lkml.org 
[lkml]   [2017]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: Linux 4.9.3
    diff --git a/Documentation/conf.py b/Documentation/conf.py
    index bf6f310e5170..d769cd89a9f7 100644
    --- a/Documentation/conf.py
    +++ b/Documentation/conf.py
    @@ -37,7 +37,7 @@ from load_config import loadConfig
    extensions = ['kernel-doc', 'rstFlatTable', 'kernel_include', 'cdomain']

    # The name of the math extension changed on Sphinx 1.4
    -if minor > 3:
    +if major == 1 and minor > 3:
    extensions.append("sphinx.ext.imgmath")
    else:
    extensions.append("sphinx.ext.pngmath")
    @@ -332,6 +332,10 @@ latex_elements = {
    '''
    }

    +# Fix reference escape troubles with Sphinx 1.4.x
    +if major == 1 and minor > 3:
    + latex_elements['preamble'] += '\\renewcommand*{\\DUrole}[2]{ #2 }\n'
    +
    # Grouping the document tree into LaTeX files. List of tuples
    # (source start file, target name, title,
    # author, documentclass [howto, manual, or own class]).
    diff --git a/Documentation/media/index.rst b/Documentation/media/index.rst
    index e347a3e7bdef..7f8f0af620ce 100644
    --- a/Documentation/media/index.rst
    +++ b/Documentation/media/index.rst
    @@ -1,11 +1,6 @@
    Linux Media Subsystem Documentation
    ===================================

    -.. Sphinx 1.4.x has a definition for DUrole that doesn't work on alltt blocks
    -.. raw:: latex
    -
    - \renewcommand*{\DUrole}[2]{ #2 }
    -
    Contents:

    .. toctree::
    diff --git a/Makefile b/Makefile
    index c9ce897465c5..ae42a0aaab06 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,6 +1,6 @@
    VERSION = 4
    PATCHLEVEL = 9
    -SUBLEVEL = 2
    +SUBLEVEL = 3
    EXTRAVERSION =
    NAME = Roaring Lionus

    diff --git a/arch/arm/boot/dts/r8a7794.dtsi b/arch/arm/boot/dts/r8a7794.dtsi
    index 9365580a194f..725ecb3c5fb4 100644
    --- a/arch/arm/boot/dts/r8a7794.dtsi
    +++ b/arch/arm/boot/dts/r8a7794.dtsi
    @@ -1260,7 +1260,7 @@
    mstp7_clks: mstp7_clks@e615014c {
    compatible = "renesas,r8a7794-mstp-clocks", "renesas,cpg-mstp-clocks";
    reg = <0 0xe615014c 0 4>, <0 0xe61501c4 0 4>;
    - clocks = <&mp_clk>, <&mp_clk>,
    + clocks = <&mp_clk>, <&hp_clk>,
    <&zs_clk>, <&p_clk>, <&p_clk>, <&zs_clk>,
    <&zs_clk>, <&p_clk>, <&p_clk>, <&p_clk>, <&p_clk>,
    <&zx_clk>;
    diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
    index ba5bca0fe997..44377a98cc89 100644
    --- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
    +++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
    @@ -227,3 +227,8 @@
    pinctrl-0 = <&uart0_pins_a>;
    status = "okay";
    };
    +
    +&usbphy {
    + /* VBUS on usb host ports are tied to DC5V and therefore always on */
    + status = "okay";
    +};
    diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
    index aef022a87c53..04410d9f5e72 100644
    --- a/arch/arm/crypto/aes-ce-glue.c
    +++ b/arch/arm/crypto/aes-ce-glue.c
    @@ -88,8 +88,13 @@ static int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key,
    u32 *rki = ctx->key_enc + (i * kwords);
    u32 *rko = rki + kwords;

    +#ifndef CONFIG_CPU_BIG_ENDIAN
    rko[0] = ror32(ce_aes_sub(rki[kwords - 1]), 8);
    rko[0] = rko[0] ^ rki[0] ^ rcon[i];
    +#else
    + rko[0] = rol32(ce_aes_sub(rki[kwords - 1]), 8);
    + rko[0] = rko[0] ^ rki[0] ^ (rcon[i] << 24);
    +#endif
    rko[1] = rko[0] ^ rki[1];
    rko[2] = rko[1] ^ rki[2];
    rko[3] = rko[2] ^ rki[3];
    diff --git a/arch/arm/mach-davinci/da850.c b/arch/arm/mach-davinci/da850.c
    index ed3d0e9f72ac..d7a43afdfac0 100644
    --- a/arch/arm/mach-davinci/da850.c
    +++ b/arch/arm/mach-davinci/da850.c
    @@ -319,6 +319,16 @@ static struct clk emac_clk = {
    .gpsc = 1,
    };

    +/*
    + * In order to avoid adding the emac_clk to the clock lookup table twice (and
    + * screwing up the linked list in the process) create a separate clock for
    + * mdio inheriting the rate from emac_clk.
    + */
    +static struct clk mdio_clk = {
    + .name = "mdio",
    + .parent = &emac_clk,
    +};
    +
    static struct clk mcasp_clk = {
    .name = "mcasp",
    .parent = &async3_clk,
    @@ -494,7 +504,7 @@ static struct clk_lookup da850_clks[] = {
    CLK(NULL, "arm", &arm_clk),
    CLK(NULL, "rmii", &rmii_clk),
    CLK("davinci_emac.1", NULL, &emac_clk),
    - CLK("davinci_mdio.0", "fck", &emac_clk),
    + CLK("davinci_mdio.0", "fck", &mdio_clk),
    CLK("davinci-mcasp.0", NULL, &mcasp_clk),
    CLK("davinci-mcbsp.0", NULL, &mcbsp0_clk),
    CLK("davinci-mcbsp.1", NULL, &mcbsp1_clk),
    diff --git a/arch/arm64/boot/dts/hisilicon/hip06.dtsi b/arch/arm64/boot/dts/hisilicon/hip06.dtsi
    index b548763366dd..af450413b9dd 100644
    --- a/arch/arm64/boot/dts/hisilicon/hip06.dtsi
    +++ b/arch/arm64/boot/dts/hisilicon/hip06.dtsi
    @@ -322,7 +322,7 @@
    compatible = "generic-ohci";
    reg = <0x0 0xa7030000 0x0 0x10000>;
    interrupt-parent = <&mbigen_usb>;
    - interrupts = <64 4>;
    + interrupts = <640 4>;
    dma-coherent;
    status = "disabled";
    };
    @@ -331,7 +331,7 @@
    compatible = "generic-ehci";
    reg = <0x0 0xa7020000 0x0 0x10000>;
    interrupt-parent = <&mbigen_usb>;
    - interrupts = <65 4>;
    + interrupts = <641 4>;
    dma-coherent;
    status = "disabled";
    };
    diff --git a/arch/arm64/crypto/aes-ce-ccm-core.S b/arch/arm64/crypto/aes-ce-ccm-core.S
    index a2a7fbcacc14..3363560c79b7 100644
    --- a/arch/arm64/crypto/aes-ce-ccm-core.S
    +++ b/arch/arm64/crypto/aes-ce-ccm-core.S
    @@ -9,6 +9,7 @@
    */

    #include <linux/linkage.h>
    +#include <asm/assembler.h>

    .text
    .arch armv8-a+crypto
    @@ -19,7 +20,7 @@
    */
    ENTRY(ce_aes_ccm_auth_data)
    ldr w8, [x3] /* leftover from prev round? */
    - ld1 {v0.2d}, [x0] /* load mac */
    + ld1 {v0.16b}, [x0] /* load mac */
    cbz w8, 1f
    sub w8, w8, #16
    eor v1.16b, v1.16b, v1.16b
    @@ -31,7 +32,7 @@ ENTRY(ce_aes_ccm_auth_data)
    beq 8f /* out of input? */
    cbnz w8, 0b
    eor v0.16b, v0.16b, v1.16b
    -1: ld1 {v3.2d}, [x4] /* load first round key */
    +1: ld1 {v3.16b}, [x4] /* load first round key */
    prfm pldl1strm, [x1]
    cmp w5, #12 /* which key size? */
    add x6, x4, #16
    @@ -41,17 +42,17 @@ ENTRY(ce_aes_ccm_auth_data)
    mov v5.16b, v3.16b
    b 4f
    2: mov v4.16b, v3.16b
    - ld1 {v5.2d}, [x6], #16 /* load 2nd round key */
    + ld1 {v5.16b}, [x6], #16 /* load 2nd round key */
    3: aese v0.16b, v4.16b
    aesmc v0.16b, v0.16b
    -4: ld1 {v3.2d}, [x6], #16 /* load next round key */
    +4: ld1 {v3.16b}, [x6], #16 /* load next round key */
    aese v0.16b, v5.16b
    aesmc v0.16b, v0.16b
    -5: ld1 {v4.2d}, [x6], #16 /* load next round key */
    +5: ld1 {v4.16b}, [x6], #16 /* load next round key */
    subs w7, w7, #3
    aese v0.16b, v3.16b
    aesmc v0.16b, v0.16b
    - ld1 {v5.2d}, [x6], #16 /* load next round key */
    + ld1 {v5.16b}, [x6], #16 /* load next round key */
    bpl 3b
    aese v0.16b, v4.16b
    subs w2, w2, #16 /* last data? */
    @@ -60,7 +61,7 @@ ENTRY(ce_aes_ccm_auth_data)
    ld1 {v1.16b}, [x1], #16 /* load next input block */
    eor v0.16b, v0.16b, v1.16b /* xor with mac */
    bne 1b
    -6: st1 {v0.2d}, [x0] /* store mac */
    +6: st1 {v0.16b}, [x0] /* store mac */
    beq 10f
    adds w2, w2, #16
    beq 10f
    @@ -79,7 +80,7 @@ ENTRY(ce_aes_ccm_auth_data)
    adds w7, w7, #1
    bne 9b
    eor v0.16b, v0.16b, v1.16b
    - st1 {v0.2d}, [x0]
    + st1 {v0.16b}, [x0]
    10: str w8, [x3]
    ret
    ENDPROC(ce_aes_ccm_auth_data)
    @@ -89,27 +90,27 @@ ENDPROC(ce_aes_ccm_auth_data)
    * u32 rounds);
    */
    ENTRY(ce_aes_ccm_final)
    - ld1 {v3.2d}, [x2], #16 /* load first round key */
    - ld1 {v0.2d}, [x0] /* load mac */
    + ld1 {v3.16b}, [x2], #16 /* load first round key */
    + ld1 {v0.16b}, [x0] /* load mac */
    cmp w3, #12 /* which key size? */
    sub w3, w3, #2 /* modified # of rounds */
    - ld1 {v1.2d}, [x1] /* load 1st ctriv */
    + ld1 {v1.16b}, [x1] /* load 1st ctriv */
    bmi 0f
    bne 3f
    mov v5.16b, v3.16b
    b 2f
    0: mov v4.16b, v3.16b
    -1: ld1 {v5.2d}, [x2], #16 /* load next round key */
    +1: ld1 {v5.16b}, [x2], #16 /* load next round key */
    aese v0.16b, v4.16b
    aesmc v0.16b, v0.16b
    aese v1.16b, v4.16b
    aesmc v1.16b, v1.16b
    -2: ld1 {v3.2d}, [x2], #16 /* load next round key */
    +2: ld1 {v3.16b}, [x2], #16 /* load next round key */
    aese v0.16b, v5.16b
    aesmc v0.16b, v0.16b
    aese v1.16b, v5.16b
    aesmc v1.16b, v1.16b
    -3: ld1 {v4.2d}, [x2], #16 /* load next round key */
    +3: ld1 {v4.16b}, [x2], #16 /* load next round key */
    subs w3, w3, #3
    aese v0.16b, v3.16b
    aesmc v0.16b, v0.16b
    @@ -120,47 +121,47 @@ ENTRY(ce_aes_ccm_final)
    aese v1.16b, v4.16b
    /* final round key cancels out */
    eor v0.16b, v0.16b, v1.16b /* en-/decrypt the mac */
    - st1 {v0.2d}, [x0] /* store result */
    + st1 {v0.16b}, [x0] /* store result */
    ret
    ENDPROC(ce_aes_ccm_final)

    .macro aes_ccm_do_crypt,enc
    ldr x8, [x6, #8] /* load lower ctr */
    - ld1 {v0.2d}, [x5] /* load mac */
    - rev x8, x8 /* keep swabbed ctr in reg */
    + ld1 {v0.16b}, [x5] /* load mac */
    +CPU_LE( rev x8, x8 ) /* keep swabbed ctr in reg */
    0: /* outer loop */
    - ld1 {v1.1d}, [x6] /* load upper ctr */
    + ld1 {v1.8b}, [x6] /* load upper ctr */
    prfm pldl1strm, [x1]
    add x8, x8, #1
    rev x9, x8
    cmp w4, #12 /* which key size? */
    sub w7, w4, #2 /* get modified # of rounds */
    ins v1.d[1], x9 /* no carry in lower ctr */
    - ld1 {v3.2d}, [x3] /* load first round key */
    + ld1 {v3.16b}, [x3] /* load first round key */
    add x10, x3, #16
    bmi 1f
    bne 4f
    mov v5.16b, v3.16b
    b 3f
    1: mov v4.16b, v3.16b
    - ld1 {v5.2d}, [x10], #16 /* load 2nd round key */
    + ld1 {v5.16b}, [x10], #16 /* load 2nd round key */
    2: /* inner loop: 3 rounds, 2x interleaved */
    aese v0.16b, v4.16b
    aesmc v0.16b, v0.16b
    aese v1.16b, v4.16b
    aesmc v1.16b, v1.16b
    -3: ld1 {v3.2d}, [x10], #16 /* load next round key */
    +3: ld1 {v3.16b}, [x10], #16 /* load next round key */
    aese v0.16b, v5.16b
    aesmc v0.16b, v0.16b
    aese v1.16b, v5.16b
    aesmc v1.16b, v1.16b
    -4: ld1 {v4.2d}, [x10], #16 /* load next round key */
    +4: ld1 {v4.16b}, [x10], #16 /* load next round key */
    subs w7, w7, #3
    aese v0.16b, v3.16b
    aesmc v0.16b, v0.16b
    aese v1.16b, v3.16b
    aesmc v1.16b, v1.16b
    - ld1 {v5.2d}, [x10], #16 /* load next round key */
    + ld1 {v5.16b}, [x10], #16 /* load next round key */
    bpl 2b
    aese v0.16b, v4.16b
    aese v1.16b, v4.16b
    @@ -177,14 +178,14 @@ ENDPROC(ce_aes_ccm_final)
    eor v0.16b, v0.16b, v2.16b /* xor mac with pt ^ rk[last] */
    st1 {v1.16b}, [x0], #16 /* write output block */
    bne 0b
    - rev x8, x8
    - st1 {v0.2d}, [x5] /* store mac */
    +CPU_LE( rev x8, x8 )
    + st1 {v0.16b}, [x5] /* store mac */
    str x8, [x6, #8] /* store lsb end of ctr (BE) */
    5: ret

    6: eor v0.16b, v0.16b, v5.16b /* final round mac */
    eor v1.16b, v1.16b, v5.16b /* final round enc */
    - st1 {v0.2d}, [x5] /* store mac */
    + st1 {v0.16b}, [x5] /* store mac */
    add w2, w2, #16 /* process partial tail block */
    7: ldrb w9, [x1], #1 /* get 1 byte of input */
    umov w6, v1.b[0] /* get top crypted ctr byte */
    diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c
    index f7bd9bf0bbb3..50d9fe11d0c8 100644
    --- a/arch/arm64/crypto/aes-ce-cipher.c
    +++ b/arch/arm64/crypto/aes-ce-cipher.c
    @@ -47,24 +47,24 @@ static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[])
    kernel_neon_begin_partial(4);

    __asm__(" ld1 {v0.16b}, %[in] ;"
    - " ld1 {v1.2d}, [%[key]], #16 ;"
    + " ld1 {v1.16b}, [%[key]], #16 ;"
    " cmp %w[rounds], #10 ;"
    " bmi 0f ;"
    " bne 3f ;"
    " mov v3.16b, v1.16b ;"
    " b 2f ;"
    "0: mov v2.16b, v1.16b ;"
    - " ld1 {v3.2d}, [%[key]], #16 ;"
    + " ld1 {v3.16b}, [%[key]], #16 ;"
    "1: aese v0.16b, v2.16b ;"
    " aesmc v0.16b, v0.16b ;"
    - "2: ld1 {v1.2d}, [%[key]], #16 ;"
    + "2: ld1 {v1.16b}, [%[key]], #16 ;"
    " aese v0.16b, v3.16b ;"
    " aesmc v0.16b, v0.16b ;"
    - "3: ld1 {v2.2d}, [%[key]], #16 ;"
    + "3: ld1 {v2.16b}, [%[key]], #16 ;"
    " subs %w[rounds], %w[rounds], #3 ;"
    " aese v0.16b, v1.16b ;"
    " aesmc v0.16b, v0.16b ;"
    - " ld1 {v3.2d}, [%[key]], #16 ;"
    + " ld1 {v3.16b}, [%[key]], #16 ;"
    " bpl 1b ;"
    " aese v0.16b, v2.16b ;"
    " eor v0.16b, v0.16b, v3.16b ;"
    @@ -92,24 +92,24 @@ static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[])
    kernel_neon_begin_partial(4);

    __asm__(" ld1 {v0.16b}, %[in] ;"
    - " ld1 {v1.2d}, [%[key]], #16 ;"
    + " ld1 {v1.16b}, [%[key]], #16 ;"
    " cmp %w[rounds], #10 ;"
    " bmi 0f ;"
    " bne 3f ;"
    " mov v3.16b, v1.16b ;"
    " b 2f ;"
    "0: mov v2.16b, v1.16b ;"
    - " ld1 {v3.2d}, [%[key]], #16 ;"
    + " ld1 {v3.16b}, [%[key]], #16 ;"
    "1: aesd v0.16b, v2.16b ;"
    " aesimc v0.16b, v0.16b ;"
    - "2: ld1 {v1.2d}, [%[key]], #16 ;"
    + "2: ld1 {v1.16b}, [%[key]], #16 ;"
    " aesd v0.16b, v3.16b ;"
    " aesimc v0.16b, v0.16b ;"
    - "3: ld1 {v2.2d}, [%[key]], #16 ;"
    + "3: ld1 {v2.16b}, [%[key]], #16 ;"
    " subs %w[rounds], %w[rounds], #3 ;"
    " aesd v0.16b, v1.16b ;"
    " aesimc v0.16b, v0.16b ;"
    - " ld1 {v3.2d}, [%[key]], #16 ;"
    + " ld1 {v3.16b}, [%[key]], #16 ;"
    " bpl 1b ;"
    " aesd v0.16b, v2.16b ;"
    " eor v0.16b, v0.16b, v3.16b ;"
    @@ -173,7 +173,12 @@ int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key,
    u32 *rki = ctx->key_enc + (i * kwords);
    u32 *rko = rki + kwords;

    +#ifndef CONFIG_CPU_BIG_ENDIAN
    rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0];
    +#else
    + rko[0] = rol32(aes_sub(rki[kwords - 1]), 8) ^ (rcon[i] << 24) ^
    + rki[0];
    +#endif
    rko[1] = rko[0] ^ rki[1];
    rko[2] = rko[1] ^ rki[2];
    rko[3] = rko[2] ^ rki[3];
    diff --git a/arch/arm64/crypto/aes-ce.S b/arch/arm64/crypto/aes-ce.S
    index 78f3cfe92c08..b46093d567e5 100644
    --- a/arch/arm64/crypto/aes-ce.S
    +++ b/arch/arm64/crypto/aes-ce.S
    @@ -10,6 +10,7 @@
    */

    #include <linux/linkage.h>
    +#include <asm/assembler.h>

    #define AES_ENTRY(func) ENTRY(ce_ ## func)
    #define AES_ENDPROC(func) ENDPROC(ce_ ## func)
    diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
    index f6e372c528eb..c53dbeae79f2 100644
    --- a/arch/arm64/crypto/aes-modes.S
    +++ b/arch/arm64/crypto/aes-modes.S
    @@ -386,7 +386,8 @@ AES_ENDPROC(aes_ctr_encrypt)
    .endm

    .Lxts_mul_x:
    - .word 1, 0, 0x87, 0
    +CPU_LE( .quad 1, 0x87 )
    +CPU_BE( .quad 0x87, 1 )

    AES_ENTRY(aes_xts_encrypt)
    FRAME_PUSH
    diff --git a/arch/arm64/crypto/aes-neon.S b/arch/arm64/crypto/aes-neon.S
    index b93170e1cc93..85f07ead7c5c 100644
    --- a/arch/arm64/crypto/aes-neon.S
    +++ b/arch/arm64/crypto/aes-neon.S
    @@ -9,6 +9,7 @@
    */

    #include <linux/linkage.h>
    +#include <asm/assembler.h>

    #define AES_ENTRY(func) ENTRY(neon_ ## func)
    #define AES_ENDPROC(func) ENDPROC(neon_ ## func)
    @@ -83,13 +84,13 @@
    .endm

    .macro do_block, enc, in, rounds, rk, rkp, i
    - ld1 {v15.16b}, [\rk]
    + ld1 {v15.4s}, [\rk]
    add \rkp, \rk, #16
    mov \i, \rounds
    1111: eor \in\().16b, \in\().16b, v15.16b /* ^round key */
    tbl \in\().16b, {\in\().16b}, v13.16b /* ShiftRows */
    sub_bytes \in
    - ld1 {v15.16b}, [\rkp], #16
    + ld1 {v15.4s}, [\rkp], #16
    subs \i, \i, #1
    beq 2222f
    .if \enc == 1
    @@ -229,7 +230,7 @@
    .endm

    .macro do_block_2x, enc, in0, in1 rounds, rk, rkp, i
    - ld1 {v15.16b}, [\rk]
    + ld1 {v15.4s}, [\rk]
    add \rkp, \rk, #16
    mov \i, \rounds
    1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */
    @@ -237,7 +238,7 @@
    sub_bytes_2x \in0, \in1
    tbl \in0\().16b, {\in0\().16b}, v13.16b /* ShiftRows */
    tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */
    - ld1 {v15.16b}, [\rkp], #16
    + ld1 {v15.4s}, [\rkp], #16
    subs \i, \i, #1
    beq 2222f
    .if \enc == 1
    @@ -254,7 +255,7 @@
    .endm

