_INET, str_addr, &(addr4->sin_addr)) != 1) ++ if (str_addr && ++ inet_pton(AF_INET, str_addr, &(addr4->sin_addr)) != 1) + error(1, 0, "ipv4 parse error: %s", str_addr); + break; + case PF_INET6: ++ memset(addr6, 0, sizeof(*addr6)); + addr6->sin6_family = AF_INET6; + addr6->sin6_port = htons(cfg_port); +- if (inet_pton(AF_INET6, str_addr, &(addr6->sin6_addr)) != 1) ++ if (str_addr && ++ inet_pton(AF_INET6, str_addr, &(addr6->sin6_addr)) != 1) + error(1, 0, "ipv6 parse error: %s", str_addr); + break; + default: +@@ -603,6 +609,7 @@ static void parse_opts(int argc, char **argv) + sizeof(struct tcphdr) - + 40 /* max tcp options */; + int c; ++ char *daddr = NULL, *saddr = NULL; + + cfg_payload_len = max_payload_len; + +@@ -627,7 +634,7 @@ static void parse_opts(int argc, char **argv) + cfg_cpu = strtol(optarg, NULL, 0); + break; + case 'D': +- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr); ++ daddr = optarg; + break; + case 'i': + cfg_ifindex = if_nametoindex(optarg); +@@ -638,7 +645,7 @@ static void parse_opts(int argc, char **argv) + cfg_cork_mixed = true; + break; + case 'p': +- cfg_port = htons(strtoul(optarg, NULL, 0)); ++ cfg_port = strtoul(optarg, NULL, 0); + break; + case 'r': + cfg_rx = true; +@@ -647,7 +654,7 @@ static void parse_opts(int argc, char **argv) + cfg_payload_len = strtoul(optarg, NULL, 0); + break; + case 'S': +- setup_sockaddr(cfg_family, optarg, &cfg_src_addr); ++ saddr = optarg; + break; + case 't': + cfg_runtime_ms = 200 + strtoul(optarg, NULL, 10) * 1000; +@@ -660,6 +667,8 @@ static void parse_opts(int argc, char **argv) + break; + } + } ++ setup_sockaddr(cfg_family, daddr, &cfg_dst_addr); ++ setup_sockaddr(cfg_family, saddr, &cfg_src_addr); + + if (cfg_payload_len > max_payload_len) + error(1, 0, "-s: payload exceeds max (%d)", max_payload_len); |