    .macro do_block_4x, enc, in0, in1, in2, in3, rounds, rk, rkp, i
    - ld1 {v15.16b}, [\rk]
    + ld1 {v15.4s}, [\rk]
    add \rkp, \rk, #16
    mov \i, \rounds
    1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */
    @@ -266,7 +267,7 @@
    tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */
    tbl \in2\().16b, {\in2\().16b}, v13.16b /* ShiftRows */
    tbl \in3\().16b, {\in3\().16b}, v13.16b /* ShiftRows */
    - ld1 {v15.16b}, [\rkp], #16
    + ld1 {v15.4s}, [\rkp], #16
    subs \i, \i, #1
    beq 2222f
    .if \enc == 1
    @@ -306,12 +307,16 @@
    .text
    .align 4
    .LForward_ShiftRows:
    - .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3
    - .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb
    +CPU_LE( .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3 )
    +CPU_LE( .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb )
    +CPU_BE( .byte 0xb, 0x6, 0x1, 0xc, 0x7, 0x2, 0xd, 0x8 )
    +CPU_BE( .byte 0x3, 0xe, 0x9, 0x4, 0xf, 0xa, 0x5, 0x0 )

    .LReverse_ShiftRows:
    - .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb
    - .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3
    +CPU_LE( .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb )
    +CPU_LE( .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3 )
    +CPU_BE( .byte 0x3, 0x6, 0x9, 0xc, 0xf, 0x2, 0x5, 0x8 )
    +CPU_BE( .byte 0xb, 0xe, 0x1, 0x4, 0x7, 0xa, 0xd, 0x0 )

    .LForward_Sbox:
    .byte 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
    diff --git a/arch/arm64/crypto/ghash-ce-core.S b/arch/arm64/crypto/ghash-ce-core.S
    index dc457015884e..f0bb9f0b524f 100644
    --- a/arch/arm64/crypto/ghash-ce-core.S
    +++ b/arch/arm64/crypto/ghash-ce-core.S
    @@ -29,8 +29,8 @@
    * struct ghash_key const *k, const char *head)
    */
    ENTRY(pmull_ghash_update)
    - ld1 {SHASH.16b}, [x3]
    - ld1 {XL.16b}, [x1]
    + ld1 {SHASH.2d}, [x3]
    + ld1 {XL.2d}, [x1]
    movi MASK.16b, #0xe1
    ext SHASH2.16b, SHASH.16b, SHASH.16b, #8
    shl MASK.2d, MASK.2d, #57
    @@ -74,6 +74,6 @@ CPU_LE( rev64 T1.16b, T1.16b )

    cbnz w0, 0b

    - st1 {XL.16b}, [x1]
    + st1 {XL.2d}, [x1]
    ret
    ENDPROC(pmull_ghash_update)
    diff --git a/arch/arm64/crypto/sha1-ce-core.S b/arch/arm64/crypto/sha1-ce-core.S
    index 033aae6d732a..c98e7e849f06 100644
    --- a/arch/arm64/crypto/sha1-ce-core.S
    +++ b/arch/arm64/crypto/sha1-ce-core.S
    @@ -78,7 +78,7 @@ ENTRY(sha1_ce_transform)
    ld1r {k3.4s}, [x6]

    /* load state */
    - ldr dga, [x0]
    + ld1 {dgav.4s}, [x0]
    ldr dgb, [x0, #16]

    /* load sha1_ce_state::finalize */
    @@ -144,7 +144,7 @@ CPU_LE( rev32 v11.16b, v11.16b )
    b 1b

    /* store new state */
    -3: str dga, [x0]
    +3: st1 {dgav.4s}, [x0]
    str dgb, [x0, #16]
    ret
    ENDPROC(sha1_ce_transform)
    diff --git a/arch/arm64/crypto/sha2-ce-core.S b/arch/arm64/crypto/sha2-ce-core.S
    index 5df9d9d470ad..01cfee066837 100644
    --- a/arch/arm64/crypto/sha2-ce-core.S
    +++ b/arch/arm64/crypto/sha2-ce-core.S
    @@ -85,7 +85,7 @@ ENTRY(sha2_ce_transform)
    ld1 {v12.4s-v15.4s}, [x8]

    /* load state */
    - ldp dga, dgb, [x0]
    + ld1 {dgav.4s, dgbv.4s}, [x0]

    /* load sha256_ce_state::finalize */
    ldr w4, [x0, #:lo12:sha256_ce_offsetof_finalize]
    @@ -148,6 +148,6 @@ CPU_LE( rev32 v19.16b, v19.16b )
    b 1b

    /* store new state */
    -3: stp dga, dgb, [x0]
    +3: st1 {dgav.4s, dgbv.4s}, [x0]
    ret
    ENDPROC(sha2_ce_transform)
    diff --git a/arch/cris/boot/rescue/Makefile b/arch/cris/boot/rescue/Makefile
    index 52bd0bd1dd22..d98edbb30a18 100644
    --- a/arch/cris/boot/rescue/Makefile
    +++ b/arch/cris/boot/rescue/Makefile
    @@ -10,6 +10,9 @@

    asflags-y += $(LINUXINCLUDE)
    ccflags-y += -O2 $(LINUXINCLUDE)
    +
    +ifdef CONFIG_ETRAX_AXISFLASHMAP
    +
    arch-$(CONFIG_ETRAX_ARCH_V10) = v10
    arch-$(CONFIG_ETRAX_ARCH_V32) = v32

    @@ -28,6 +31,11 @@ $(obj)/rescue.bin: $(obj)/rescue.o FORCE
    $(call if_changed,objcopy)
    cp -p $(obj)/rescue.bin $(objtree)

    +else
    +$(obj)/rescue.bin:
    +
    +endif
    +
    $(obj)/testrescue.bin: $(obj)/testrescue.o
    $(OBJCOPY) $(OBJCOPYFLAGS) $(obj)/testrescue.o tr.bin
    # Pad it to 784 bytes
    diff --git a/arch/mips/kvm/entry.c b/arch/mips/kvm/entry.c
    index 6a02b3a3fa65..e92fb190e2d6 100644
    --- a/arch/mips/kvm/entry.c
    +++ b/arch/mips/kvm/entry.c
    @@ -521,6 +521,9 @@ void *kvm_mips_build_exit(void *addr)
    uasm_i_and(&p, V0, V0, AT);
    uasm_i_lui(&p, AT, ST0_CU0 >> 16);
    uasm_i_or(&p, V0, V0, AT);
    +#ifdef CONFIG_64BIT
    + uasm_i_ori(&p, V0, V0, ST0_SX | ST0_UX);
    +#endif
    uasm_i_mtc0(&p, V0, C0_STATUS);
    uasm_i_ehb(&p);

    @@ -643,7 +646,7 @@ static void *kvm_mips_build_ret_to_guest(void *addr)

    /* Setup status register for running guest in UM */
    uasm_i_ori(&p, V1, V1, ST0_EXL | KSU_USER | ST0_IE);
    - UASM_i_LA(&p, AT, ~(ST0_CU0 | ST0_MX));
    + UASM_i_LA(&p, AT, ~(ST0_CU0 | ST0_MX | ST0_SX | ST0_UX));
    uasm_i_and(&p, V1, V1, AT);
    uasm_i_mtc0(&p, V1, C0_STATUS);
    uasm_i_ehb(&p);
    diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c
    index 06a60b19acfb..29ec9ab3fd55 100644
    --- a/arch/mips/kvm/mips.c
    +++ b/arch/mips/kvm/mips.c
    @@ -360,8 +360,8 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
    dump_handler("kvm_exit", gebase + 0x2000, vcpu->arch.vcpu_run);

    /* Invalidate the icache for these ranges */
    - local_flush_icache_range((unsigned long)gebase,
    - (unsigned long)gebase + ALIGN(size, PAGE_SIZE));
    + flush_icache_range((unsigned long)gebase,
    + (unsigned long)gebase + ALIGN(size, PAGE_SIZE));

    /*
    * Allocate comm page for guest kernel, a TLB will be reserved for
    diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
    index 325f30d82b64..47ef8fdcd382 100644
    --- a/arch/parisc/kernel/time.c
    +++ b/arch/parisc/kernel/time.c
    @@ -289,9 +289,26 @@ void __init time_init(void)

    cr16_hz = 100 * PAGE0->mem_10msec; /* Hz */

    - /* register at clocksource framework */
    - clocksource_register_hz(&clocksource_cr16, cr16_hz);
    -
    /* register as sched_clock source */
    sched_clock_register(read_cr16_sched_clock, BITS_PER_LONG, cr16_hz);
    }
    +
    +static int __init init_cr16_clocksource(void)
    +{
    + /*
    + * The cr16 interval timers are not syncronized across CPUs, so mark
    + * them unstable and lower rating on SMP systems.
    + */
    + if (num_online_cpus() > 1) {
    + clocksource_cr16.flags = CLOCK_SOURCE_UNSTABLE;
    + clocksource_cr16.rating = 0;
    + }
    +
    + /* register at clocksource framework */
    + clocksource_register_hz(&clocksource_cr16,
    + 100 * PAGE0->mem_10msec);
    +
    + return 0;
    +}
    +
    +device_initcall(init_cr16_clocksource);
    diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
    index 8ff9253930af..1a0b4f63f0e9 100644
    --- a/arch/parisc/mm/fault.c
    +++ b/arch/parisc/mm/fault.c
    @@ -234,7 +234,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long code,
    tsk->comm, code, address);
    print_vma_addr(KERN_CONT " in ", regs->iaoq[0]);

    - pr_cont(" trap #%lu: %s%c", code, trap_name(code),
    + pr_cont("\ntrap #%lu: %s%c", code, trap_name(code),
    vma ? ',':'\n');

    if (vma)
    diff --git a/arch/s390/crypto/prng.c b/arch/s390/crypto/prng.c
    index 9cc050f9536c..1113389d0a39 100644
    --- a/arch/s390/crypto/prng.c
    +++ b/arch/s390/crypto/prng.c
    @@ -507,8 +507,10 @@ static ssize_t prng_tdes_read(struct file *file, char __user *ubuf,
    prng_data->prngws.byte_counter += n;
    prng_data->prngws.reseed_counter += n;

    - if (copy_to_user(ubuf, prng_data->buf, chunk))
    - return -EFAULT;
    + if (copy_to_user(ubuf, prng_data->buf, chunk)) {
    + ret = -EFAULT;
    + break;
    + }

    nbytes -= chunk;
    ret += chunk;
    diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
    index e959c02e0cac..8705ee66c087 100644
    --- a/arch/s390/kernel/topology.c
    +++ b/arch/s390/kernel/topology.c
    @@ -448,6 +448,7 @@ static int __init s390_topology_init(void)
    struct sysinfo_15_1_x *info;
    int i;

    + set_sched_topology(s390_topology);
    if (!MACHINE_HAS_TOPOLOGY)
    return 0;
    tl_info = (struct sysinfo_15_1_x *)__get_free_page(GFP_KERNEL);
    @@ -460,7 +461,6 @@ static int __init s390_topology_init(void)
    alloc_masks(info, &socket_info, 1);
    alloc_masks(info, &book_info, 2);
    alloc_masks(info, &drawer_info, 3);
    - set_sched_topology(s390_topology);
    return 0;
    }
    early_initcall(s390_topology_init);
    diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
    index 6b2f72f523b9..049e3860ac54 100644
    --- a/arch/s390/pci/pci_dma.c
    +++ b/arch/s390/pci/pci_dma.c
    @@ -419,6 +419,7 @@ static int __s390_dma_map_sg(struct device *dev, struct scatterlist *sg,
    size_t size, dma_addr_t *handle,
    enum dma_data_direction dir)
    {
    + unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
    struct zpci_dev *zdev = to_zpci(to_pci_dev(dev));
    dma_addr_t dma_addr_base, dma_addr;
    int flags = ZPCI_PTE_VALID;
    @@ -426,8 +427,7 @@ static int __s390_dma_map_sg(struct device *dev, struct scatterlist *sg,
    unsigned long pa = 0;
    int ret;

    - size = PAGE_ALIGN(size);
    - dma_addr_base = dma_alloc_address(dev, size >> PAGE_SHIFT);
    + dma_addr_base = dma_alloc_address(dev, nr_pages);
    if (dma_addr_base == DMA_ERROR_CODE)
    return -ENOMEM;

    @@ -436,26 +436,27 @@ static int __s390_dma_map_sg(struct device *dev, struct scatterlist *sg,
    flags |= ZPCI_TABLE_PROTECTED;

    for (s = sg; dma_addr < dma_addr_base + size; s = sg_next(s)) {
    - pa = page_to_phys(sg_page(s)) + s->offset;
    - ret = __dma_update_trans(zdev, pa, dma_addr, s->length, flags);
    + pa = page_to_phys(sg_page(s));
    + ret = __dma_update_trans(zdev, pa, dma_addr,
    + s->offset + s->length, flags);
    if (ret)
    goto unmap;

    - dma_addr += s->length;
    + dma_addr += s->offset + s->length;
    }
    ret = __dma_purge_tlb(zdev, dma_addr_base, size, flags);
    if (ret)
    goto unmap;

    *handle = dma_addr_base;
    - atomic64_add(size >> PAGE_SHIFT, &zdev->mapped_pages);
    + atomic64_add(nr_pages, &zdev->mapped_pages);

    return ret;

    unmap:
    dma_update_trans(zdev, 0, dma_addr_base, dma_addr - dma_addr_base,
    ZPCI_PTE_INVALID);
    - dma_free_address(dev, dma_addr_base, size >> PAGE_SHIFT);
    + dma_free_address(dev, dma_addr_base, nr_pages);
    zpci_err("map error:\n");
    zpci_err_dma(ret, pa);
    return ret;
    diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h
    index ae135de547f5..835aa51c7f6e 100644
    --- a/arch/x86/include/uapi/asm/prctl.h
    +++ b/arch/x86/include/uapi/asm/prctl.h
    @@ -6,10 +6,8 @@
    #define ARCH_GET_FS 0x1003
    #define ARCH_GET_GS 0x1004

    -#ifdef CONFIG_CHECKPOINT_RESTORE
    -# define ARCH_MAP_VDSO_X32 0x2001
    -# define ARCH_MAP_VDSO_32 0x2002
    -# define ARCH_MAP_VDSO_64 0x2003
    -#endif
    +#define ARCH_MAP_VDSO_X32 0x2001
    +#define ARCH_MAP_VDSO_32 0x2002
    +#define ARCH_MAP_VDSO_64 0x2003

    #endif /* _ASM_X86_PRCTL_H */
    diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
    index c2048b44851c..dd62708c6a67 100644
    --- a/arch/x86/kernel/cpu/common.c
    +++ b/arch/x86/kernel/cpu/common.c
    @@ -667,13 +667,14 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
    c->x86_capability[CPUID_1_EDX] = edx;
    }

    + /* Thermal and Power Management Leaf: level 0x00000006 (eax) */
    + if (c->cpuid_level >= 0x00000006)
    + c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
    +
    /* Additional Intel-defined flags: level 0x00000007 */
    if (c->cpuid_level >= 0x00000007) {
    cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx);
    -
    c->x86_capability[CPUID_7_0_EBX] = ebx;
    -
    - c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
    c->x86_capability[CPUID_7_ECX] = ecx;
    }

    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 04c5d96b1d67..f3648c978d2f 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -3036,6 +3036,8 @@ static void kvm_vcpu_ioctl_x86_get_vcpu_events(struct kvm_vcpu *vcpu,
    memset(&events->reserved, 0, sizeof(events->reserved));
    }

    +static void kvm_set_hflags(struct kvm_vcpu *vcpu, unsigned emul_flags);
    +
    static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
    struct kvm_vcpu_events *events)
    {
    @@ -3072,10 +3074,13 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
    vcpu->arch.apic->sipi_vector = events->sipi_vector;

    if (events->flags & KVM_VCPUEVENT_VALID_SMM) {
    + u32 hflags = vcpu->arch.hflags;
    if (events->smi.smm)
    - vcpu->arch.hflags |= HF_SMM_MASK;
    + hflags |= HF_SMM_MASK;
    else
    - vcpu->arch.hflags &= ~HF_SMM_MASK;
    + hflags &= ~HF_SMM_MASK;
    + kvm_set_hflags(vcpu, hflags);
    +
    vcpu->arch.smi_pending = events->smi.pending;
    if (events->smi.smm_inside_nmi)
    vcpu->arch.hflags |= HF_SMM_INSIDE_NMI_MASK;
    diff --git a/drivers/base/power/power.h b/drivers/base/power/power.h
    index 50e30e7b059d..a84332aefc2d 100644
    --- a/drivers/base/power/power.h
    +++ b/drivers/base/power/power.h
    @@ -21,14 +21,22 @@ extern void pm_runtime_init(struct device *dev);
    extern void pm_runtime_reinit(struct device *dev);
    extern void pm_runtime_remove(struct device *dev);

    +#define WAKE_IRQ_DEDICATED_ALLOCATED BIT(0)
    +#define WAKE_IRQ_DEDICATED_MANAGED BIT(1)
    +#define WAKE_IRQ_DEDICATED_MASK (WAKE_IRQ_DEDICATED_ALLOCATED | \
    + WAKE_IRQ_DEDICATED_MANAGED)
    +
    struct wake_irq {
    struct device *dev;
    + unsigned int status;
    int irq;
    - bool dedicated_irq:1;
    };

    extern void dev_pm_arm_wake_irq(struct wake_irq *wirq);
    extern void dev_pm_disarm_wake_irq(struct wake_irq *wirq);
    +extern void dev_pm_enable_wake_irq_check(struct device *dev,
    + bool can_change_status);
    +extern void dev_pm_disable_wake_irq_check(struct device *dev);

    #ifdef CONFIG_PM_SLEEP

    @@ -104,6 +112,15 @@ static inline void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
    {
    }

    +static inline void dev_pm_enable_wake_irq_check(struct device *dev,
    + bool can_change_status)
    +{
    +}
    +
    +static inline void dev_pm_disable_wake_irq_check(struct device *dev)
    +{
    +}
    +
    #endif

    #ifdef CONFIG_PM_SLEEP
    diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
    index 82a081ea4317..23f3b95a1158 100644
    --- a/drivers/base/power/runtime.c
    +++ b/drivers/base/power/runtime.c
    @@ -515,7 +515,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)

    callback = RPM_GET_CALLBACK(dev, runtime_suspend);

    - dev_pm_enable_wake_irq(dev);
    + dev_pm_enable_wake_irq_check(dev, true);
    retval = rpm_callback(callback, dev);
    if (retval)
    goto fail;
    @@ -554,7 +554,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
    return retval;

    fail:
    - dev_pm_disable_wake_irq(dev);
    + dev_pm_disable_wake_irq_check(dev);
    __update_runtime_status(dev, RPM_ACTIVE);
    dev->power.deferred_resume = false;
    wake_up_all(&dev->power.wait_queue);
    @@ -737,12 +737,12 @@ static int rpm_resume(struct device *dev, int rpmflags)

    callback = RPM_GET_CALLBACK(dev, runtime_resume);

    - dev_pm_disable_wake_irq(dev);
    + dev_pm_disable_wake_irq_check(dev);
    retval = rpm_callback(callback, dev);
    if (retval) {
    __update_runtime_status(dev, RPM_SUSPENDED);
    pm_runtime_cancel_pending(dev);
    - dev_pm_enable_wake_irq(dev);
    + dev_pm_enable_wake_irq_check(dev, false);
    } else {
    no_callback:
    __update_runtime_status(dev, RPM_ACTIVE);
    diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
    index 0d77cd6fd8d1..404d94c6c8bc 100644
    --- a/drivers/base/power/wakeirq.c
    +++ b/drivers/base/power/wakeirq.c
    @@ -110,8 +110,10 @@ void dev_pm_clear_wake_irq(struct device *dev)
    dev->power.wakeirq = NULL;
    spin_unlock_irqrestore(&dev->power.lock, flags);

    - if (wirq->dedicated_irq)
    + if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) {
    free_irq(wirq->irq, wirq);
    + wirq->status &= ~WAKE_IRQ_DEDICATED_MASK;
    + }
    kfree(wirq);
    }
    EXPORT_SYMBOL_GPL(dev_pm_clear_wake_irq);
    @@ -179,7 +181,6 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)

    wirq->dev = dev;
    wirq->irq = irq;
    - wirq->dedicated_irq = true;
    irq_set_status_flags(irq, IRQ_NOAUTOEN);

    /*
    @@ -195,6 +196,8 @@ int dev_pm_set_dedicated_wake_irq(struct device *dev, int irq)
    if (err)
    goto err_free_irq;

    + wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED;
    +
    return err;

    err_free_irq:
    @@ -210,9 +213,9 @@ EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_wake_irq);
    * dev_pm_enable_wake_irq - Enable device wake-up interrupt
    * @dev: Device
    *
    - * Called from the bus code or the device driver for
    - * runtime_suspend() to enable the wake-up interrupt while
    - * the device is running.
    + * Optionally called from the bus code or the device driver for
    + * runtime_resume() to override the PM runtime core managed wake-up
    + * interrupt handling to enable the wake-up interrupt.
    *
    * Note that for runtime_suspend()) the wake-up interrupts
    * should be unconditionally enabled unlike for suspend()
    @@ -222,7 +225,7 @@ void dev_pm_enable_wake_irq(struct device *dev)
    {
    struct wake_irq *wirq = dev->power.wakeirq;

    - if (wirq && wirq->dedicated_irq)
    + if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED))
    enable_irq(wirq->irq);
    }
    EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq);
    @@ -231,20 +234,73 @@ EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq);
    * dev_pm_disable_wake_irq - Disable device wake-up interrupt
    * @dev: Device
    *
    - * Called from the bus code or the device driver for
    - * runtime_resume() to disable the wake-up interrupt while
    - * the device is running.
    + * Optionally called from the bus code or the device driver for
    + * runtime_suspend() to override the PM runtime core managed wake-up
    + * interrupt handling to disable the wake-up interrupt.
    */
    void dev_pm_disable_wake_irq(struct device *dev)
    {
    struct wake_irq *wirq = dev->power.wakeirq;

    - if (wirq && wirq->dedicated_irq)
    + if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED))
    disable_irq_nosync(wirq->irq);
    }
    EXPORT_SYMBOL_GPL(dev_pm_disable_wake_irq);

    /**
    + * dev_pm_enable_wake_irq_check - Checks and enables wake-up interrupt
    + * @dev: Device
    + * @can_change_status: Can change wake-up interrupt status
    + *
    + * Enables wakeirq conditionally. We need to enable wake-up interrupt
    + * lazily on the first rpm_suspend(). This is needed as the consumer device
    + * starts in RPM_SUSPENDED state, and the the first pm_runtime_get() would
    + * otherwise try to disable already disabled wakeirq. The wake-up interrupt
    + * starts disabled with IRQ_NOAUTOEN set.
    + *
    + * Should be only called from rpm_suspend() and rpm_resume() path.
    + * Caller must hold &dev->power.lock to change wirq->status
    + */
    +void dev_pm_enable_wake_irq_check(struct device *dev,
    + bool can_change_status)
    +{
    + struct wake_irq *wirq = dev->power.wakeirq;
    +
    + if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK)))
    + return;
    +
    + if (likely(wirq->status & WAKE_IRQ_DEDICATED_MANAGED)) {
    + goto enable;
    + } else if (can_change_status) {
    + wirq->status |= WAKE_IRQ_DEDICATED_MANAGED;
    + goto enable;
    + }
    +
    + return;
    +
    +enable:
    + enable_irq(wirq->irq);
    +}
    +
    +/**
    + * dev_pm_disable_wake_irq_check - Checks and disables wake-up interrupt
    + * @dev: Device
    + *
    + * Disables wake-up interrupt conditionally based on status.
    + * Should be only called from rpm_suspend() and rpm_resume() path.
    + */
    +void dev_pm_disable_wake_irq_check(struct device *dev)
    +{
    + struct wake_irq *wirq = dev->power.wakeirq;
    +
    + if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK)))
    + return;
    +
    + if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED)
    + disable_irq_nosync(wirq->irq);
    +}
    +
    +/**
    * dev_pm_arm_wake_irq - Arm device wake-up
    * @wirq: Device wake-up interrupt
    *
    diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
    index e3bf31b37138..a1ce0607bf7b 100644
    --- a/drivers/char/tpm/tpm_tis_core.c
    +++ b/drivers/char/tpm/tpm_tis_core.c
    @@ -185,7 +185,12 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
    TPM_STS_DATA_AVAIL | TPM_STS_VALID,
    chip->timeout_c,
    &priv->read_queue, true) == 0) {
    - burstcnt = min_t(int, get_burstcount(chip), count - size);
    + burstcnt = get_burstcount(chip);
    + if (burstcnt < 0) {
    + dev_err(&chip->dev, "Unable to read burstcount\n");
    + return burstcnt;
    + }
    + burstcnt = min_t(int, burstcnt, count - size);

    rc = tpm_tis_read_bytes(priv, TPM_DATA_FIFO(priv->locality),
    burstcnt, buf + size);
    @@ -271,7 +276,13 @@ static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)
    }

    while (count < len - 1) {
    - burstcnt = min_t(int, get_burstcount(chip), len - count - 1);
    + burstcnt = get_burstcount(chip);
    + if (burstcnt < 0) {
    + dev_err(&chip->dev, "Unable to read burstcount\n");
    + rc = burstcnt;
    + goto out_err;
    + }
    + burstcnt = min_t(int, burstcnt, len - count - 1);
    rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
    burstcnt, buf + count);
    if (rc < 0)
    diff --git a/drivers/clk/clk-wm831x.c b/drivers/clk/clk-wm831x.c
    index f4fdac55727c..0621fbfb4beb 100644
    --- a/drivers/clk/clk-wm831x.c
    +++ b/drivers/clk/clk-wm831x.c
    @@ -243,7 +243,7 @@ static int wm831x_clkout_is_prepared(struct clk_hw *hw)
    if (ret < 0) {
    dev_err(wm831x->dev, "Unable to read CLOCK_CONTROL_1: %d\n",
    ret);
    - return true;
    + return false;
    }

    return (ret & WM831X_CLKOUT_ENA) != 0;
    diff --git a/drivers/clk/imx/clk-imx31.c b/drivers/clk/imx/clk-imx31.c
    index 6a964144a5b5..6a49ba2b9671 100644
    --- a/drivers/clk/imx/clk-imx31.c
    +++ b/drivers/clk/imx/clk-imx31.c
    @@ -157,10 +157,8 @@ static void __init _mx31_clocks_init(unsigned long fref)
    }
    }

    -int __init mx31_clocks_init(void)
    +int __init mx31_clocks_init(unsigned long fref)
    {
    - u32 fref = 26000000; /* default */
    -
    _mx31_clocks_init(fref);

    clk_register_clkdev(clk[gpt_gate], "per", "imx-gpt.0");
    diff --git a/drivers/clk/qcom/gcc-ipq806x.c b/drivers/clk/qcom/gcc-ipq806x.c
    index 52a7d3959875..28eb200d0f1e 100644
    --- a/drivers/clk/qcom/gcc-ipq806x.c
    +++ b/drivers/clk/qcom/gcc-ipq806x.c
    @@ -2990,11 +2990,11 @@ static int gcc_ipq806x_probe(struct platform_device *pdev)
    struct regmap *regmap;
    int ret;

    - ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 19200000);
    + ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 25000000);
    if (ret)
    return ret;

    - ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 27000000);
    + ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 25000000);
    if (ret)
    return ret;

    diff --git a/drivers/clk/renesas/clk-mstp.c b/drivers/clk/renesas/clk-mstp.c
    index 9375777776d9..b533f99550e1 100644
    --- a/drivers/clk/renesas/clk-mstp.c
    +++ b/drivers/clk/renesas/clk-mstp.c
    @@ -37,12 +37,14 @@
    * @smstpcr: module stop control register
    * @mstpsr: module stop status register (optional)
    * @lock: protects writes to SMSTPCR
    + * @width_8bit: registers are 8-bit, not 32-bit
    */
    struct mstp_clock_group {
    struct clk_onecell_data data;
    void __iomem *smstpcr;
    void __iomem *mstpsr;
    spinlock_t lock;
    + bool width_8bit;
    };

    /**
    @@ -59,6 +61,18 @@ struct mstp_clock {

    #define to_mstp_clock(_hw) container_of(_hw, struct mstp_clock, hw)

    +static inline u32 cpg_mstp_read(struct mstp_clock_group *group,
    + u32 __iomem *reg)
    +{
    + return group->width_8bit ? readb(reg) : clk_readl(reg);
    +}
    +
    +static inline void cpg_mstp_write(struct mstp_clock_group *group, u32 val,
    + u32 __iomem *reg)
    +{
    + group->width_8bit ? writeb(val, reg) : clk_writel(val, reg);
    +}
    +
    static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable)
    {
    struct mstp_clock *clock = to_mstp_clock(hw);
    @@ -70,12 +84,12 @@ static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable)

    spin_lock_irqsave(&group->lock, flags);

    - value = clk_readl(group->smstpcr);
    + value = cpg_mstp_read(group, group->smstpcr);
    if (enable)
    value &= ~bitmask;
    else
    value |= bitmask;
    - clk_writel(value, group->smstpcr);
    + cpg_mstp_write(group, value, group->smstpcr);

    spin_unlock_irqrestore(&group->lock, flags);

    @@ -83,7 +97,7 @@ static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable)
    return 0;

    for (i = 1000; i > 0; --i) {
    - if (!(clk_readl(group->mstpsr) & bitmask))
    + if (!(cpg_mstp_read(group, group->mstpsr) & bitmask))
    break;
    cpu_relax();
    }
    @@ -114,9 +128,9 @@ static int cpg_mstp_clock_is_enabled(struct clk_hw *hw)
    u32 value;

    if (group->mstpsr)
    - value = clk_readl(group->mstpsr);
    + value = cpg_mstp_read(group, group->mstpsr);
    else
    - value = clk_readl(group->smstpcr);
    + value = cpg_mstp_read(group, group->smstpcr);

    return !(value & BIT(clock->bit_index));
    }
    @@ -188,6 +202,9 @@ static void __init cpg_mstp_clocks_init(struct device_node *np)
    return;
    }

    + if (of_device_is_compatible(np, "renesas,r7s72100-mstp-clocks"))
    + group->width_8bit = true;
    +
    for (i = 0; i < MSTP_MAX_CLOCKS; ++i)
    clks[i] = ERR_PTR(-ENOENT);

    diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c
    index e1365e7491ae..25c41cd9cdfc 100644
    --- a/drivers/clk/renesas/renesas-cpg-mssr.c
    +++ b/drivers/clk/renesas/renesas-cpg-mssr.c
    @@ -33,9 +33,9 @@
    #include "clk-div6.h"

    #ifdef DEBUG
    -#define WARN_DEBUG(x) do { } while (0)
    -#else
    #define WARN_DEBUG(x) WARN_ON(x)
    +#else
    +#define WARN_DEBUG(x) do { } while (0)
    #endif


    diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
    index 2646d980087b..5c6d37bdf247 100644
    --- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
    +++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
    @@ -344,10 +344,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4,
    static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
    "pll-audio-2x", "pll-audio" };
    static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
    - 0x0b0, 16, 2, BIT(31), 0);
    + 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
    - 0x0b4, 16, 2, BIT(31), 0);
    + 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);

    /* TODO: the parent for most of the USB clocks is not known */
    static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
    @@ -415,7 +415,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve",
    0x13c, 16, 3, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio",
    - 0x140, BIT(31), 0);
    + 0x140, BIT(31), CLK_SET_RATE_PARENT);
    static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M",
    0x144, BIT(31), 0);

    diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
    index 4d70590f05e3..21c427d86f28 100644
    --- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
    +++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
    @@ -394,16 +394,16 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4,
    static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
    "pll-audio-2x", "pll-audio" };
    static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
    - 0x0b0, 16, 2, BIT(31), 0);
    + 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
    - 0x0b4, 16, 2, BIT(31), 0);
    + 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_MUX_WITH_GATE(i2s2_clk, "i2s2", i2s_parents,
    - 0x0b8, 16, 2, BIT(31), 0);
    + 0x0b8, 16, 2, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_M_WITH_GATE(spdif_clk, "spdif", "pll-audio",
    - 0x0c0, 0, 4, BIT(31), 0);
    + 0x0c0, 0, 4, BIT(31), CLK_SET_RATE_PARENT);

    static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
    0x0cc, BIT(8), 0);
    @@ -466,7 +466,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve",
    0x13c, 16, 3, BIT(31), 0);

    static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio",
    - 0x140, BIT(31), 0);
    + 0x140, BIT(31), CLK_SET_RATE_PARENT);
    static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M",
    0x144, BIT(31), 0);

    diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
    index bfa17d33ef3b..9fd6043314eb 100644
    --- a/drivers/clk/ti/clk-7xx.c
    +++ b/drivers/clk/ti/clk-7xx.c
    @@ -201,7 +201,6 @@ static struct ti_dt_clk dra7xx_clks[] = {
    DT_CLK(NULL, "atl_dpll_clk_mux", "atl_dpll_clk_mux"),
    DT_CLK(NULL, "atl_gfclk_mux", "atl_gfclk_mux"),
    DT_CLK(NULL, "dcan1_sys_clk_mux", "dcan1_sys_clk_mux"),
    - DT_CLK(NULL, "gmac_gmii_ref_clk_div", "gmac_gmii_ref_clk_div"),
    DT_CLK(NULL, "gmac_rft_clk_mux", "gmac_rft_clk_mux"),
    DT_CLK(NULL, "gpu_core_gclk_mux", "gpu_core_gclk_mux"),
    DT_CLK(NULL, "gpu_hyd_gclk_mux", "gpu_hyd_gclk_mux"),
    diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
    index 1ac199cd75e7..a4944e22f294 100644
    --- a/drivers/firmware/efi/efi.c
    +++ b/drivers/firmware/efi/efi.c
    @@ -259,8 +259,10 @@ static __init int efivar_ssdt_load(void)
    }

    data = kmalloc(size, GFP_KERNEL);
    - if (!data)
    + if (!data) {
    + ret = -ENOMEM;
    goto free_entry;
    + }

    ret = efivar_entry_get(entry, NULL, &size, data);
    if (ret) {
    diff --git a/drivers/gpu/drm/i915/i915_gem_request.h b/drivers/gpu/drm/i915/i915_gem_request.h
    index 974bd7bcc801..59ac90025552 100644
    --- a/drivers/gpu/drm/i915/i915_gem_request.h
    +++ b/drivers/gpu/drm/i915/i915_gem_request.h
    @@ -344,6 +344,25 @@ i915_gem_active_set(struct i915_gem_active *active,
    rcu_assign_pointer(active->request, request);
    }

    +/**
    + * i915_gem_active_set_retire_fn - updates the retirement callback
    + * @active - the active tracker
    + * @fn - the routine called when the request is retired
    + * @mutex - struct_mutex used to guard retirements
    + *
    + * i915_gem_active_set_retire_fn() updates the function pointer that
    + * is called when the final request associated with the @active tracker
    + * is retired.
    + */
    +static inline void
    +i915_gem_active_set_retire_fn(struct i915_gem_active *active,
    + i915_gem_retire_fn fn,
    + struct mutex *mutex)
    +{
    + lockdep_assert_held(mutex);
    + active->retire = fn ?: i915_gem_retire_noop;
    +}
    +
    static inline struct drm_i915_gem_request *
    __i915_gem_active_peek(const struct i915_gem_active *active)
    {
    diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
    index bf344d08356a..055525013d2f 100644
    --- a/drivers/gpu/drm/i915/intel_dp.c
    +++ b/drivers/gpu/drm/i915/intel_dp.c
    @@ -280,7 +280,8 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,
    struct intel_dp *intel_dp);
    static void
    intel_dp_init_panel_power_sequencer_registers(struct drm_device *dev,
    - struct intel_dp *intel_dp);
    + struct intel_dp *intel_dp,
    + bool force_disable_vdd);
    static void
    intel_dp_pps_init(struct drm_device *dev, struct intel_dp *intel_dp);

    @@ -442,7 +443,7 @@ vlv_power_sequencer_pipe(struct intel_dp *intel_dp)

    /* init power sequencer on this pipe and port */
    intel_dp_init_panel_power_sequencer(dev, intel_dp);
    - intel_dp_init_panel_power_sequencer_registers(dev, intel_dp);
    + intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, true);

    /*
    * Even vdd force doesn't work until we've made
    @@ -479,7 +480,7 @@ bxt_power_sequencer_idx(struct intel_dp *intel_dp)
    * Only the HW needs to be reprogrammed, the SW state is fixed and
    * has been setup during connector init.
    */
    - intel_dp_init_panel_power_sequencer_registers(dev, intel_dp);
    + intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, false);

    return 0;
    }
    @@ -562,7 +563,7 @@ vlv_initial_power_sequencer_setup(struct intel_dp *intel_dp)
    port_name(port), pipe_name(intel_dp->pps_pipe));

    intel_dp_init_panel_power_sequencer(dev, intel_dp);
    - intel_dp_init_panel_power_sequencer_registers(dev, intel_dp);
    + intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, false);
    }

    void intel_power_sequencer_reset(struct drm_i915_private *dev_priv)
    @@ -2924,7 +2925,7 @@ static void vlv_init_panel_power_sequencer(struct intel_dp *intel_dp)

    /* init power sequencer on this pipe and port */
    intel_dp_init_panel_power_sequencer(dev, intel_dp);
    - intel_dp_init_panel_power_sequencer_registers(dev, intel_dp);
    + intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, true);
    }

    static void vlv_pre_enable_dp(struct intel_encoder *encoder,
    @@ -4017,6 +4018,11 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
    if (!to_intel_crtc(intel_encoder->base.crtc)->active)
    return;

    + /* FIXME: we need to synchronize this sort of stuff with hardware
    + * readout. Currently fast link training doesn't work on boot-up. */
    + if (!intel_dp->lane_count)
    + return;
    +
    /* if link training is requested we should perform it always */
    if ((intel_dp->compliance_test_type == DP_TEST_LINK_TRAINING) ||
    (!drm_dp_channel_eq_ok(link_status, intel_dp->lane_count))) {
    @@ -5054,7 +5060,8 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,

    static void
    intel_dp_init_panel_power_sequencer_registers(struct drm_device *dev,
    - struct intel_dp *intel_dp)
    + struct intel_dp *intel_dp,
    + bool force_disable_vdd)
    {
    struct drm_i915_private *dev_priv = to_i915(dev);
    u32 pp_on, pp_off, pp_div, port_sel = 0;
    @@ -5067,6 +5074,31 @@ intel_dp_init_panel_power_sequencer_registers(struct drm_device *dev,

    intel_pps_get_registers(dev_priv, intel_dp, &regs);

    + /*
    + * On some VLV machines the BIOS can leave the VDD
    + * enabled even on power seqeuencers which aren't
    + * hooked up to any port. This would mess up the
    + * power domain tracking the first time we pick
    + * one of these power sequencers for use since
    + * edp_panel_vdd_on() would notice that the VDD was
    + * already on and therefore wouldn't grab the power
    + * domain reference. Disable VDD first to avoid this.
    + * This also avoids spuriously turning the VDD on as
    + * soon as the new power seqeuencer gets initialized.
    + */
    + if (force_disable_vdd) {
    + u32 pp = ironlake_get_pp_control(intel_dp);
    +
    + WARN(pp & PANEL_POWER_ON, "Panel power already on\n");
    +
    + if (pp & EDP_FORCE_VDD)
    + DRM_DEBUG_KMS("VDD already on, disabling first\n");
    +
    + pp &= ~EDP_FORCE_VDD;
    +
    + I915_WRITE(regs.pp_ctrl, pp);
    + }
    +
    pp_on = (seq->t1_t3 << PANEL_POWER_UP_DELAY_SHIFT) |
    (seq->t8 << PANEL_LIGHT_ON_DELAY_SHIFT);
    pp_off = (seq->t9 << PANEL_LIGHT_OFF_DELAY_SHIFT) |
    @@ -5119,7 +5151,7 @@ static void intel_dp_pps_init(struct drm_device *dev,
    vlv_initial_power_sequencer_setup(intel_dp);
    } else {
    intel_dp_init_panel_power_sequencer(dev, intel_dp);
    - intel_dp_init_panel_power_sequencer_registers(dev, intel_dp);
    + intel_dp_init_panel_power_sequencer_registers(dev, intel_dp, false);
    }
    }

    diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
    index a24bc8c7889f..a2655cd5a84e 100644
    --- a/drivers/gpu/drm/i915/intel_overlay.c
    +++ b/drivers/gpu/drm/i915/intel_overlay.c
    @@ -216,7 +216,8 @@ static void intel_overlay_submit_request(struct intel_overlay *overlay,
    {
    GEM_BUG_ON(i915_gem_active_peek(&overlay->last_flip,
    &overlay->i915->drm.struct_mutex));
    - overlay->last_flip.retire = retire;
    + i915_gem_active_set_retire_fn(&overlay->last_flip, retire,
    + &overlay->i915->drm.struct_mutex);
    i915_gem_active_set(&overlay->last_flip, req);
    i915_add_request(req);
    }
    @@ -839,8 +840,8 @@ static int intel_overlay_do_put_image(struct intel_overlay *overlay,
    if (ret)
    goto out_unpin;

    - i915_gem_track_fb(overlay->vma->obj, new_bo,
    - INTEL_FRONTBUFFER_OVERLAY(pipe));
    + i915_gem_track_fb(overlay->vma ? overlay->vma->obj : NULL,
    + vma->obj, INTEL_FRONTBUFFER_OVERLAY(pipe));

    overlay->old_vma = overlay->vma;
    overlay->vma = vma;
    @@ -1430,6 +1431,8 @@ void intel_setup_overlay(struct drm_i915_private *dev_priv)
    overlay->contrast = 75;
    overlay->saturation = 146;

    + init_request_active(&overlay->last_flip, NULL);
    +
    regs = intel_overlay_map_regs(overlay);
    if (!regs)
    goto out_unpin_bo;
    diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    index db24f898853c..103cefdb9ddd 100644
    --- a/drivers/gpu/drm/i915/intel_pm.c
    +++ b/drivers/gpu/drm/i915/intel_pm.c
    @@ -2879,6 +2879,21 @@ skl_wm_plane_id(const struct intel_plane *plane)
    }
    }

    +/*
    + * FIXME: We still don't have the proper code detect if we need to apply the WA,
    + * so assume we'll always need it in order to avoid underruns.
    + */
    +static bool skl_needs_memory_bw_wa(struct intel_atomic_state *state)
    +{
    + struct drm_i915_private *dev_priv = to_i915(state->base.dev);
    +
    + if (IS_SKYLAKE(dev_priv) || IS_BROXTON(dev_priv) ||
    + IS_KABYLAKE(dev_priv))
    + return true;
    +
    + return false;
    +}
    +
    static bool
    intel_has_sagv(struct drm_i915_private *dev_priv)
    {
    @@ -2999,9 +3014,10 @@ bool intel_can_enable_sagv(struct drm_atomic_state *state)
    struct drm_device *dev = state->dev;
    struct drm_i915_private *dev_priv = to_i915(dev);
    struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
    - struct drm_crtc *crtc;
    + struct intel_crtc *crtc;
    + struct intel_plane *plane;
    enum pipe pipe;
    - int level, plane;
    + int level, id, latency;

    if (!intel_has_sagv(dev_priv))
    return false;
    @@ -3019,27 +3035,36 @@ bool intel_can_enable_sagv(struct drm_atomic_state *state)

    /* Since we're now guaranteed to only have one active CRTC... */
    pipe = ffs(intel_state->active_crtcs) - 1;
    - crtc = dev_priv->pipe_to_crtc_mapping[pipe];
    + crtc = to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);

    - if (crtc->state->mode.flags & DRM_MODE_FLAG_INTERLACE)
    + if (crtc->base.state->mode.flags & DRM_MODE_FLAG_INTERLACE)
    return false;

    - for_each_plane(dev_priv, pipe, plane) {
    + for_each_intel_plane_on_crtc(dev, crtc, plane) {
    + id = skl_wm_plane_id(plane);
    +
    /* Skip this plane if it's not enabled */
    - if (intel_state->wm_results.plane[pipe][plane][0] == 0)
    + if (intel_state->wm_results.plane[pipe][id][0] == 0)
    continue;

    /* Find the highest enabled wm level for this plane */
    for (level = ilk_wm_max_level(dev);
    - intel_state->wm_results.plane[pipe][plane][level] == 0; --level)
    + intel_state->wm_results.plane[pipe][id][level] == 0; --level)
    { }

    + latency = dev_priv->wm.skl_latency[level];
    +
    + if (skl_needs_memory_bw_wa(intel_state) &&
    + plane->base.state->fb->modifier[0] ==
    + I915_FORMAT_MOD_X_TILED)
    + latency += 15;
    +
    /*
    * If any of the planes on this pipe don't enable wm levels
    * that incur memory latencies higher then 30µs we can't enable
    * the SAGV
    */
    - if (dev_priv->wm.skl_latency[level] < SKL_SAGV_BLOCK_TIME)
    + if (latency < SKL_SAGV_BLOCK_TIME)
    return false;
    }

    @@ -3549,12 +3574,18 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
    uint32_t width = 0, height = 0;
    uint32_t plane_pixel_rate;
    uint32_t y_tile_minimum, y_min_scanlines;
    + struct intel_atomic_state *state =
    + to_intel_atomic_state(cstate->base.state);
    + bool apply_memory_bw_wa = skl_needs_memory_bw_wa(state);

    if (latency == 0 || !cstate->base.active || !intel_pstate->base.visible) {
    *enabled = false;
    return 0;
    }

    + if (apply_memory_bw_wa && fb->modifier[0] == I915_FORMAT_MOD_X_TILED)
    + latency += 15;
    +
    width = drm_rect_width(&intel_pstate->base.src) >> 16;
    height = drm_rect_height(&intel_pstate->base.src) >> 16;

    @@ -3586,6 +3617,9 @@ static int skl_compute_plane_wm(const struct drm_i915_private *dev_priv,
    y_min_scanlines = 4;
    }

    + if (apply_memory_bw_wa)
    + y_min_scanlines *= 2;
    +
    plane_bytes_per_line = width * cpp;
    if (fb->modifier[0] == I915_FORMAT_MOD_Y_TILED ||
    fb->modifier[0] == I915_FORMAT_MOD_Yf_TILED) {
    diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
    index 108ba1e5d658..9b307cee3008 100644
    --- a/drivers/gpu/drm/i915/intel_psr.c
    +++ b/drivers/gpu/drm/i915/intel_psr.c
    @@ -825,13 +825,9 @@ void intel_psr_init(struct drm_device *dev)
    dev_priv->psr_mmio_base = IS_HASWELL(dev_priv) ?
    HSW_EDP_PSR_BASE : BDW_EDP_PSR_BASE;

    - /* Per platform default */
    - if (i915.enable_psr == -1) {
    - if (IS_HASWELL(dev) || IS_BROADWELL(dev))
    - i915.enable_psr = 1;
    - else
    - i915.enable_psr = 0;
    - }
    + /* Per platform default: all disabled. */
    + if (i915.enable_psr == -1)
    + i915.enable_psr = 0;

    /* Set link_standby x link_off defaults */
    if (IS_HASWELL(dev) || IS_BROADWELL(dev))
    diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
    index 87a72476d313..fb16070b266e 100644
    --- a/drivers/gpu/drm/radeon/radeon_cursor.c
    +++ b/drivers/gpu/drm/radeon/radeon_cursor.c
    @@ -146,6 +146,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    int xorigin = 0, yorigin = 0;
    int w = radeon_crtc->cursor_width;

    + radeon_crtc->cursor_x = x;
    + radeon_crtc->cursor_y = y;
    +
    if (ASIC_IS_AVIVO(rdev)) {
    /* avivo cursor are offset into the total surface */
    x += crtc->x;
    @@ -240,9 +243,6 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
    yorigin * 256);
    }

    - radeon_crtc->cursor_x = x;
    - radeon_crtc->cursor_y = y;
    -
    if (radeon_crtc->cursor_out_of_bounds) {
    radeon_crtc->cursor_out_of_bounds = false;
    if (radeon_crtc->cursor_bo)
    diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
    index 60875625cbdf..8f6c35370f66 100644
    --- a/drivers/hid/hid-sensor-hub.c
    +++ b/drivers/hid/hid-sensor-hub.c
    @@ -212,7 +212,6 @@ int sensor_hub_set_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
    __s32 value;
    int ret = 0;

    - memset(buffer, 0, buffer_size);
    mutex_lock(&data->mutex);
    report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
    if (!report || (field_index >= report->maxfield)) {
    @@ -256,6 +255,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
    int buffer_index = 0;
    int i;

    + memset(buffer, 0, buffer_size);
    +
    mutex_lock(&data->mutex);
    report = sensor_hub_report(report_id, hsdev->hdev, HID_FEATURE_REPORT);
    if (!report || (field_index >= report->maxfield) ||
    diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
    index 12e851a5af48..46b4e35fd555 100644
    --- a/drivers/hwmon/amc6821.c
    +++ b/drivers/hwmon/amc6821.c
    @@ -188,8 +188,8 @@ static struct amc6821_data *amc6821_update_device(struct device *dev)
    !data->valid) {

    for (i = 0; i < TEMP_IDX_LEN; i++)
    - data->temp[i] = i2c_smbus_read_byte_data(client,
    - temp_reg[i]);
    + data->temp[i] = (int8_t)i2c_smbus_read_byte_data(
    + client, temp_reg[i]);

    data->stat1 = i2c_smbus_read_byte_data(client,
    AMC6821_REG_STAT1);
    diff --git a/drivers/hwmon/ds620.c b/drivers/hwmon/ds620.c
    index edf550fc4eef..0043a4c02b85 100644
    --- a/drivers/hwmon/ds620.c
    +++ b/drivers/hwmon/ds620.c
    @@ -166,7 +166,7 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *da,
    if (res)
    return res;

    - val = (val * 10 / 625) * 8;
    + val = (clamp_val(val, -128000, 128000) * 10 / 625) * 8;

    mutex_lock(&data->update_lock);
    data->temp[attr->index] = val;
    diff --git a/drivers/hwmon/g762.c b/drivers/hwmon/g762.c
    index b96a2a9e4df7..628be9c95ff9 100644
    --- a/drivers/hwmon/g762.c
    +++ b/drivers/hwmon/g762.c
    @@ -193,14 +193,17 @@ static inline unsigned int rpm_from_cnt(u8 cnt, u32 clk_freq, u16 p,
    * Convert fan RPM value from sysfs into count value for fan controller
    * register (FAN_SET_CNT).
    */
    -static inline unsigned char cnt_from_rpm(u32 rpm, u32 clk_freq, u16 p,
    +static inline unsigned char cnt_from_rpm(unsigned long rpm, u32 clk_freq, u16 p,
    u8 clk_div, u8 gear_mult)
    {
    - if (!rpm) /* to stop the fan, set cnt to 255 */
    + unsigned long f1 = clk_freq * 30 * gear_mult;
    + unsigned long f2 = p * clk_div;
    +
    + if (!rpm) /* to stop the fan, set cnt to 255 */
    return 0xff;

    - return clamp_val(((clk_freq * 30 * gear_mult) / (rpm * p * clk_div)),
    - 0, 255);
    + rpm = clamp_val(rpm, f1 / (255 * f2), ULONG_MAX / f2);
    + return DIV_ROUND_CLOSEST(f1, rpm * f2);
    }

    /* helper to grab and cache data, at most one time per second */
    diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
    index 322ed9272811..841f2428e84a 100644
    --- a/drivers/hwmon/lm90.c
    +++ b/drivers/hwmon/lm90.c
    @@ -1036,7 +1036,7 @@ static const u8 lm90_temp_emerg_index[3] = {
    };

    static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 };
    -static const u8 lm90_max_alarm_bits[3] = { 0, 4, 12 };
    +static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 };
    static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 };
    static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 };
    static const u8 lm90_fault_bits[3] = { 0, 2, 10 };
    diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
    index 3ce33d244cc0..12b94b094c0d 100644
    --- a/drivers/hwmon/nct7802.c
    +++ b/drivers/hwmon/nct7802.c
    @@ -259,13 +259,15 @@ static int nct7802_read_fan_min(struct nct7802_data *data, u8 reg_fan_low,
    ret = 0;
    else if (ret)
    ret = DIV_ROUND_CLOSEST(1350000U, ret);
    + else
    + ret = 1350000U;
    abort:
    mutex_unlock(&data->access_lock);
    return ret;
    }

    static int nct7802_write_fan_min(struct nct7802_data *data, u8 reg_fan_low,
    - u8 reg_fan_high, unsigned int limit)
    + u8 reg_fan_high, unsigned long limit)
    {
    int err;

    @@ -326,8 +328,8 @@ static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
    int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
    int err;

    + voltage = clamp_val(voltage, 0, 0x3ff * nct7802_vmul[nr]);
    voltage = DIV_ROUND_CLOSEST(voltage, nct7802_vmul[nr]);
    - voltage = clamp_val(voltage, 0, 0x3ff);

    mutex_lock(&data->access_lock);
    err = regmap_write(data->regmap,
    @@ -402,7 +404,7 @@ static ssize_t store_temp(struct device *dev, struct device_attribute *attr,
    if (err < 0)
    return err;

    - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127);
    + val = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000);

    err = regmap_write(data->regmap, nr, val & 0xff);
    return err ? : count;
    diff --git a/drivers/hwmon/scpi-hwmon.c b/drivers/hwmon/scpi-hwmon.c
    index 559a3dcd64d8..094f948f99ff 100644
    --- a/drivers/hwmon/scpi-hwmon.c
    +++ b/drivers/hwmon/scpi-hwmon.c
    @@ -251,6 +251,7 @@ static const struct of_device_id scpi_of_match[] = {
    {.compatible = "arm,scpi-sensors"},
    {},
    };
    +MODULE_DEVICE_TABLE(of, scpi_of_match);

    static struct platform_driver scpi_hwmon_platdrv = {
    .driver = {
    diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
    index ce69048c88e9..3a557e3181ea 100644
    --- a/drivers/iio/accel/st_accel_core.c
    +++ b/drivers/iio/accel/st_accel_core.c
    @@ -154,8 +154,8 @@
    #define ST_ACCEL_4_FS_MASK 0x80
    #define ST_ACCEL_4_FS_AVL_2_VAL 0X00
    #define ST_ACCEL_4_FS_AVL_6_VAL 0X01
    -#define ST_ACCEL_4_FS_AVL_2_GAIN IIO_G_TO_M_S_2(1024)
    -#define ST_ACCEL_4_FS_AVL_6_GAIN IIO_G_TO_M_S_2(340)
    +#define ST_ACCEL_4_FS_AVL_2_GAIN IIO_G_TO_M_S_2(1000)
    +#define ST_ACCEL_4_FS_AVL_6_GAIN IIO_G_TO_M_S_2(3000)
    #define ST_ACCEL_4_BDU_ADDR 0x21
    #define ST_ACCEL_4_BDU_MASK 0x40
    #define ST_ACCEL_4_DRDY_IRQ_ADDR 0x21
    @@ -346,6 +346,14 @@ static const struct st_sensor_settings st_accel_sensors_settings[] = {
    .addr = ST_ACCEL_1_BDU_ADDR,
    .mask = ST_ACCEL_1_BDU_MASK,
    },
    + /*
    + * Data Alignment Setting - needs to be set to get
    + * left-justified data like all other sensors.
    + */
    + .das = {
    + .addr = 0x21,
    + .mask = 0x01,
    + },
    .drdy_irq = {
    .addr = ST_ACCEL_1_DRDY_IRQ_ADDR,
    .mask_int1 = ST_ACCEL_1_DRDY_IRQ_INT1_MASK,
    diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c
    index fe7775bb3740..df4045203a07 100644
    --- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
    +++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
    @@ -30,7 +30,9 @@ static int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf)

    for_each_set_bit(i, indio_dev->active_scan_mask, num_data_channels) {
    const struct iio_chan_spec *channel = &indio_dev->channels[i];
    - unsigned int bytes_to_read = channel->scan_type.realbits >> 3;
    + unsigned int bytes_to_read =
    + DIV_ROUND_UP(channel->scan_type.realbits +
    + channel->scan_type.shift, 8);
    unsigned int storage_bytes =
    channel->scan_type.storagebits >> 3;

    diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c
    index 975a1f19f747..79c8c7cd70d5 100644
    --- a/drivers/iio/common/st_sensors/st_sensors_core.c
    +++ b/drivers/iio/common/st_sensors/st_sensors_core.c
    @@ -401,6 +401,15 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev,
    return err;
    }

    + /* set DAS */
    + if (sdata->sensor_settings->das.addr) {
    + err = st_sensors_write_data_with_mask(indio_dev,
    + sdata->sensor_settings->das.addr,
    + sdata->sensor_settings->das.mask, 1);
    + if (err < 0)
    + return err;
    + }
    +
    if (sdata->int_pin_open_drain) {
    dev_info(&indio_dev->dev,
    "set interrupt line to open drain mode\n");
    @@ -483,8 +492,10 @@ static int st_sensors_read_axis_data(struct iio_dev *indio_dev,
    int err;
    u8 *outdata;
    struct st_sensor_data *sdata = iio_priv(indio_dev);
    - unsigned int byte_for_channel = ch->scan_type.realbits >> 3;
    + unsigned int byte_for_channel;

    + byte_for_channel = DIV_ROUND_UP(ch->scan_type.realbits +
    + ch->scan_type.shift, 8);
    outdata = kmalloc(byte_for_channel, GFP_KERNEL);
    if (!outdata)
    return -ENOMEM;
    diff --git a/drivers/iio/imu/bmi160/bmi160_core.c b/drivers/iio/imu/bmi160/bmi160_core.c
    index e0251b8c1a52..5fb571d03153 100644
    --- a/drivers/iio/imu/bmi160/bmi160_core.c
    +++ b/drivers/iio/imu/bmi160/bmi160_core.c
    @@ -66,10 +66,8 @@

    #define BMI160_REG_DUMMY 0x7F

    -#define BMI160_ACCEL_PMU_MIN_USLEEP 3200
    -#define BMI160_ACCEL_PMU_MAX_USLEEP 3800
    -#define BMI160_GYRO_PMU_MIN_USLEEP 55000
    -#define BMI160_GYRO_PMU_MAX_USLEEP 80000
    +#define BMI160_ACCEL_PMU_MIN_USLEEP 3800
    +#define BMI160_GYRO_PMU_MIN_USLEEP 80000
    #define BMI160_SOFTRESET_USLEEP 1000

    #define BMI160_CHANNEL(_type, _axis, _index) { \
    @@ -151,20 +149,9 @@ static struct bmi160_regs bmi160_regs[] = {
    },
    };

    -struct bmi160_pmu_time {
    - unsigned long min;
    - unsigned long max;
    -};
    -
    -static struct bmi160_pmu_time bmi160_pmu_time[] = {
    - [BMI160_ACCEL] = {
    - .min = BMI160_ACCEL_PMU_MIN_USLEEP,
    - .max = BMI160_ACCEL_PMU_MAX_USLEEP
    - },
    - [BMI160_GYRO] = {
    - .min = BMI160_GYRO_PMU_MIN_USLEEP,
    - .max = BMI160_GYRO_PMU_MIN_USLEEP,
    - },
    +static unsigned long bmi160_pmu_time[] = {
    + [BMI160_ACCEL] = BMI160_ACCEL_PMU_MIN_USLEEP,
    + [BMI160_GYRO] = BMI160_GYRO_PMU_MIN_USLEEP,
    };

    struct bmi160_scale {
    @@ -289,7 +276,7 @@ int bmi160_set_mode(struct bmi160_data *data, enum bmi160_sensor_type t,
    if (ret < 0)
    return ret;

    - usleep_range(bmi160_pmu_time[t].min, bmi160_pmu_time[t].max);
    + usleep_range(bmi160_pmu_time[t], bmi160_pmu_time[t] + 1000);

    return 0;
    }
    diff --git a/drivers/iio/light/max44000.c b/drivers/iio/light/max44000.c
    index 6511b20a2a29..a8ffa432bf0d 100644
    --- a/drivers/iio/light/max44000.c
    +++ b/drivers/iio/light/max44000.c
    @@ -113,7 +113,7 @@ static const char max44000_int_time_avail_str[] =
    "0.100 "
    "0.025 "
    "0.00625 "
    - "0.001625";
    + "0.0015625";

    /* Available scales (internal to ulux) with pretty manual alignment: */
    static const int max44000_scale_avail_ulux_array[] = {
    diff --git a/drivers/input/rmi4/rmi_f54.c b/drivers/input/rmi4/rmi_f54.c
    index cf805b960866..2e934aef3d2a 100644
    --- a/drivers/input/rmi4/rmi_f54.c
    +++ b/drivers/input/rmi4/rmi_f54.c
    @@ -200,7 +200,7 @@ static int rmi_f54_request_report(struct rmi_function *fn, u8 report_type)

    error = rmi_write(rmi_dev, fn->fd.command_base_addr, F54_GET_REPORT);
    if (error < 0)
    - return error;
    + goto unlock;

    init_completion(&f54->cmd_done);

    @@ -209,9 +209,10 @@ static int rmi_f54_request_report(struct rmi_function *fn, u8 report_type)

    queue_delayed_work(f54->workqueue, &f54->work, 0);

    +unlock:
    mutex_unlock(&f54->data_mutex);

    - return 0;
    + return error;
    }

    static size_t rmi_f54_get_report_size(struct f54_data *f54)
    diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    index 754595ee11b6..11a13b5be73a 100644
    --- a/drivers/iommu/amd_iommu.c
    +++ b/drivers/iommu/amd_iommu.c
    @@ -1021,7 +1021,7 @@ static int __iommu_queue_command_sync(struct amd_iommu *iommu,
    next_tail = (tail + sizeof(*cmd)) % CMD_BUFFER_SIZE;
    left = (head - next_tail) % CMD_BUFFER_SIZE;

    - if (left <= 2) {
    + if (left <= 0x20) {
    struct iommu_cmd sync_cmd;
    int ret;

    diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c
    index 594849a3a9be..f8ed8c95b685 100644
    --- a/drivers/iommu/amd_iommu_v2.c
    +++ b/drivers/iommu/amd_iommu_v2.c
    @@ -805,8 +805,10 @@ int amd_iommu_init_device(struct pci_dev *pdev, int pasids)
    goto out_free_domain;

    group = iommu_group_get(&pdev->dev);
    - if (!group)
    + if (!group) {
    + ret = -EINVAL;
    goto out_free_domain;
    + }

    ret = iommu_attach_group(dev_state->domain, group);
    if (ret != 0)
    diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    index d8376c2d18b3..d82637ab09fd 100644
    --- a/drivers/iommu/intel-iommu.c
    +++ b/drivers/iommu/intel-iommu.c
    @@ -2037,6 +2037,25 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
    if (context_present(context))
    goto out_unlock;

    + /*
    + * For kdump cases, old valid entries may be cached due to the
    + * in-flight DMA and copied pgtable, but there is no unmapping
    + * behaviour for them, thus we need an explicit cache flush for
    + * the newly-mapped device. For kdump, at this point, the device
    + * is supposed to finish reset at its driver probe stage, so no
    + * in-flight DMA will exist, and we don't need to worry anymore
    + * hereafter.
    + */
    + if (context_copied(context)) {
    + u16 did_old = context_domain_id(context);
    +
    + if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
    + iommu->flush.flush_context(iommu, did_old,
    + (((u16)bus) << 8) | devfn,
    + DMA_CCMD_MASK_NOBIT,
    + DMA_CCMD_DEVICE_INVL);
    + }
    +
    pgd = domain->pgd;

    context_clear_entry(context);
    @@ -5197,6 +5216,25 @@ static void intel_iommu_remove_device(struct device *dev)
    }

    #ifdef CONFIG_INTEL_IOMMU_SVM
    +#define MAX_NR_PASID_BITS (20)
    +static inline unsigned long intel_iommu_get_pts(struct intel_iommu *iommu)
    +{
    + /*
    + * Convert ecap_pss to extend context entry pts encoding, also
    + * respect the soft pasid_max value set by the iommu.
    + * - number of PASID bits = ecap_pss + 1
    + * - number of PASID table entries = 2^(pts + 5)
    + * Therefore, pts = ecap_pss - 4
    + * e.g. KBL ecap_pss = 0x13, PASID has 20 bits, pts = 15
    + */
    + if (ecap_pss(iommu->ecap) < 5)
    + return 0;
    +
    + /* pasid_max is encoded as actual number of entries not the bits */
    + return find_first_bit((unsigned long *)&iommu->pasid_max,
    + MAX_NR_PASID_BITS) - 5;
    +}
    +
    int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sdev)
    {
    struct device_domain_info *info;
    @@ -5229,7 +5267,9 @@ int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sd

    if (!(ctx_lo & CONTEXT_PASIDE)) {
    context[1].hi = (u64)virt_to_phys(iommu->pasid_state_table);
    - context[1].lo = (u64)virt_to_phys(iommu->pasid_table) | ecap_pss(iommu->ecap);
    + context[1].lo = (u64)virt_to_phys(iommu->pasid_table) |
    + intel_iommu_get_pts(iommu);
    +
    wmb();
    /* CONTEXT_TT_MULTI_LEVEL and CONTEXT_TT_DEV_IOTLB are both
    * extended to permit requests-with-PASID if the PASIDE bit
    diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
    index 353c54986211..c2662a1bfdd3 100644
    --- a/drivers/irqchip/irq-bcm7038-l1.c
    +++ b/drivers/irqchip/irq-bcm7038-l1.c
    @@ -215,6 +215,31 @@ static int bcm7038_l1_set_affinity(struct irq_data *d,
    return 0;
    }

    +static void bcm7038_l1_cpu_offline(struct irq_data *d)
    +{
    + struct cpumask *mask = irq_data_get_affinity_mask(d);
    + int cpu = smp_processor_id();
    + cpumask_t new_affinity;
    +
    + /* This CPU was not on the affinity mask */
    + if (!cpumask_test_cpu(cpu, mask))
    + return;
    +
    + if (cpumask_weight(mask) > 1) {
    + /*
    + * Multiple CPU affinity, remove this CPU from the affinity
    + * mask
    + */
    + cpumask_copy(&new_affinity, mask);
    + cpumask_clear_cpu(cpu, &new_affinity);
    + } else {
    + /* Only CPU, put on the lowest online CPU */
    + cpumask_clear(&new_affinity);
    + cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
    + }
    + irq_set_affinity_locked(d, &new_affinity, false);
    +}
    +
    static int __init bcm7038_l1_init_one(struct device_node *dn,
    unsigned int idx,
    struct bcm7038_l1_chip *intc)
    @@ -266,6 +291,7 @@ static struct irq_chip bcm7038_l1_irq_chip = {
    .irq_mask = bcm7038_l1_mask,
    .irq_unmask = bcm7038_l1_unmask,
    .irq_set_affinity = bcm7038_l1_set_affinity,
    + .irq_cpu_offline = bcm7038_l1_cpu_offline,
    };

    static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq,
    diff --git a/drivers/md/md.c b/drivers/md/md.c
    index 2089d46b0eb8..24925f2aa235 100644
    --- a/drivers/md/md.c
    +++ b/drivers/md/md.c
    @@ -6829,7 +6829,7 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
    /* need to ensure recovery thread has run */
    wait_event_interruptible_timeout(mddev->sb_wait,
    !test_bit(MD_RECOVERY_NEEDED,
    - &mddev->flags),
    + &mddev->recovery),
    msecs_to_jiffies(5000));
    if (cmd == STOP_ARRAY || cmd == STOP_ARRAY_RO) {
    /* Need to flush page cache, and ensure no-one else opens
    @@ -7092,7 +7092,8 @@ static int md_open(struct block_device *bdev, fmode_t mode)

    if (test_bit(MD_CLOSING, &mddev->flags)) {
    mutex_unlock(&mddev->open_mutex);
    - return -ENODEV;
    + err = -ENODEV;
    + goto out;
    }

    err = 0;
    @@ -7101,6 +7102,8 @@ static int md_open(struct block_device *bdev, fmode_t mode)

    check_disk_change(bdev);
    out:
    + if (err)
    + mddev_put(mddev);
    return err;
    }

    diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
    index de3ee2547479..8207e6900656 100644
    --- a/drivers/media/usb/dvb-usb/dibusb-common.c
    +++ b/drivers/media/usb/dvb-usb/dibusb-common.c
    @@ -382,9 +382,9 @@ int dibusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
    if (buf[0] != 0)
    deb_info("key: %*ph\n", 5, buf);

    +ret:
    kfree(buf);

    -ret:
    return ret;
    }
    EXPORT_SYMBOL(dibusb_rc_query);
    diff --git a/drivers/mfd/tps65217.c b/drivers/mfd/tps65217.c
    index 9a4d8684dd32..df2e7756927f 100644
    --- a/drivers/mfd/tps65217.c
    +++ b/drivers/mfd/tps65217.c
    @@ -424,6 +424,24 @@ static int tps65217_probe(struct i2c_client *client,
    return 0;
    }

    +static int tps65217_remove(struct i2c_client *client)
    +{
    + struct tps65217 *tps = i2c_get_clientdata(client);
    + unsigned int virq;
    + int i;
    +
    + for (i = 0; i < ARRAY_SIZE(tps65217_irqs); i++) {
    + virq = irq_find_mapping(tps->irq_domain, i);
    + if (virq)
    + irq_dispose_mapping(virq);
    + }
    +
    + irq_domain_remove(tps->irq_domain);
    + tps->irq_domain = NULL;
    +
    + return 0;
    +}
    +
    static const struct i2c_device_id tps65217_id_table[] = {
    {"tps65217", TPS65217},
    { /* sentinel */ }
    @@ -437,6 +455,7 @@ static struct i2c_driver tps65217_driver = {
    },
    .id_table = tps65217_id_table,
    .probe = tps65217_probe,
    + .remove = tps65217_remove,
    };

    static int __init tps65217_init(void)
    diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
    index 8cac7ef9ad0d..dbe676de7a19 100644
    --- a/drivers/misc/mei/bus.c
    +++ b/drivers/misc/mei/bus.c
    @@ -408,7 +408,7 @@ bool mei_cldev_enabled(struct mei_cl_device *cldev)
    EXPORT_SYMBOL_GPL(mei_cldev_enabled);

    /**
    - * mei_cldev_enable_device - enable me client device
    + * mei_cldev_enable - enable me client device
    * create connection with me client
    *
    * @cldev: me client device
    diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
    index f999a8d3c9c4..e2af61f7e3b6 100644
    --- a/drivers/misc/mei/client.c
    +++ b/drivers/misc/mei/client.c
    @@ -425,7 +425,7 @@ static inline void mei_io_list_free(struct mei_cl_cb *list, struct mei_cl *cl)
    *
    * @cl: host client
    * @length: size of the buffer
    - * @type: operation type
    + * @fop_type: operation type
    * @fp: associated file pointer (might be NULL)
    *
    * Return: cb on success and NULL on failure
    @@ -459,7 +459,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
    *
    * @cl: host client
    * @length: size of the buffer
    - * @type: operation type
    + * @fop_type: operation type
    * @fp: associated file pointer (might be NULL)
    *
    * Return: cb on success and NULL on failure
    @@ -1536,7 +1536,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,

    rets = first_chunk ? mei_cl_tx_flow_ctrl_creds(cl) : 1;
    if (rets < 0)
    - return rets;
    + goto err;

    if (rets == 0) {
    cl_dbg(dev, cl, "No flow control credentials: not sending.\n");
    @@ -1570,11 +1570,8 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
    cb->buf.size, cb->buf_idx);

    rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
    - if (rets) {
    - cl->status = rets;
    - list_move_tail(&cb->list, &cmpl_list->list);
    - return rets;
    - }
    + if (rets)
    + goto err;

    cl->status = 0;
    cl->writing_state = MEI_WRITING;
    @@ -1582,14 +1579,21 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
    cb->completed = mei_hdr.msg_complete == 1;

    if (first_chunk) {
    - if (mei_cl_tx_flow_ctrl_creds_reduce(cl))
    - return -EIO;
    + if (mei_cl_tx_flow_ctrl_creds_reduce(cl)) {
    + rets = -EIO;
    + goto err;
    + }
    }

    if (mei_hdr.msg_complete)
    list_move_tail(&cb->list, &dev->write_waiting_list.list);

    return 0;
    +
    +err:
    + cl->status = rets;
    + list_move_tail(&cb->list, &cmpl_list->list);
    + return rets;
    }

    /**
    diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
    index 3678220964fe..df382be62634 100644
    --- a/drivers/mmc/card/mmc_test.c
    +++ b/drivers/mmc/card/mmc_test.c
    @@ -818,7 +818,7 @@ static int mmc_test_nonblock_transfer(struct mmc_test_card *test,
    struct mmc_async_req *cur_areq = &test_areq[0].areq;
    struct mmc_async_req *other_areq = &test_areq[1].areq;
    int i;
    - int ret;
    + int ret = RESULT_OK;

    test_areq[0].test = test;
    test_areq[1].test = test;
    diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
    index 521f1c55c19e..be5b527472f9 100644
    --- a/drivers/net/wireless/ath/ath10k/core.h
    +++ b/drivers/net/wireless/ath/ath10k/core.h
    @@ -557,10 +557,8 @@ enum ath10k_fw_features {
    */
    ATH10K_FW_FEATURE_BTCOEX_PARAM = 14,

    - /* Older firmware with HTT delivers incorrect tx status for null func
    - * frames to driver, but this fixed in 10.2 and 10.4 firmware versions.
    - * Also this workaround results in reporting of incorrect null func
    - * status for 10.4. This flag is used to skip the workaround.
    + /* Unused flag and proven to be not working, enable this if you want
    + * to experiment sending NULL func data frames in HTT TX
    */
    ATH10K_FW_FEATURE_SKIP_NULL_FUNC_WAR = 15,

    diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
    index 90eeb1c82e8b..f2e85eb22afe 100644
    --- a/drivers/net/wireless/ath/ath10k/mac.c
    +++ b/drivers/net/wireless/ath/ath10k/mac.c
    @@ -3255,8 +3255,6 @@ ath10k_mac_tx_h_get_txmode(struct ath10k *ar,
    if (ar->htt.target_version_major < 3 &&
    (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
    !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
    - ar->running_fw->fw_file.fw_features) &&
    - !test_bit(ATH10K_FW_FEATURE_SKIP_NULL_FUNC_WAR,
    ar->running_fw->fw_file.fw_features))
    return ATH10K_HW_TXRX_MGMT;

    diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
    index 7d9b0da1b010..2ffc1fe4923b 100644
    --- a/drivers/net/wireless/ath/ath10k/spectral.c
    +++ b/drivers/net/wireless/ath/ath10k/spectral.c
    @@ -338,7 +338,7 @@ static ssize_t write_file_spec_scan_ctl(struct file *file,
    } else {
    res = -EINVAL;
    }
    - } else if (strncmp("background", buf, 9) == 0) {
    + } else if (strncmp("background", buf, 10) == 0) {
    res = ath10k_spectral_scan_config(ar, SPECTRAL_BACKGROUND);
    } else if (strncmp("manual", buf, 6) == 0) {
    res = ath10k_spectral_scan_config(ar, SPECTRAL_MANUAL);
    diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
    index 4ac928bf1f8e..264466f59c57 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/base.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/base.c
    @@ -1303,13 +1303,12 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);

    static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
    {
    - struct ieee80211_hw *hw = rtlpriv->hw;
    -
    rtlpriv->ra.is_special_data = true;
    if (rtlpriv->cfg->ops->get_btc_status())
    rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
    rtlpriv, 1);
    - rtl_lps_leave(hw);
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    ppsc->last_delaylps_stamp_jiffies = jiffies;
    }

    @@ -1382,7 +1381,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,

    if (is_tx) {
    rtlpriv->ra.is_special_data = true;
    - rtl_lps_leave(hw);
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    ppsc->last_delaylps_stamp_jiffies = jiffies;
    }

    diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
    index 4da4e458142c..8e7f23c11680 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/core.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/core.c
    @@ -1150,8 +1150,10 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
    } else {
    mstatus = RT_MEDIA_DISCONNECT;

    - if (mac->link_state == MAC80211_LINKED)
    - rtl_lps_leave(hw);
    + if (mac->link_state == MAC80211_LINKED) {
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    + }
    if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
    rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
    mac->link_state = MAC80211_NOLINK;
    @@ -1429,7 +1431,8 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
    }

    if (mac->link_state == MAC80211_LINKED) {
    - rtl_lps_leave(hw);
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    mac->link_state = MAC80211_LINKED_SCANNING;
    } else {
    rtl_ips_nic_on(hw);
    diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
    index 5be4fc96002d..0dfa9eac3926 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/pci.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
    @@ -663,9 +663,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
    }

    if (((rtlpriv->link_info.num_rx_inperiod +
    - rtlpriv->link_info.num_tx_inperiod) > 8) ||
    - (rtlpriv->link_info.num_rx_inperiod > 2))
    - rtl_lps_leave(hw);
    + rtlpriv->link_info.num_tx_inperiod) > 8) ||
    + (rtlpriv->link_info.num_rx_inperiod > 2)) {
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    + }
    }

    static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
    @@ -916,8 +918,10 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
    }
    if (((rtlpriv->link_info.num_rx_inperiod +
    rtlpriv->link_info.num_tx_inperiod) > 8) ||
    - (rtlpriv->link_info.num_rx_inperiod > 2))
    - rtl_lps_leave(hw);
    + (rtlpriv->link_info.num_rx_inperiod > 2)) {
    + rtlpriv->enter_ps = false;
    + schedule_work(&rtlpriv->works.lps_change_work);
    + }
    skb = new_skb;
    no_new:
    if (rtlpriv->use_new_trx_flow) {
    diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
    index d0ffc4d508cf..18d979affc18 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/ps.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
    @@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
    }
    }

    -/* Interrupt safe routine to enter the leisure power save mode.*/
    -static void rtl_lps_enter_core(struct ieee80211_hw *hw)
    +/*Enter the leisure power save mode.*/
    +void rtl_lps_enter(struct ieee80211_hw *hw)
    {
    struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
    struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
    @@ -444,9 +444,10 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw)

    spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
    }
    +EXPORT_SYMBOL(rtl_lps_enter);

    -/* Interrupt safe routine to leave the leisure power save mode.*/
    -static void rtl_lps_leave_core(struct ieee80211_hw *hw)
    +/*Leave the leisure power save mode.*/
    +void rtl_lps_leave(struct ieee80211_hw *hw)
    {
    struct rtl_priv *rtlpriv = rtl_priv(hw);
    struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
    @@ -476,6 +477,7 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw)
    }
    spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
    }
    +EXPORT_SYMBOL(rtl_lps_leave);

    /* For sw LPS*/
    void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
    @@ -668,34 +670,12 @@ void rtl_lps_change_work_callback(struct work_struct *work)
    struct rtl_priv *rtlpriv = rtl_priv(hw);

    if (rtlpriv->enter_ps)
    - rtl_lps_enter_core(hw);
    + rtl_lps_enter(hw);
    else
    - rtl_lps_leave_core(hw);
    + rtl_lps_leave(hw);
    }
    EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);

    -void rtl_lps_enter(struct ieee80211_hw *hw)
    -{
    - struct rtl_priv *rtlpriv = rtl_priv(hw);
    -
    - if (!in_interrupt())
    - return rtl_lps_enter_core(hw);
    - rtlpriv->enter_ps = true;
    - schedule_work(&rtlpriv->works.lps_change_work);
    -}
    -EXPORT_SYMBOL_GPL(rtl_lps_enter);
    -
    -void rtl_lps_leave(struct ieee80211_hw *hw)
    -{
    - struct rtl_priv *rtlpriv = rtl_priv(hw);
    -
    - if (!in_interrupt())
    - return rtl_lps_leave_core(hw);
    - rtlpriv->enter_ps = false;
    - schedule_work(&rtlpriv->works.lps_change_work);
    -}
    -EXPORT_SYMBOL_GPL(rtl_lps_leave);
    -
    void rtl_swlps_wq_callback(void *data)
    {
    struct rtl_works *rtlworks = container_of_dwork_rtl(data,
    diff --git a/drivers/pci/host/pcie-rockchip.c b/drivers/pci/host/pcie-rockchip.c
    index e04f69beb42d..3452983d3569 100644
    --- a/drivers/pci/host/pcie-rockchip.c
    +++ b/drivers/pci/host/pcie-rockchip.c
    @@ -533,7 +533,7 @@ static int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)

    /* Fix the transmitted FTS count desired to exit from L0s. */
    status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL_PLC1);
    - status = (status & PCIE_CORE_CTRL_PLC1_FTS_MASK) |
    + status = (status & ~PCIE_CORE_CTRL_PLC1_FTS_MASK) |
    (PCIE_CORE_CTRL_PLC1_FTS_CNT << PCIE_CORE_CTRL_PLC1_FTS_SHIFT);
    rockchip_pcie_write(rockchip, status, PCIE_CORE_CTRL_PLC1);

    @@ -590,8 +590,8 @@ static int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)

    /* Check the final link width from negotiated lane counter from MGMT */
    status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
    - status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
    - PCIE_CORE_PL_CONF_LANE_MASK);
    + status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
    + PCIE_CORE_PL_CONF_LANE_SHIFT);
    dev_dbg(dev, "current link width is x%d\n", status);

    rockchip_pcie_write(rockchip, ROCKCHIP_VENDOR_ID,
    diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
    index dc67f39779ec..c614ff7c3bc3 100644
    --- a/drivers/pci/hotplug/rpadlpar_core.c
    +++ b/drivers/pci/hotplug/rpadlpar_core.c
    @@ -257,8 +257,13 @@ static int dlpar_add_phb(char *drc_name, struct device_node *dn)

    static int dlpar_add_vio_slot(char *drc_name, struct device_node *dn)
    {
    - if (vio_find_node(dn))
    + struct vio_dev *vio_dev;
    +
    + vio_dev = vio_find_node(dn);
    + if (vio_dev) {
    + put_device(&vio_dev->dev);
    return -EINVAL;
    + }

    if (!vio_register_device_node(dn)) {
    printk(KERN_ERR
    @@ -334,6 +339,9 @@ static int dlpar_remove_vio_slot(char *drc_name, struct device_node *dn)
    return -EINVAL;

    vio_unregister_device(vio_dev);
    +
    + put_device(&vio_dev->dev);
    +
    return 0;
    }

    diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
    index ad70507cfb56..3455f752d5e4 100644
    --- a/drivers/pci/msi.c
    +++ b/drivers/pci/msi.c
    @@ -1294,7 +1294,8 @@ const struct cpumask *pci_irq_get_affinity(struct pci_dev *dev, int nr)
    } else if (dev->msi_enabled) {
    struct msi_desc *entry = first_pci_msi_entry(dev);

    - if (WARN_ON_ONCE(!entry || nr >= entry->nvec_used))
    + if (WARN_ON_ONCE(!entry || !entry->affinity ||
    + nr >= entry->nvec_used))
    return NULL;

    return &entry->affinity[nr];
    diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    index c232729f5b1b..3a035e073889 100644
    --- a/drivers/pci/quirks.c
    +++ b/drivers/pci/quirks.c
    @@ -3137,8 +3137,9 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x22b5, quirk_remove_d3_delay);
    DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x22b7, quirk_remove_d3_delay);
    DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2298, quirk_remove_d3_delay);
    DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x229c, quirk_remove_d3_delay);
    +
    /*
    - * Some devices may pass our check in pci_intx_mask_supported if
    + * Some devices may pass our check in pci_intx_mask_supported() if
    * PCI_COMMAND_INTX_DISABLE works though they actually do not properly
    * support this feature.
    */
    @@ -3146,53 +3147,139 @@ static void quirk_broken_intx_masking(struct pci_dev *dev)
    {
    dev->broken_intx_masking = 1;
    }
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, 0x0030,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
    - quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x0030,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
    + quirk_broken_intx_masking);
    +
    /*
    * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
    * Subsystem: Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
    *
    * RTL8110SC - Fails under PCI device assignment using DisINTx masking.
    */
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x8169,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
    - quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8169,
    + quirk_broken_intx_masking);

    /*
    * Intel i40e (XL710/X710) 10/20/40GbE NICs all have broken INTx masking,
    * DisINTx can be set but the interrupt status bit is non-functional.
    */
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1572,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1574,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1580,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1581,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1583,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1584,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1585,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1586,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1587,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1588,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1589,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d0,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d1,
    - quirk_broken_intx_masking);
    -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d2,
    - quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1572,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1574,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1580,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1581,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1583,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1584,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1585,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1586,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1587,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1588,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1589,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d0,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d1,
    + quirk_broken_intx_masking);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d2,
    + quirk_broken_intx_masking);
    +
    +static u16 mellanox_broken_intx_devs[] = {
    + PCI_DEVICE_ID_MELLANOX_HERMON_SDR,
    + PCI_DEVICE_ID_MELLANOX_HERMON_DDR,
    + PCI_DEVICE_ID_MELLANOX_HERMON_QDR,
    + PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2,
    + PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2,
    + PCI_DEVICE_ID_MELLANOX_HERMON_EN,
    + PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX_EN,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX2,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX3,
    + PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO,
    +};
    +
    +#define CONNECTX_4_CURR_MAX_MINOR 99
    +#define CONNECTX_4_INTX_SUPPORT_MINOR 14
    +
    +/*
    + * Check ConnectX-4/LX FW version to see if it supports legacy interrupts.
    + * If so, don't mark it as broken.
    + * FW minor > 99 means older FW version format and no INTx masking support.
    + * FW minor < 14 means new FW version format and no INTx masking support.
    + */
    +static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
    +{
    + __be32 __iomem *fw_ver;
    + u16 fw_major;
    + u16 fw_minor;
    + u16 fw_subminor;
    + u32 fw_maj_min;
    + u32 fw_sub_min;
    + int i;
    +
    + for (i = 0; i < ARRAY_SIZE(mellanox_broken_intx_devs); i++) {
    + if (pdev->device == mellanox_broken_intx_devs[i]) {
    + pdev->broken_intx_masking = 1;
    + return;
    + }
    + }
    +
    + /* Getting here means Connect-IB cards and up. Connect-IB has no INTx
    + * support so shouldn't be checked further
    + */
    + if (pdev->device == PCI_DEVICE_ID_MELLANOX_CONNECTIB)
    + return;
    +
    + if (pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4 &&
    + pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX)
    + return;
    +
    + /* For ConnectX-4 and ConnectX-4LX, need to check FW support */
    + if (pci_enable_device_mem(pdev)) {
    + dev_warn(&pdev->dev, "Can't enable device memory\n");
    + return;
    + }
    +
    + fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
    + if (!fw_ver) {
    + dev_warn(&pdev->dev, "Can't map ConnectX-4 initialization segment\n");
    + goto out;
    + }
    +
    + /* Reading from resource space should be 32b aligned */
    + fw_maj_min = ioread32be(fw_ver);
    + fw_sub_min = ioread32be(fw_ver + 1);
    + fw_major = fw_maj_min & 0xffff;
    + fw_minor = fw_maj_min >> 16;
    + fw_subminor = fw_sub_min & 0xffff;
    + if (fw_minor > CONNECTX_4_CURR_MAX_MINOR ||
    + fw_minor < CONNECTX_4_INTX_SUPPORT_MINOR) {
    + dev_warn(&pdev->dev, "ConnectX-4: FW %u.%u.%u doesn't support INTx masking, disabling. Please upgrade FW to %d.14.1100 and up for INTx support\n",
    + fw_major, fw_minor, fw_subminor, pdev->device ==
    + PCI_DEVICE_ID_MELLANOX_CONNECTX4 ? 12 : 14);
    + pdev->broken_intx_masking = 1;
    + }
    +
    + iounmap(fw_ver);
    +
    +out:
    + pci_disable_device(pdev);
    +}
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
    + mellanox_check_broken_intx_masking);

    static void quirk_no_bus_reset(struct pci_dev *dev)
    {
    @@ -3255,6 +3342,25 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C
    DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
    quirk_thunderbolt_hotplug_msi);

    +static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
    +{
    + pci_set_vpd_size(dev, 8192);
    +}
    +
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
    +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
    +
    #ifdef CONFIG_ACPI
    /*
    * Apple: Shutdown Cactus Ridge Thunderbolt controller.
    diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
    index aea310a91821..c9a146948192 100644
    --- a/drivers/pinctrl/pinctrl-amd.c
    +++ b/drivers/pinctrl/pinctrl-amd.c
    @@ -382,26 +382,21 @@ static int amd_gpio_irq_set_type(struct irq_data *d, unsigned int type)
    {
    int ret = 0;
    u32 pin_reg;
    - unsigned long flags;
    - bool level_trig;
    - u32 active_level;
    + unsigned long flags, irq_flags;
    struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
    struct amd_gpio *gpio_dev = gpiochip_get_data(gc);

    spin_lock_irqsave(&gpio_dev->lock, flags);
    pin_reg = readl(gpio_dev->base + (d->hwirq)*4);

    - /*
    - * When level_trig is set EDGE and active_level is set HIGH in BIOS
    - * default settings, ignore incoming settings from client and use
    - * BIOS settings to configure GPIO register.
    + /* Ignore the settings coming from the client and
    + * read the values from the ACPI tables
    + * while setting the trigger type
    */
    - level_trig = !(pin_reg & (LEVEL_TRIGGER << LEVEL_TRIG_OFF));
    - active_level = pin_reg & (ACTIVE_LEVEL_MASK << ACTIVE_LEVEL_OFF);

    - if(level_trig &&
    - ((active_level >> ACTIVE_LEVEL_OFF) == ACTIVE_HIGH))
    - type = IRQ_TYPE_EDGE_FALLING;
    + irq_flags = irq_get_trigger_type(d->irq);
    + if (irq_flags != IRQ_TYPE_NONE)
    + type = irq_flags;

    switch (type & IRQ_TYPE_SENSE_MASK) {
    case IRQ_TYPE_EDGE_RISING:
    diff --git a/drivers/platform/x86/fujitsu-laptop.c b/drivers/platform/x86/fujitsu-laptop.c
    index 61f39abf5dc8..82d67715ce76 100644
    --- a/drivers/platform/x86/fujitsu-laptop.c
    +++ b/drivers/platform/x86/fujitsu-laptop.c
    @@ -177,43 +177,43 @@ static void acpi_fujitsu_hotkey_notify(struct acpi_device *device, u32 event);

    #if IS_ENABLED(CONFIG_LEDS_CLASS)
    static enum led_brightness logolamp_get(struct led_classdev *cdev);
    -static void logolamp_set(struct led_classdev *cdev,
    +static int logolamp_set(struct led_classdev *cdev,
    enum led_brightness brightness);

    static struct led_classdev logolamp_led = {
    .name = "fujitsu::logolamp",
    .brightness_get = logolamp_get,
    - .brightness_set = logolamp_set
    + .brightness_set_blocking = logolamp_set
    };

    static enum led_brightness kblamps_get(struct led_classdev *cdev);
    -static void kblamps_set(struct led_classdev *cdev,
    +static int kblamps_set(struct led_classdev *cdev,
    enum led_brightness brightness);

    static struct led_classdev kblamps_led = {
    .name = "fujitsu::kblamps",
    .brightness_get = kblamps_get,
    - .brightness_set = kblamps_set
    + .brightness_set_blocking = kblamps_set
    };

    static enum led_brightness radio_led_get(struct led_classdev *cdev);
    -static void radio_led_set(struct led_classdev *cdev,
    +static int radio_led_set(struct led_classdev *cdev,
    enum led_brightness brightness);

    static struct led_classdev radio_led = {
    .name = "fujitsu::radio_led",
    .brightness_get = radio_led_get,
    - .brightness_set = radio_led_set
    + .brightness_set_blocking = radio_led_set
    };

    static enum led_brightness eco_led_get(struct led_classdev *cdev);
    -static void eco_led_set(struct led_classdev *cdev,
    +static int eco_led_set(struct led_classdev *cdev,
    enum led_brightness brightness);

    static struct led_classdev eco_led = {
    .name = "fujitsu::eco_led",
    .brightness_get = eco_led_get,
    - .brightness_set = eco_led_set
    + .brightness_set_blocking = eco_led_set
    };
    #endif

    @@ -267,48 +267,48 @@ static int call_fext_func(int cmd, int arg0, int arg1, int arg2)
    #if IS_ENABLED(CONFIG_LEDS_CLASS)
    /* LED class callbacks */

    -static void logolamp_set(struct led_classdev *cdev,
    +static int logolamp_set(struct led_classdev *cdev,
    enum led_brightness brightness)
    {
    if (brightness >= LED_FULL) {
    call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON);
    - call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON);
    + return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON);
    } else if (brightness >= LED_HALF) {
    call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON);
    - call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF);
    + return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF);
    } else {
    - call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF);
    + return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF);
    }
    }

    -static void kblamps_set(struct led_classdev *cdev,
    +static int kblamps_set(struct led_classdev *cdev,
    enum led_brightness brightness)
    {
    if (brightness >= LED_FULL)
    - call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON);
    + return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON);
    else
    - call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF);
    + return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF);
    }

    -static void radio_led_set(struct led_classdev *cdev,
    +static int radio_led_set(struct led_classdev *cdev,
    enum led_brightness brightness)
    {
    if (brightness >= LED_FULL)
    - call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
    + return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
    else
    - call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
    + return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
    }

    -static void eco_led_set(struct led_classdev *cdev,
    +static int eco_led_set(struct led_classdev *cdev,
    enum led_brightness brightness)
    {
    int curr;

    curr = call_fext_func(FUNC_LEDS, 0x2, ECO_LED, 0x0);
    if (brightness >= LED_FULL)
    - call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON);
    + return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON);
    else
    - call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON);
    + return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON);
    }

    static enum led_brightness logolamp_get(struct led_classdev *cdev)
    diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
    index 06fef2b4c814..1d4770c02e57 100644
    --- a/drivers/rpmsg/qcom_smd.c
    +++ b/drivers/rpmsg/qcom_smd.c
    @@ -739,7 +739,7 @@ static int __qcom_smd_send(struct qcom_smd_channel *channel, const void *data,

    while (qcom_smd_get_tx_avail(channel) < tlen) {
    if (!wait) {
    - ret = -ENOMEM;
    + ret = -EAGAIN;
    goto out;
    }

    diff --git a/drivers/scsi/g_NCR5380.c b/drivers/scsi/g_NCR5380.c
    index cbf010324c18..596a75924d90 100644
    --- a/drivers/scsi/g_NCR5380.c
    +++ b/drivers/scsi/g_NCR5380.c
    @@ -170,12 +170,12 @@ static int generic_NCR5380_init_one(struct scsi_host_template *tpnt,
    if (ports[i]) {
    /* At this point we have our region reserved */
    magic_configure(i, 0, magic); /* no IRQ yet */
    - outb(0xc0, ports[i] + 9);
    - if (inb(ports[i] + 9) != 0x80) {
    + base = ports[i];
    + outb(0xc0, base + 9);
    + if (inb(base + 9) != 0x80) {
    ret = -ENODEV;
    goto out_release;
    }
    - base = ports[i];
    port_idx = i;
    } else
    return -EINVAL;
    diff --git a/drivers/scsi/mvsas/mv_94xx.c b/drivers/scsi/mvsas/mv_94xx.c
    index 4c57d9abce7b..7de5d8d75480 100644
    --- a/drivers/scsi/mvsas/mv_94xx.c
    +++ b/drivers/scsi/mvsas/mv_94xx.c
    @@ -668,7 +668,7 @@ static void mvs_94xx_command_active(struct mvs_info *mvi, u32 slot_idx)
    {
    u32 tmp;
    tmp = mvs_cr32(mvi, MVS_COMMAND_ACTIVE+(slot_idx >> 3));
    - if (tmp && 1 << (slot_idx % 32)) {
    + if (tmp & 1 << (slot_idx % 32)) {
    mv_printk("command active %08X, slot [%x].\n", tmp, slot_idx);
    mvs_cw32(mvi, MVS_COMMAND_ACTIVE + (slot_idx >> 3),
    1 << (slot_idx % 32));
    diff --git a/drivers/staging/iio/adc/ad7606_core.c b/drivers/staging/iio/adc/ad7606_core.c
    index f79ee61851f6..cbd6bc52050f 100644
    --- a/drivers/staging/iio/adc/ad7606_core.c
    +++ b/drivers/staging/iio/adc/ad7606_core.c
    @@ -189,7 +189,7 @@ static ssize_t ad7606_store_oversampling_ratio(struct device *dev,
    mutex_lock(&indio_dev->mlock);
    gpio_set_value(st->pdata->gpio_os0, (ret >> 0) & 1);
    gpio_set_value(st->pdata->gpio_os1, (ret >> 1) & 1);
    - gpio_set_value(st->pdata->gpio_os1, (ret >> 2) & 1);
    + gpio_set_value(st->pdata->gpio_os2, (ret >> 2) & 1);
    st->oversampling = lval;
    mutex_unlock(&indio_dev->mlock);

    diff --git a/drivers/staging/media/davinci_vpfe/vpfe_video.c b/drivers/staging/media/davinci_vpfe/vpfe_video.c
    index 8be9f854510f..89dd6b989254 100644
    --- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
    +++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
    @@ -1362,7 +1362,7 @@ static int vpfe_reqbufs(struct file *file, void *priv,
    ret = vb2_queue_init(q);
    if (ret) {
    v4l2_err(&vpfe_dev->v4l2_dev, "vb2_queue_init() failed\n");
    - return ret;
    + goto unlock_out;
    }

    fh->io_allowed = 1;
    diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
    index d02e3e31ed29..12354440a334 100644
    --- a/drivers/staging/octeon/ethernet.c
    +++ b/drivers/staging/octeon/ethernet.c
    @@ -776,6 +776,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
    /* Initialize the device private structure. */
    struct octeon_ethernet *priv = netdev_priv(dev);

    + SET_NETDEV_DEV(dev, &pdev->dev);
    dev->netdev_ops = &cvm_oct_pow_netdev_ops;
    priv->imode = CVMX_HELPER_INTERFACE_MODE_DISABLED;
    priv->port = CVMX_PIP_NUM_INPUT_PORTS;
    @@ -820,6 +821,7 @@ static int cvm_oct_probe(struct platform_device *pdev)
    }

    /* Initialize the device private structure. */
    + SET_NETDEV_DEV(dev, &pdev->dev);
    priv = netdev_priv(dev);
    priv->netdev = dev;
    priv->of_node = cvm_oct_node_for_port(pip, interface,
    diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
    index 0814e5894a96..205a509b0dfb 100644
    --- a/drivers/target/iscsi/iscsi_target_tpg.c
    +++ b/drivers/target/iscsi/iscsi_target_tpg.c
    @@ -260,7 +260,6 @@ int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_gro
    iscsi_release_param_list(tpg->param_list);
    tpg->param_list = NULL;
    }
    - kfree(tpg);
    return -ENOMEM;
    }

    diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
    index 58bb6ed18185..6ca388eca33b 100644
    --- a/drivers/target/sbp/sbp_target.c
    +++ b/drivers/target/sbp/sbp_target.c
    @@ -928,7 +928,7 @@ static struct sbp_target_request *sbp_mgt_get_req(struct sbp_session *sess,
    struct sbp_target_request *req;
    int tag;

    - tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
    + tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING);
    if (tag < 0)
    return ERR_PTR(-ENOMEM);

    diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    index a2d90aca779f..1f7036c8f57b 100644
    --- a/drivers/usb/core/config.c
    +++ b/drivers/usb/core/config.c
    @@ -234,6 +234,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
    if (ifp->desc.bNumEndpoints >= num_ep)
    goto skip_to_next_endpoint_or_interface_descriptor;

    + /* Check for duplicate endpoint addresses */
    + for (i = 0; i < ifp->desc.bNumEndpoints; ++i) {
    + if (ifp->endpoint[i].desc.bEndpointAddress ==
    + d->bEndpointAddress) {
    + dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
    + cfgno, inum, asnum, d->bEndpointAddress);
    + goto skip_to_next_endpoint_or_interface_descriptor;
    + }
    + }
    +
    endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
    ++ifp->desc.bNumEndpoints;

    diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    index 0d81436c94bd..aef81a16e2c8 100644
    --- a/drivers/usb/core/hub.c
    +++ b/drivers/usb/core/hub.c
    @@ -101,8 +101,7 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);

    static void hub_release(struct kref *kref);
    static int usb_reset_and_verify_device(struct usb_device *udev);
    -static void hub_usb3_port_prepare_disable(struct usb_hub *hub,
    - struct usb_port *port_dev);
    +static int hub_port_disable(struct usb_hub *hub, int port1, int set_state);

    static inline char *portspeed(struct usb_hub *hub, int portstatus)
    {
    @@ -901,34 +900,6 @@ static int hub_set_port_link_state(struct usb_hub *hub, int port1,
    }

    /*
    - * USB-3 does not have a similar link state as USB-2 that will avoid negotiating
    - * a connection with a plugged-in cable but will signal the host when the cable
    - * is unplugged. Disable remote wake and set link state to U3 for USB-3 devices
    - */
    -static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
    -{
    - struct usb_port *port_dev = hub->ports[port1 - 1];
    - struct usb_device *hdev = hub->hdev;
    - int ret = 0;
    -
    - if (!hub->error) {
    - if (hub_is_superspeed(hub->hdev)) {
    - hub_usb3_port_prepare_disable(hub, port_dev);
    - ret = hub_set_port_link_state(hub, port_dev->portnum,
    - USB_SS_PORT_LS_U3);
    - } else {
    - ret = usb_clear_port_feature(hdev, port1,
    - USB_PORT_FEAT_ENABLE);
    - }
    - }
    - if (port_dev->child && set_state)
    - usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED);
    - if (ret && ret != -ENODEV)
    - dev_err(&port_dev->dev, "cannot disable (err = %d)\n", ret);
    - return ret;
    -}
    -
    -/*
    * Disable a port and mark a logical connect-change event, so that some
    * time later hub_wq will disconnect() any existing usb_device on the port
    * and will re-enumerate if there actually is a device attached.
    @@ -4153,6 +4124,34 @@ static int hub_handle_remote_wakeup(struct usb_hub *hub, unsigned int port,

    #endif /* CONFIG_PM */

    +/*
    + * USB-3 does not have a similar link state as USB-2 that will avoid negotiating
    + * a connection with a plugged-in cable but will signal the host when the cable
    + * is unplugged. Disable remote wake and set link state to U3 for USB-3 devices
    + */
    +static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
    +{
    + struct usb_port *port_dev = hub->ports[port1 - 1];
    + struct usb_device *hdev = hub->hdev;
    + int ret = 0;
    +
    + if (!hub->error) {
    + if (hub_is_superspeed(hub->hdev)) {
    + hub_usb3_port_prepare_disable(hub, port_dev);
    + ret = hub_set_port_link_state(hub, port_dev->portnum,
    + USB_SS_PORT_LS_U3);
    + } else {
    + ret = usb_clear_port_feature(hdev, port1,
    + USB_PORT_FEAT_ENABLE);
    + }
    + }
    + if (port_dev->child && set_state)
    + usb_set_device_state(port_dev->child, USB_STATE_NOTATTACHED);
    + if (ret && ret != -ENODEV)
    + dev_err(&port_dev->dev, "cannot disable (err = %d)\n", ret);
    + return ret;
    +}
    +

    /* USB 2.0 spec, 7.1.7.3 / fig 7-29:
    *
    diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
    index 6b60e42626a2..884c43714456 100644
    --- a/drivers/usb/dwc3/core.h
    +++ b/drivers/usb/dwc3/core.h
    @@ -43,9 +43,7 @@
    #define DWC3_XHCI_RESOURCES_NUM 2

    #define DWC3_SCRATCHBUF_SIZE 4096 /* each buffer is assumed to be 4KiB */
    -#define DWC3_EVENT_SIZE 4 /* bytes */
    -#define DWC3_EVENT_MAX_NUM 64 /* 2 events/endpoint */
    -#define DWC3_EVENT_BUFFERS_SIZE (DWC3_EVENT_SIZE * DWC3_EVENT_MAX_NUM)
    +#define DWC3_EVENT_BUFFERS_SIZE 4096
    #define DWC3_EVENT_TYPE_MASK 0xfe

    #define DWC3_EVENT_TYPE_DEV 0
    @@ -303,9 +301,8 @@
    #define DWC3_DCFG_SUPERSPEED_PLUS (5 << 0) /* DWC_usb31 only */
    #define DWC3_DCFG_SUPERSPEED (4 << 0)
    #define DWC3_DCFG_HIGHSPEED (0 << 0)
    -#define DWC3_DCFG_FULLSPEED2 (1 << 0)
    +#define DWC3_DCFG_FULLSPEED (1 << 0)
    #define DWC3_DCFG_LOWSPEED (2 << 0)
    -#define DWC3_DCFG_FULLSPEED1 (3 << 0)

    #define DWC3_DCFG_NUMP_SHIFT 17
    #define DWC3_DCFG_NUMP(n) (((n) >> DWC3_DCFG_NUMP_SHIFT) & 0x1f)
    @@ -397,9 +394,8 @@
    #define DWC3_DSTS_SUPERSPEED_PLUS (5 << 0) /* DWC_usb31 only */
    #define DWC3_DSTS_SUPERSPEED (4 << 0)
    #define DWC3_DSTS_HIGHSPEED (0 << 0)
    -#define DWC3_DSTS_FULLSPEED2 (1 << 0)
    +#define DWC3_DSTS_FULLSPEED (1 << 0)
    #define DWC3_DSTS_LOWSPEED (2 << 0)
    -#define DWC3_DSTS_FULLSPEED1 (3 << 0)

    /* Device Generic Command Register */
    #define DWC3_DGCMD_SET_LMP 0x01
    diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
    index 6df0f5dad9a4..427291a19e6d 100644
    --- a/drivers/usb/dwc3/dwc3-pci.c
    +++ b/drivers/usb/dwc3/dwc3-pci.c
    @@ -38,6 +38,7 @@
    #define PCI_DEVICE_ID_INTEL_BXT_M 0x1aaa
    #define PCI_DEVICE_ID_INTEL_APL 0x5aaa
    #define PCI_DEVICE_ID_INTEL_KBP 0xa2b0
    +#define PCI_DEVICE_ID_INTEL_GLK 0x31aa

    static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
    static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
    @@ -81,7 +82,7 @@ static int dwc3_pci_quirks(struct pci_dev *pdev, struct platform_device *dwc3)
    int ret;

    struct property_entry properties[] = {
    - PROPERTY_ENTRY_STRING("dr-mode", "peripheral"),
    + PROPERTY_ENTRY_STRING("dr_mode", "peripheral"),
    { }
    };

    @@ -229,6 +230,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
    { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
    { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
    { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
    + { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
    { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
    { } /* Terminating Entry */
    };
    diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
    index fe79d771dee4..2331469f943d 100644
    --- a/drivers/usb/dwc3/ep0.c
    +++ b/drivers/usb/dwc3/ep0.c
    @@ -55,20 +55,13 @@ static const char *dwc3_ep0_state_string(enum dwc3_ep0_state state)
    }
    }

    -static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
    - u32 len, u32 type, bool chain)
    +static void dwc3_ep0_prepare_one_trb(struct dwc3 *dwc, u8 epnum,
    + dma_addr_t buf_dma, u32 len, u32 type, bool chain)
    {
    - struct dwc3_gadget_ep_cmd_params params;
    struct dwc3_trb *trb;
    struct dwc3_ep *dep;

    - int ret;
    -
    dep = dwc->eps[epnum];
    - if (dep->flags & DWC3_EP_BUSY) {
    - dwc3_trace(trace_dwc3_ep0, "%s still busy", dep->name);
    - return 0;
    - }

    trb = &dwc->ep0_trb[dep->trb_enqueue];

    @@ -89,15 +82,25 @@ static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum, dma_addr_t buf_dma,
    trb->ctrl |= (DWC3_TRB_CTRL_IOC
    | DWC3_TRB_CTRL_LST);

    - if (chain)
    + trace_dwc3_prepare_trb(dep, trb);
    +}
    +
    +static int dwc3_ep0_start_trans(struct dwc3 *dwc, u8 epnum)
    +{
    + struct dwc3_gadget_ep_cmd_params params;
    + struct dwc3_ep *dep;
    + int ret;
    +
    + dep = dwc->eps[epnum];
    + if (dep->flags & DWC3_EP_BUSY) {
    + dwc3_trace(trace_dwc3_ep0, "%s still busy", dep->name);
    return 0;
    + }

    memset(&params, 0, sizeof(params));
    params.param0 = upper_32_bits(dwc->ep0_trb_addr);
    params.param1 = lower_32_bits(dwc->ep0_trb_addr);

    - trace_dwc3_prepare_trb(dep, trb);
    -
    ret = dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_STARTTRANSFER, &params);
    if (ret < 0) {
    dwc3_trace(trace_dwc3_ep0, "%s STARTTRANSFER failed",
    @@ -308,8 +311,9 @@ void dwc3_ep0_out_start(struct dwc3 *dwc)
    {
    int ret;

    - ret = dwc3_ep0_start_trans(dwc, 0, dwc->ctrl_req_addr, 8,
    + dwc3_ep0_prepare_one_trb(dwc, 0, dwc->ctrl_req_addr, 8,
    DWC3_TRBCTL_CONTROL_SETUP, false);
    + ret = dwc3_ep0_start_trans(dwc, 0);
    WARN_ON(ret < 0);
    }

    @@ -880,9 +884,9 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,

    dwc->ep0_next_event = DWC3_EP0_COMPLETE;

    - ret = dwc3_ep0_start_trans(dwc, epnum,
    - dwc->ctrl_req_addr, 0,
    - DWC3_TRBCTL_CONTROL_DATA, false);
    + dwc3_ep0_prepare_one_trb(dwc, epnum, dwc->ctrl_req_addr,
    + 0, DWC3_TRBCTL_CONTROL_DATA, false);
    + ret = dwc3_ep0_start_trans(dwc, epnum);
    WARN_ON(ret < 0);
    }
    }
    @@ -966,9 +970,10 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
    req->direction = !!dep->number;

    if (req->request.length == 0) {
    - ret = dwc3_ep0_start_trans(dwc, dep->number,
    + dwc3_ep0_prepare_one_trb(dwc, dep->number,
    dwc->ctrl_req_addr, 0,
    DWC3_TRBCTL_CONTROL_DATA, false);
    + ret = dwc3_ep0_start_trans(dwc, dep->number);
    } else if (!IS_ALIGNED(req->request.length, dep->endpoint.maxpacket)
    && (dep->number == 0)) {
    u32 transfer_size = 0;
    @@ -986,7 +991,7 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
    if (req->request.length > DWC3_EP0_BOUNCE_SIZE) {
    transfer_size = ALIGN(req->request.length - maxpacket,
    maxpacket);
    - ret = dwc3_ep0_start_trans(dwc, dep->number,
    + dwc3_ep0_prepare_one_trb(dwc, dep->number,
    req->request.dma,
    transfer_size,
    DWC3_TRBCTL_CONTROL_DATA,
    @@ -998,9 +1003,10 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,

    dwc->ep0_bounced = true;

    - ret = dwc3_ep0_start_trans(dwc, dep->number,
    + dwc3_ep0_prepare_one_trb(dwc, dep->number,
    dwc->ep0_bounce_addr, transfer_size,
    DWC3_TRBCTL_CONTROL_DATA, false);
    + ret = dwc3_ep0_start_trans(dwc, dep->number);
    } else {
    ret = usb_gadget_map_request(&dwc->gadget, &req->request,
    dep->number);
    @@ -1009,9 +1015,10 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
    return;
    }

    - ret = dwc3_ep0_start_trans(dwc, dep->number, req->request.dma,
    + dwc3_ep0_prepare_one_trb(dwc, dep->number, req->request.dma,
    req->request.length, DWC3_TRBCTL_CONTROL_DATA,
    false);
    + ret = dwc3_ep0_start_trans(dwc, dep->number);
    }

    WARN_ON(ret < 0);
    @@ -1025,8 +1032,9 @@ static int dwc3_ep0_start_control_status(struct dwc3_ep *dep)
    type = dwc->three_stage_setup ? DWC3_TRBCTL_CONTROL_STATUS3
    : DWC3_TRBCTL_CONTROL_STATUS2;

    - return dwc3_ep0_start_trans(dwc, dep->number,
    + dwc3_ep0_prepare_one_trb(dwc, dep->number,
    dwc->ctrl_req_addr, 0, type, false);
    + return dwc3_ep0_start_trans(dwc, dep->number);
    }

    static void __dwc3_ep0_do_control_status(struct dwc3 *dwc, struct dwc3_ep *dep)
    diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    index b3687e223e00..d2b860ebfe13 100644
    --- a/drivers/usb/dwc3/gadget.c
    +++ b/drivers/usb/dwc3/gadget.c
    @@ -182,11 +182,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
    if (req->request.status == -EINPROGRESS)
    req->request.status = status;

    - if (dwc->ep0_bounced && dep->number == 0)
    + if (dwc->ep0_bounced && dep->number <= 1)
    dwc->ep0_bounced = false;
    - else
    - usb_gadget_unmap_request(&dwc->gadget, &req->request,
    - req->direction);
    +
    + usb_gadget_unmap_request(&dwc->gadget, &req->request,
    + req->direction);

    trace_dwc3_gadget_giveback(req);

    @@ -1606,7 +1606,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc)
    reg |= DWC3_DCFG_LOWSPEED;
    break;
    case USB_SPEED_FULL:
    - reg |= DWC3_DCFG_FULLSPEED1;
    + reg |= DWC3_DCFG_FULLSPEED;
    break;
    case USB_SPEED_HIGH:
    reg |= DWC3_DCFG_HIGHSPEED;
    @@ -2465,8 +2465,7 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
    dwc->gadget.ep0->maxpacket = 64;
    dwc->gadget.speed = USB_SPEED_HIGH;
    break;
    - case DWC3_DSTS_FULLSPEED2:
    - case DWC3_DSTS_FULLSPEED1:
    + case DWC3_DSTS_FULLSPEED:
    dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(64);
    dwc->gadget.ep0->maxpacket = 64;
    dwc->gadget.speed = USB_SPEED_FULL;
    diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
    index e38b21087d26..c3c5b87b35b3 100644
    --- a/drivers/usb/gadget/composite.c
    +++ b/drivers/usb/gadget/composite.c
    @@ -205,7 +205,7 @@ int config_ep_by_speed(struct usb_gadget *g,

    if (g->speed == USB_SPEED_HIGH && (usb_endpoint_xfer_isoc(_ep->desc) ||
    usb_endpoint_xfer_int(_ep->desc)))
    - _ep->mult = usb_endpoint_maxp(_ep->desc) & 0x7ff;
    + _ep->mult = ((usb_endpoint_maxp(_ep->desc) & 0x1800) >> 11) + 1;

    if (!want_comp_desc)
    return 0;
    @@ -1694,9 +1694,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
    value = min(w_length, (u16) 1);
    break;

    - /* function drivers must handle get/set altsetting; if there's
    - * no get() method, we know only altsetting zero works.
    - */
    + /* function drivers must handle get/set altsetting */
    case USB_REQ_SET_INTERFACE:
    if (ctrl->bRequestType != USB_RECIP_INTERFACE)
    goto unknown;
    @@ -1705,7 +1703,13 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
    f = cdev->config->interface[intf];
    if (!f)
    break;
    - if (w_value && !f->set_alt)
    +
    + /*
    + * If there's no get_alt() method, we know only altsetting zero
    + * works. There is no need to check if set_alt() is not NULL
    + * as we check this in usb_add_function().
    + */
    + if (w_value && !f->get_alt)
    break;
    value = f->set_alt(f, w_index, w_value);
    if (value == USB_GADGET_DELAYED_STATUS) {
    diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
    index 197f73386fac..d2351139342f 100644
    --- a/drivers/usb/gadget/function/f_tcm.c
    +++ b/drivers/usb/gadget/function/f_tcm.c
    @@ -1073,7 +1073,7 @@ static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu,
    struct usbg_cmd *cmd;
    int tag;

    - tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
    + tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING);
    if (tag < 0)
    return ERR_PTR(-ENOMEM);

    diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    index bd82dd12deff..1468d8f085a3 100644
    --- a/drivers/usb/gadget/legacy/inode.c
    +++ b/drivers/usb/gadget/legacy/inode.c
    @@ -1126,7 +1126,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    /* data and/or status stage for control request */
    } else if (dev->state == STATE_DEV_SETUP) {

    - /* IN DATA+STATUS caller makes len <= wLength */
    + len = min_t(size_t, len, dev->setup_wLength);
    if (dev->setup_in) {
    retval = setup_req (dev->gadget->ep0, dev->req, len);
    if (retval == 0) {
    @@ -1734,10 +1734,12 @@ static struct usb_gadget_driver gadgetfs_driver = {
    * such as configuration notifications.
    */

    -static int is_valid_config (struct usb_config_descriptor *config)
    +static int is_valid_config(struct usb_config_descriptor *config,
    + unsigned int total)
    {
    return config->bDescriptorType == USB_DT_CONFIG
    && config->bLength == USB_DT_CONFIG_SIZE
    + && total >= USB_DT_CONFIG_SIZE
    && config->bConfigurationValue != 0
    && (config->bmAttributes & USB_CONFIG_ATT_ONE) != 0
    && (config->bmAttributes & USB_CONFIG_ATT_WAKEUP) == 0;
    @@ -1762,7 +1764,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    }
    spin_unlock_irq(&dev->lock);

    - if (len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4))
    + if ((len < (USB_DT_CONFIG_SIZE + USB_DT_DEVICE_SIZE + 4)) ||
    + (len > PAGE_SIZE * 4))
    return -EINVAL;

    /* we might need to change message format someday */
    @@ -1786,7 +1789,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    /* full or low speed config */
    dev->config = (void *) kbuf;
    total = le16_to_cpu(dev->config->wTotalLength);
    - if (!is_valid_config (dev->config) || total >= length)
    + if (!is_valid_config(dev->config, total) ||
    + total > length - USB_DT_DEVICE_SIZE)
    goto fail;
    kbuf += total;
    length -= total;
    @@ -1795,10 +1799,13 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    if (kbuf [1] == USB_DT_CONFIG) {
    dev->hs_config = (void *) kbuf;
    total = le16_to_cpu(dev->hs_config->wTotalLength);
    - if (!is_valid_config (dev->hs_config) || total >= length)
    + if (!is_valid_config(dev->hs_config, total) ||
    + total > length - USB_DT_DEVICE_SIZE)
    goto fail;
    kbuf += total;
    length -= total;
    + } else {
    + dev->hs_config = NULL;
    }

    /* could support multiple configs, using another encoding! */
    diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
    index 9483489080f6..0402177f93cd 100644
    --- a/drivers/usb/gadget/udc/core.c
    +++ b/drivers/usb/gadget/udc/core.c
    @@ -1317,7 +1317,11 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver)
    if (!ret)
    break;
    }
    - if (!ret && !udc->driver)
    + if (ret)
    + ret = -ENODEV;
    + else if (udc->driver)
    + ret = -EBUSY;
    + else
    goto found;
    } else {
    list_for_each_entry(udc, &udc_list, list) {
    diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
    index 77d07904f932..a81d9ab861dc 100644
    --- a/drivers/usb/gadget/udc/dummy_hcd.c
    +++ b/drivers/usb/gadget/udc/dummy_hcd.c
    @@ -330,7 +330,7 @@ static void nuke(struct dummy *dum, struct dummy_ep *ep)
    /* caller must hold lock */
    static void stop_activity(struct dummy *dum)
    {
    - struct dummy_ep *ep;
    + int i;

    /* prevent any more requests */
    dum->address = 0;
    @@ -338,8 +338,8 @@ static void stop_activity(struct dummy *dum)
    /* The timer is left running so that outstanding URBs can fail */

    /* nuke any pending requests first, so driver i/o is quiesced */
    - list_for_each_entry(ep, &dum->gadget.ep_list, ep.ep_list)
    - nuke(dum, ep);
    + for (i = 0; i < DUMMY_ENDPOINTS; ++i)
    + nuke(dum, &dum->ep[i]);

    /* driver now does any non-usb quiescing necessary */
    }
    diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
    index 6afe32381209..7064892ff4a6 100644
    --- a/drivers/usb/host/xhci-mem.c
    +++ b/drivers/usb/host/xhci-mem.c
    @@ -979,6 +979,40 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
    xhci->devs[slot_id] = NULL;
    }

    +/*
    + * Free a virt_device structure.
    + * If the virt_device added a tt_info (a hub) and has children pointing to
    + * that tt_info, then free the child first. Recursive.
    + * We can't rely on udev at this point to find child-parent relationships.
    + */
    +void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
    +{
    + struct xhci_virt_device *vdev;
    + struct list_head *tt_list_head;
    + struct xhci_tt_bw_info *tt_info, *next;
    + int i;
    +
    + vdev = xhci->devs[slot_id];
    + if (!vdev)
    + return;
    +
    + tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
    + list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
    + /* is this a hub device that added a tt_info to the tts list */
    + if (tt_info->slot_id == slot_id) {
    + /* are any devices using this tt_info? */
    + for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
    + vdev = xhci->devs[i];
    + if (vdev && (vdev->tt_info == tt_info))
    + xhci_free_virt_devices_depth_first(
    + xhci, i);
    + }
    + }
    + }
    + /* we are now at a leaf device */
    + xhci_free_virt_device(xhci, slot_id);
    +}
    +
    int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
    struct usb_device *udev, gfp_t flags)
    {
    @@ -1796,7 +1830,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
    int size;
    int i, j, num_ports;

    - del_timer_sync(&xhci->cmd_timer);
    + cancel_delayed_work_sync(&xhci->cmd_timer);

    /* Free the Event Ring Segment Table and the actual Event Ring */
    size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
    @@ -1829,8 +1863,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
    }
    }

    - for (i = 1; i < MAX_HC_SLOTS; ++i)
    - xhci_free_virt_device(xhci, i);
    + for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
    + xhci_free_virt_devices_depth_first(xhci, i);

    dma_pool_destroy(xhci->segment_pool);
    xhci->segment_pool = NULL;
    @@ -2343,9 +2377,9 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)

    INIT_LIST_HEAD(&xhci->cmd_list);

    - /* init command timeout timer */
    - setup_timer(&xhci->cmd_timer, xhci_handle_command_timeout,
    - (unsigned long)xhci);
    + /* init command timeout work */
    + INIT_DELAYED_WORK(&xhci->cmd_timer, xhci_handle_command_timeout);
    + init_completion(&xhci->cmd_ring_stop_completion);

    page_size = readl(&xhci->op_regs->page_size);
    xhci_dbg_trace(xhci, trace_xhci_dbg_init,
    @@ -2384,7 +2418,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
    * "physically contiguous and 64-byte (cache line) aligned".
    */
    xhci->dcbaa = dma_alloc_coherent(dev, sizeof(*xhci->dcbaa), &dma,
    - GFP_KERNEL);
    + flags);
    if (!xhci->dcbaa)
    goto fail;
    memset(xhci->dcbaa, 0, sizeof *(xhci->dcbaa));
    @@ -2480,7 +2514,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)

    xhci->erst.entries = dma_alloc_coherent(dev,
    sizeof(struct xhci_erst_entry) * ERST_NUM_SEGS, &dma,
    - GFP_KERNEL);
    + flags);
    if (!xhci->erst.entries)
    goto fail;
    xhci_dbg_trace(xhci, trace_xhci_dbg_init,
    diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
    index 79959f17c38c..f2365a47fa4a 100644
    --- a/drivers/usb/host/xhci-mtk.c
    +++ b/drivers/usb/host/xhci-mtk.c
    @@ -560,8 +560,10 @@ static int xhci_mtk_probe(struct platform_device *pdev)
    goto disable_ldos;

    irq = platform_get_irq(pdev, 0);
    - if (irq < 0)
    + if (irq < 0) {
    + ret = irq;
    goto disable_clk;
    + }

    /* Initialize dma_mask and coherent_dma_mask to 32-bits */
    ret = dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
    diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    index e96ae80d107e..954abfd5014d 100644
    --- a/drivers/usb/host/xhci-pci.c
    +++ b/drivers/usb/host/xhci-pci.c
    @@ -165,7 +165,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
    pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
    pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
    - pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI)) {
    + pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
    + pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
    xhci->quirks |= XHCI_PME_STUCK_QUIRK;
    }
    if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    index 797137e26549..771a6da9caea 100644
    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -260,23 +260,76 @@ void xhci_ring_cmd_db(struct xhci_hcd *xhci)
    readl(&xhci->dba->doorbell[0]);
    }

    -static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    +static bool xhci_mod_cmd_timer(struct xhci_hcd *xhci, unsigned long delay)
    +{
    + return mod_delayed_work(system_wq, &xhci->cmd_timer, delay);
    +}
    +
    +static struct xhci_command *xhci_next_queued_cmd(struct xhci_hcd *xhci)
    +{
    + return list_first_entry_or_null(&xhci->cmd_list, struct xhci_command,
    + cmd_list);
    +}
    +
    +/*
    + * Turn all commands on command ring with status set to "aborted" to no-op trbs.
    + * If there are other commands waiting then restart the ring and kick the timer.
    + * This must be called with command ring stopped and xhci->lock held.
    + */
    +static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
    + struct xhci_command *cur_cmd)
    +{
    + struct xhci_command *i_cmd;
    + u32 cycle_state;
    +
    + /* Turn all aborted commands in list to no-ops, then restart */
    + list_for_each_entry(i_cmd, &xhci->cmd_list, cmd_list) {
    +
    + if (i_cmd->status != COMP_CMD_ABORT)
    + continue;
    +
    + i_cmd->status = COMP_CMD_STOP;
    +
    + xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
    + i_cmd->command_trb);
    + /* get cycle state from the original cmd trb */
    + cycle_state = le32_to_cpu(
    + i_cmd->command_trb->generic.field[3]) & TRB_CYCLE;
    + /* modify the command trb to no-op command */
    + i_cmd->command_trb->generic.field[0] = 0;
    + i_cmd->command_trb->generic.field[1] = 0;
    + i_cmd->command_trb->generic.field[2] = 0;
    + i_cmd->command_trb->generic.field[3] = cpu_to_le32(
    + TRB_TYPE(TRB_CMD_NOOP) | cycle_state);
    +
    + /*
    + * caller waiting for completion is called when command
    + * completion event is received for these no-op commands
    + */
    + }
    +
    + xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
    +
    + /* ring command ring doorbell to restart the command ring */
    + if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) &&
    + !(xhci->xhc_state & XHCI_STATE_DYING)) {
    + xhci->current_cmd = cur_cmd;
    + xhci_mod_cmd_timer(xhci, XHCI_CMD_DEFAULT_TIMEOUT);
    + xhci_ring_cmd_db(xhci);
    + }
    +}
    +
    +/* Must be called with xhci->lock held, releases and aquires lock back */
    +static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags)
    {
    u64 temp_64;
    int ret;

    xhci_dbg(xhci, "Abort command ring\n");

    - temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    - xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
    + reinit_completion(&xhci->cmd_ring_stop_completion);

    - /*
    - * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
    - * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
    - * but the completion event in never sent. Use the cmd timeout timer to
    - * handle those cases. Use twice the time to cover the bit polling retry
    - */
    - mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT));
    + temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
    &xhci->op_regs->cmd_ring);

    @@ -296,16 +349,30 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    udelay(1000);
    ret = xhci_handshake(&xhci->op_regs->cmd_ring,
    CMD_RING_RUNNING, 0, 3 * 1000 * 1000);
    - if (ret == 0)
    - return 0;
    -
    - xhci_err(xhci, "Stopped the command ring failed, "
    - "maybe the host is dead\n");
    - del_timer(&xhci->cmd_timer);
    - xhci->xhc_state |= XHCI_STATE_DYING;
    - xhci_quiesce(xhci);
    - xhci_halt(xhci);
    - return -ESHUTDOWN;
    + if (ret < 0) {
    + xhci_err(xhci, "Stopped the command ring failed, "
    + "maybe the host is dead\n");
    + xhci->xhc_state |= XHCI_STATE_DYING;
    + xhci_quiesce(xhci);
    + xhci_halt(xhci);
    + return -ESHUTDOWN;
    + }
    + }
    + /*
    + * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
    + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
    + * but the completion event in never sent. Wait 2 secs (arbitrary
    + * number) to handle those cases after negation of CMD_RING_RUNNING.
    + */
    + spin_unlock_irqrestore(&xhci->lock, flags);
    + ret = wait_for_completion_timeout(&xhci->cmd_ring_stop_completion,
    + msecs_to_jiffies(2000));
    + spin_lock_irqsave(&xhci->lock, flags);
    + if (!ret) {
    + xhci_dbg(xhci, "No stop event for abort, ring start fail?\n");
    + xhci_cleanup_command_queue(xhci);
    + } else {
    + xhci_handle_stopped_cmd_ring(xhci, xhci_next_queued_cmd(xhci));
    }

    return 0;
    @@ -1211,101 +1278,62 @@ void xhci_cleanup_command_queue(struct xhci_hcd *xhci)
    xhci_complete_del_and_free_cmd(cur_cmd, COMP_CMD_ABORT);
    }

    -/*
    - * Turn all commands on command ring with status set to "aborted" to no-op trbs.
    - * If there are other commands waiting then restart the ring and kick the timer.
    - * This must be called with command ring stopped and xhci->lock held.
    - */
    -static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
    - struct xhci_command *cur_cmd)
    -{
    - struct xhci_command *i_cmd, *tmp_cmd;
    - u32 cycle_state;
    -
    - /* Turn all aborted commands in list to no-ops, then restart */
    - list_for_each_entry_safe(i_cmd, tmp_cmd, &xhci->cmd_list,
    - cmd_list) {
    -
    - if (i_cmd->status != COMP_CMD_ABORT)
    - continue;
    -
    - i_cmd->status = COMP_CMD_STOP;
    -
    - xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
    - i_cmd->command_trb);
    - /* get cycle state from the original cmd trb */
    - cycle_state = le32_to_cpu(
    - i_cmd->command_trb->generic.field[3]) & TRB_CYCLE;
    - /* modify the command trb to no-op command */
    - i_cmd->command_trb->generic.field[0] = 0;
    - i_cmd->command_trb->generic.field[1] = 0;
    - i_cmd->command_trb->generic.field[2] = 0;
    - i_cmd->command_trb->generic.field[3] = cpu_to_le32(
    - TRB_TYPE(TRB_CMD_NOOP) | cycle_state);
    -
    - /*
    - * caller waiting for completion is called when command
    - * completion event is received for these no-op commands
    - */
    - }
    -
    - xhci->cmd_ring_state = CMD_RING_STATE_RUNNING;
    -
    - /* ring command ring doorbell to restart the command ring */
    - if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) &&
    - !(xhci->xhc_state & XHCI_STATE_DYING)) {
    - xhci->current_cmd = cur_cmd;
    - mod_timer(&xhci->cmd_timer, jiffies + XHCI_CMD_DEFAULT_TIMEOUT);
    - xhci_ring_cmd_db(xhci);
    - }
    - return;
    -}
    -
    -
    -void xhci_handle_command_timeout(unsigned long data)
    +void xhci_handle_command_timeout(struct work_struct *work)
    {
    struct xhci_hcd *xhci;
    int ret;
    unsigned long flags;
    u64 hw_ring_state;
    - bool second_timeout = false;
    - xhci = (struct xhci_hcd *) data;

    - /* mark this command to be cancelled */
    + xhci = container_of(to_delayed_work(work), struct xhci_hcd, cmd_timer);
    +
    spin_lock_irqsave(&xhci->lock, flags);
    - if (xhci->current_cmd) {
    - if (xhci->current_cmd->status == COMP_CMD_ABORT)
    - second_timeout = true;
    - xhci->current_cmd->status = COMP_CMD_ABORT;
    +
    + /*
    + * If timeout work is pending, or current_cmd is NULL, it means we
    + * raced with command completion. Command is handled so just return.
    + */
    + if (!xhci->current_cmd || delayed_work_pending(&xhci->cmd_timer)) {
    + spin_unlock_irqrestore(&xhci->lock, flags);
    + return;
    }
    + /* mark this command to be cancelled */
    + xhci->current_cmd->status = COMP_CMD_ABORT;

    /* Make sure command ring is running before aborting it */
    hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
    (hw_ring_state & CMD_RING_RUNNING)) {
    - spin_unlock_irqrestore(&xhci->lock, flags);
    + /* Prevent new doorbell, and start command abort */
    + xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
    xhci_dbg(xhci, "Command timeout\n");
    - ret = xhci_abort_cmd_ring(xhci);
    + ret = xhci_abort_cmd_ring(xhci, flags);
    if (unlikely(ret == -ESHUTDOWN)) {
    xhci_err(xhci, "Abort command ring failed\n");
    xhci_cleanup_command_queue(xhci);
    + spin_unlock_irqrestore(&xhci->lock, flags);
    usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
    xhci_dbg(xhci, "xHCI host controller is dead.\n");
    +
    + return;
    }
    - return;
    +
    + goto time_out_completed;
    }

    - /* command ring failed to restart, or host removed. Bail out */
    - if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) {
    - spin_unlock_irqrestore(&xhci->lock, flags);
    - xhci_dbg(xhci, "command timed out twice, ring start fail?\n");
    + /* host removed. Bail out */
    + if (xhci->xhc_state & XHCI_STATE_REMOVING) {
    + xhci_dbg(xhci, "host removed, ring start fail?\n");
    xhci_cleanup_command_queue(xhci);
    - return;
    +
    + goto time_out_completed;
    }

    /* command timeout on stopped ring, ring can't be aborted */
    xhci_dbg(xhci, "Command timeout on stopped ring\n");
    xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
    +
    +time_out_completed:
    spin_unlock_irqrestore(&xhci->lock, flags);
    return;
    }
    @@ -1338,7 +1366,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,

    cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);

    - del_timer(&xhci->cmd_timer);
    + cancel_delayed_work(&xhci->cmd_timer);

    trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);

    @@ -1346,7 +1374,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,

    /* If CMD ring stopped we own the trbs between enqueue and dequeue */
    if (cmd_comp_code == COMP_CMD_STOP) {
    - xhci_handle_stopped_cmd_ring(xhci, cmd);
    + complete_all(&xhci->cmd_ring_stop_completion);
    return;
    }

    @@ -1364,8 +1392,11 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
    */
    if (cmd_comp_code == COMP_CMD_ABORT) {
    xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    - if (cmd->status == COMP_CMD_ABORT)
    + if (cmd->status == COMP_CMD_ABORT) {
    + if (xhci->current_cmd == cmd)
    + xhci->current_cmd = NULL;
    goto event_handled;
    + }
    }

    cmd_type = TRB_FIELD_TO_TYPE(le32_to_cpu(cmd_trb->generic.field[3]));
    @@ -1426,7 +1457,9 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
    if (cmd->cmd_list.next != &xhci->cmd_list) {
    xhci->current_cmd = list_entry(cmd->cmd_list.next,
    struct xhci_command, cmd_list);
    - mod_timer(&xhci->cmd_timer, jiffies + XHCI_CMD_DEFAULT_TIMEOUT);
    + xhci_mod_cmd_timer(xhci, XHCI_CMD_DEFAULT_TIMEOUT);
    + } else if (xhci->current_cmd == cmd) {
    + xhci->current_cmd = NULL;
    }

    event_handled:
    @@ -3920,9 +3953,9 @@ static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,

    /* if there are no other commands queued we start the timeout timer */
    if (xhci->cmd_list.next == &cmd->cmd_list &&
    - !timer_pending(&xhci->cmd_timer)) {
    + !delayed_work_pending(&xhci->cmd_timer)) {
    xhci->current_cmd = cmd;
    - mod_timer(&xhci->cmd_timer, jiffies + XHCI_CMD_DEFAULT_TIMEOUT);
    + xhci_mod_cmd_timer(xhci, XHCI_CMD_DEFAULT_TIMEOUT);
    }

    queue_trb(xhci, xhci->cmd_ring, false, field1, field2, field3,
    diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    index 1a4ca02729c2..ad0624386950 100644
    --- a/drivers/usb/host/xhci.c
    +++ b/drivers/usb/host/xhci.c
    @@ -3783,8 +3783,10 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,

    mutex_lock(&xhci->mutex);

    - if (xhci->xhc_state) /* dying, removing or halted */
    + if (xhci->xhc_state) { /* dying, removing or halted */
    + ret = -ESHUTDOWN;
    goto out;
    + }

    if (!udev->slot_id) {
    xhci_dbg_trace(xhci, trace_xhci_dbg_address,
    diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    index f945380035d0..c525722aa934 100644
    --- a/drivers/usb/host/xhci.h
    +++ b/drivers/usb/host/xhci.h
    @@ -1571,7 +1571,8 @@ struct xhci_hcd {
    #define CMD_RING_STATE_STOPPED (1 << 2)
    struct list_head cmd_list;
    unsigned int cmd_ring_reserved_trbs;
    - struct timer_list cmd_timer;
    + struct delayed_work cmd_timer;
    + struct completion cmd_ring_stop_completion;
    struct xhci_command *current_cmd;
    struct xhci_ring *event_ring;
    struct xhci_erst erst;
    @@ -1941,7 +1942,7 @@ void xhci_queue_config_ep_quirk(struct xhci_hcd *xhci,
    unsigned int slot_id, unsigned int ep_index,
    struct xhci_dequeue_state *deq_state);
    void xhci_stop_endpoint_command_watchdog(unsigned long arg);
    -void xhci_handle_command_timeout(unsigned long data);
    +void xhci_handle_command_timeout(struct work_struct *work);

    void xhci_ring_ep_doorbell(struct xhci_hcd *xhci, unsigned int slot_id,
    unsigned int ep_index, unsigned int stream_id);
    diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
    index 310238c6b5cd..896798071817 100644
    --- a/drivers/usb/musb/blackfin.c
    +++ b/drivers/usb/musb/blackfin.c
    @@ -469,6 +469,7 @@ static const struct musb_platform_ops bfin_ops = {
    .init = bfin_musb_init,
    .exit = bfin_musb_exit,

    + .fifo_offset = bfin_fifo_offset,
    .readb = bfin_readb,
    .writeb = bfin_writeb,
    .readw = bfin_readw,
    diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
    index 91817d77d59c..47331dbdde29 100644
    --- a/drivers/usb/musb/musb_core.h
    +++ b/drivers/usb/musb/musb_core.h
    @@ -216,6 +216,7 @@ struct musb_platform_ops {
    void (*pre_root_reset_end)(struct musb *musb);
    void (*post_root_reset_end)(struct musb *musb);
    int (*phy_callback)(enum musb_vbus_id_status status);
    + void (*clear_ep_rxintr)(struct musb *musb, int epnum);
    };

    /*
    @@ -626,4 +627,10 @@ static inline void musb_platform_post_root_reset_end(struct musb *musb)
    musb->ops->post_root_reset_end(musb);
    }

    +static inline void musb_platform_clear_ep_rxintr(struct musb *musb, int epnum)
    +{
    + if (musb->ops->clear_ep_rxintr)
    + musb->ops->clear_ep_rxintr(musb, epnum);
    +}
    +
    #endif /* __MUSB_CORE_H__ */
    diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
    index feae1561b9ab..9f125e179acd 100644
    --- a/drivers/usb/musb/musb_dsps.c
    +++ b/drivers/usb/musb/musb_dsps.c
    @@ -267,6 +267,17 @@ static void otg_timer(unsigned long _musb)
    pm_runtime_put_autosuspend(dev);
    }

    +void dsps_musb_clear_ep_rxintr(struct musb *musb, int epnum)
    +{
    + u32 epintr;
    + struct dsps_glue *glue = dev_get_drvdata(musb->controller->parent);
    + const struct dsps_musb_wrapper *wrp = glue->wrp;
    +
    + /* musb->lock might already been held */
    + epintr = (1 << epnum) << wrp->rxep_shift;
    + musb_writel(musb->ctrl_base, wrp->epintr_status, epintr);
    +}
    +
    static irqreturn_t dsps_interrupt(int irq, void *hci)
    {
    struct musb *musb = hci;
    @@ -622,6 +633,7 @@ static struct musb_platform_ops dsps_ops = {

    .set_mode = dsps_musb_set_mode,
    .recover = dsps_musb_recover,
    + .clear_ep_rxintr = dsps_musb_clear_ep_rxintr,
    };

    static u64 musb_dmamask = DMA_BIT_MASK(32);
    diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
    index 53bc4ceefe89..806451418cfe 100644
    --- a/drivers/usb/musb/musb_host.c
    +++ b/drivers/usb/musb/musb_host.c
    @@ -2374,12 +2374,11 @@ static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
    int is_in = usb_pipein(urb->pipe);
    int status = 0;
    u16 csr;
    + struct dma_channel *dma = NULL;

    musb_ep_select(regs, hw_end);

    if (is_dma_capable()) {
    - struct dma_channel *dma;
    -
    dma = is_in ? ep->rx_channel : ep->tx_channel;
    if (dma) {
    status = ep->musb->dma_controller->channel_abort(dma);
    @@ -2395,10 +2394,9 @@ static int musb_cleanup_urb(struct urb *urb, struct musb_qh *qh)
    /* giveback saves bulk toggle */
    csr = musb_h_flush_rxfifo(ep, 0);

    - /* REVISIT we still get an irq; should likely clear the
    - * endpoint's irq status here to avoid bogus irqs.
    - * clearing that status is platform-specific...
    - */
    + /* clear the endpoint's irq status here to avoid bogus irqs */
    + if (is_dma_capable() && dma)
    + musb_platform_clear_ep_rxintr(musb, ep->epnum);
    } else if (ep->epnum) {
    musb_h_tx_flush_fifo(ep);
    csr = musb_readw(epio, MUSB_TXCSR);
    diff --git a/drivers/usb/musb/musbhsdma.h b/drivers/usb/musb/musbhsdma.h
    index f7b13fd25257..a3dcbd55e436 100644
    --- a/drivers/usb/musb/musbhsdma.h
    +++ b/drivers/usb/musb/musbhsdma.h
    @@ -157,5 +157,5 @@ struct musb_dma_controller {
    void __iomem *base;
    u8 channel_count;
    u8 used_channels;
    - u8 irq;
    + int irq;
    };
    diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
    index 42a1afe36a90..5f5f19813fde 100644
    --- a/drivers/usb/phy/phy-am335x-control.c
    +++ b/drivers/usb/phy/phy-am335x-control.c
    @@ -134,10 +134,12 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
    return NULL;

    dev = bus_find_device(&platform_bus_type, NULL, node, match);
    + of_node_put(node);
    if (!dev)
    return NULL;

    ctrl_usb = dev_get_drvdata(dev);
    + put_device(dev);
    if (!ctrl_usb)
    return NULL;
    return &ctrl_usb->phy_ctrl;
    diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
    index 5f17a3b9916d..80260b08398b 100644
    --- a/drivers/usb/serial/cyberjack.c
    +++ b/drivers/usb/serial/cyberjack.c
    @@ -50,6 +50,7 @@
    #define CYBERJACK_PRODUCT_ID 0x0100

    /* Function prototypes */
    +static int cyberjack_attach(struct usb_serial *serial);
    static int cyberjack_port_probe(struct usb_serial_port *port);
    static int cyberjack_port_remove(struct usb_serial_port *port);
    static int cyberjack_open(struct tty_struct *tty,
    @@ -77,6 +78,7 @@ static struct usb_serial_driver cyberjack_device = {
    .description = "Reiner SCT Cyberjack USB card reader",
    .id_table = id_table,
    .num_ports = 1,
    + .attach = cyberjack_attach,
    .port_probe = cyberjack_port_probe,
    .port_remove = cyberjack_port_remove,
    .open = cyberjack_open,
    @@ -100,6 +102,14 @@ struct cyberjack_private {
    short wrsent; /* Data already sent */
    };

    +static int cyberjack_attach(struct usb_serial *serial)
    +{
    + if (serial->num_bulk_out < serial->num_ports)
    + return -ENODEV;
    +
    + return 0;
    +}
    +
    static int cyberjack_port_probe(struct usb_serial_port *port)
    {
    struct cyberjack_private *priv;
    diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
    index 97cabf803c2f..b2f2e87aed94 100644
    --- a/drivers/usb/serial/garmin_gps.c
    +++ b/drivers/usb/serial/garmin_gps.c
    @@ -1043,6 +1043,7 @@ static int garmin_write_bulk(struct usb_serial_port *port,
    "%s - usb_submit_urb(write bulk) failed with status = %d\n",
    __func__, status);
    count = status;
    + kfree(buffer);
    }

    /* we are done with this urb, so let the host driver
    diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
    index 11c05ce2f35f..36dfe9972b17 100644
    --- a/drivers/usb/serial/io_edgeport.c
    +++ b/drivers/usb/serial/io_edgeport.c
    @@ -2754,6 +2754,11 @@ static int edge_startup(struct usb_serial *serial)
    EDGE_COMPATIBILITY_MASK1,
    EDGE_COMPATIBILITY_MASK2 };

    + if (serial->num_bulk_in < 1 || serial->num_interrupt_in < 1) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    dev = serial->dev;

    /* create our private serial structure */
    diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
    index fce82fd79f77..c02808a30436 100644
    --- a/drivers/usb/serial/io_ti.c
    +++ b/drivers/usb/serial/io_ti.c
    @@ -1499,8 +1499,7 @@ static int do_boot_mode(struct edgeport_serial *serial,

    dev_dbg(dev, "%s - Download successful -- Device rebooting...\n", __func__);

    - /* return an error on purpose */
    - return -ENODEV;
    + return 1;
    }

    stayinbootmode:
    @@ -1508,7 +1507,7 @@ static int do_boot_mode(struct edgeport_serial *serial,
    dev_dbg(dev, "%s - STAYING IN BOOT MODE\n", __func__);
    serial->product_info.TiMode = TI_MODE_BOOT;

    - return 0;
    + return 1;
    }

    static int ti_do_config(struct edgeport_port *port, int feature, int on)
    @@ -2549,6 +2548,13 @@ static int edge_startup(struct usb_serial *serial)
    int status;
    u16 product_id;

    + /* Make sure we have the required endpoints when in download mode. */
    + if (serial->interface->cur_altsetting->desc.bNumEndpoints > 1) {
    + if (serial->num_bulk_in < serial->num_ports ||
    + serial->num_bulk_out < serial->num_ports)
    + return -ENODEV;
    + }
    +
    /* create our private serial structure */
    edge_serial = kzalloc(sizeof(struct edgeport_serial), GFP_KERNEL);
    if (!edge_serial)
    @@ -2556,14 +2562,18 @@ static int edge_startup(struct usb_serial *serial)

    mutex_init(&edge_serial->es_lock);
    edge_serial->serial = serial;
    + INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work);
    usb_set_serial_data(serial, edge_serial);

    status = download_fw(edge_serial);
    - if (status) {
    + if (status < 0) {
    kfree(edge_serial);
    return status;
    }

    + if (status > 0)
    + return 1; /* bind but do not register any ports */
    +
    product_id = le16_to_cpu(
    edge_serial->serial->dev->descriptor.idProduct);

    @@ -2575,7 +2585,6 @@ static int edge_startup(struct usb_serial *serial)
    }
    }

    - INIT_DELAYED_WORK(&edge_serial->heartbeat_work, edge_heartbeat_work);
    edge_heartbeat_schedule(edge_serial);

    return 0;
    @@ -2583,6 +2592,9 @@ static int edge_startup(struct usb_serial *serial)

    static void edge_disconnect(struct usb_serial *serial)
    {
    + struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
    +
    + cancel_delayed_work_sync(&edge_serial->heartbeat_work);
    }

    static void edge_release(struct usb_serial *serial)
    diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
    index 344b4eea4bd5..d57fb5199218 100644
    --- a/drivers/usb/serial/iuu_phoenix.c
    +++ b/drivers/usb/serial/iuu_phoenix.c
    @@ -68,6 +68,16 @@ struct iuu_private {
    u32 clk;
    };

    +static int iuu_attach(struct usb_serial *serial)
    +{
    + unsigned char num_ports = serial->num_ports;
    +
    + if (serial->num_bulk_in < num_ports || serial->num_bulk_out < num_ports)
    + return -ENODEV;
    +
    + return 0;
    +}
    +
    static int iuu_port_probe(struct usb_serial_port *port)
    {
    struct iuu_private *priv;
    @@ -1196,6 +1206,7 @@ static struct usb_serial_driver iuu_device = {
    .tiocmset = iuu_tiocmset,
    .set_termios = iuu_set_termios,
    .init_termios = iuu_init_termios,
    + .attach = iuu_attach,
    .port_probe = iuu_port_probe,
    .port_remove = iuu_port_remove,
    };
    diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
    index e49ad0c63ad8..83523fcf6fb9 100644
    --- a/drivers/usb/serial/keyspan_pda.c
    +++ b/drivers/usb/serial/keyspan_pda.c
    @@ -699,6 +699,19 @@ MODULE_FIRMWARE("keyspan_pda/keyspan_pda.fw");
    MODULE_FIRMWARE("keyspan_pda/xircom_pgs.fw");
    #endif

    +static int keyspan_pda_attach(struct usb_serial *serial)
    +{
    + unsigned char num_ports = serial->num_ports;
    +
    + if (serial->num_bulk_out < num_ports ||
    + serial->num_interrupt_in < num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int keyspan_pda_port_probe(struct usb_serial_port *port)
    {

    @@ -776,6 +789,7 @@ static struct usb_serial_driver keyspan_pda_device = {
    .break_ctl = keyspan_pda_break_ctl,
    .tiocmget = keyspan_pda_tiocmget,
    .tiocmset = keyspan_pda_tiocmset,
    + .attach = keyspan_pda_attach,
    .port_probe = keyspan_pda_port_probe,
    .port_remove = keyspan_pda_port_remove,
    };
    diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
    index 6f29bfadbe33..0ee190fc1bf8 100644
    --- a/drivers/usb/serial/kl5kusb105.c
    +++ b/drivers/usb/serial/kl5kusb105.c
    @@ -311,6 +311,7 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
    if (rc < 0) {
    dev_err(&port->dev, "Enabling read failed (error = %d)\n", rc);
    retval = rc;
    + goto err_generic_close;
    } else
    dev_dbg(&port->dev, "%s - enabled reading\n", __func__);

    @@ -337,6 +338,7 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
    0, /* index */
    NULL, 0,
    KLSI_TIMEOUT);
    +err_generic_close:
    usb_serial_generic_close(port);
    err_free_cfg:
    kfree(cfg);
    diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
    index 2363654cafc9..813035f51fe7 100644
    --- a/drivers/usb/serial/kobil_sct.c
    +++ b/drivers/usb/serial/kobil_sct.c
    @@ -51,6 +51,7 @@


    /* Function prototypes */
    +static int kobil_attach(struct usb_serial *serial);
    static int kobil_port_probe(struct usb_serial_port *probe);
    static int kobil_port_remove(struct usb_serial_port *probe);
    static int kobil_open(struct tty_struct *tty, struct usb_serial_port *port);
    @@ -86,6 +87,7 @@ static struct usb_serial_driver kobil_device = {
    .description = "KOBIL USB smart card terminal",
    .id_table = id_table,
    .num_ports = 1,
    + .attach = kobil_attach,
    .port_probe = kobil_port_probe,
    .port_remove = kobil_port_remove,
    .ioctl = kobil_ioctl,
    @@ -113,6 +115,16 @@ struct kobil_private {
    };


    +static int kobil_attach(struct usb_serial *serial)
    +{
    + if (serial->num_interrupt_out < serial->num_ports) {
    + dev_err(&serial->interface->dev, "missing interrupt-out endpoint\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int kobil_port_probe(struct usb_serial_port *port)
    {
    struct usb_serial *serial = port->serial;
    diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    index de9992b492b0..136ff5e1b7c1 100644
    --- a/drivers/usb/serial/mos7720.c
    +++ b/drivers/usb/serial/mos7720.c
    @@ -65,8 +65,6 @@ struct moschip_port {
    struct urb *write_urb_pool[NUM_URBS];
    };

    -static struct usb_serial_driver moschip7720_2port_driver;
    -
    #define USB_VENDOR_ID_MOSCHIP 0x9710
    #define MOSCHIP_DEVICE_ID_7720 0x7720
    #define MOSCHIP_DEVICE_ID_7715 0x7715
    @@ -970,25 +968,6 @@ static void mos7720_bulk_out_data_callback(struct urb *urb)
    tty_port_tty_wakeup(&mos7720_port->port->port);
    }

    -/*
    - * mos77xx_probe
    - * this function installs the appropriate read interrupt endpoint callback
    - * depending on whether the device is a 7720 or 7715, thus avoiding costly
    - * run-time checks in the high-frequency callback routine itself.
    - */
    -static int mos77xx_probe(struct usb_serial *serial,
    - const struct usb_device_id *id)
    -{
    - if (id->idProduct == MOSCHIP_DEVICE_ID_7715)
    - moschip7720_2port_driver.read_int_callback =
    - mos7715_interrupt_callback;
    - else
    - moschip7720_2port_driver.read_int_callback =
    - mos7720_interrupt_callback;
    -
    - return 0;
    -}
    -
    static int mos77xx_calc_num_ports(struct usb_serial *serial)
    {
    u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
    @@ -1920,6 +1899,11 @@ static int mos7720_startup(struct usb_serial *serial)
    u16 product;
    int ret_val;

    + if (serial->num_bulk_in < 2 || serial->num_bulk_out < 2) {
    + dev_err(&serial->interface->dev, "missing bulk endpoints\n");
    + return -ENODEV;
    + }
    +
    product = le16_to_cpu(serial->dev->descriptor.idProduct);
    dev = serial->dev;

    @@ -1944,19 +1928,18 @@ static int mos7720_startup(struct usb_serial *serial)
    tmp->interrupt_in_endpointAddress;
    serial->port[1]->interrupt_in_urb = NULL;
    serial->port[1]->interrupt_in_buffer = NULL;
    +
    + if (serial->port[0]->interrupt_in_urb) {
    + struct urb *urb = serial->port[0]->interrupt_in_urb;
    +
    + urb->complete = mos7715_interrupt_callback;
    + }
    }

    /* setting configuration feature to one */
    usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
    (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000);

    - /* start the interrupt urb */
    - ret_val = usb_submit_urb(serial->port[0]->interrupt_in_urb, GFP_KERNEL);
    - if (ret_val)
    - dev_err(&dev->dev,
    - "%s - Error %d submitting control urb\n",
    - __func__, ret_val);
    -
    #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
    if (product == MOSCHIP_DEVICE_ID_7715) {
    ret_val = mos7715_parport_init(serial);
    @@ -1964,6 +1947,13 @@ static int mos7720_startup(struct usb_serial *serial)
    return ret_val;
    }
    #endif
    + /* start the interrupt urb */
    + ret_val = usb_submit_urb(serial->port[0]->interrupt_in_urb, GFP_KERNEL);
    + if (ret_val) {
    + dev_err(&dev->dev, "failed to submit interrupt urb: %d\n",
    + ret_val);
    + }
    +
    /* LSR For Port 1 */
    read_mos_reg(serial, 0, MOS7720_LSR, &data);
    dev_dbg(&dev->dev, "LSR:%x\n", data);
    @@ -1973,6 +1963,8 @@ static int mos7720_startup(struct usb_serial *serial)

    static void mos7720_release(struct usb_serial *serial)
    {
    + usb_kill_urb(serial->port[0]->interrupt_in_urb);
    +
    #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
    /* close the parallel port */

    @@ -2056,7 +2048,6 @@ static struct usb_serial_driver moschip7720_2port_driver = {
    .close = mos7720_close,
    .throttle = mos7720_throttle,
    .unthrottle = mos7720_unthrottle,
    - .probe = mos77xx_probe,
    .attach = mos7720_startup,
    .release = mos7720_release,
    .port_probe = mos7720_port_probe,
    @@ -2070,7 +2061,7 @@ static struct usb_serial_driver moschip7720_2port_driver = {
    .chars_in_buffer = mos7720_chars_in_buffer,
    .break_ctl = mos7720_break,
    .read_bulk_callback = mos7720_bulk_in_callback,
    - .read_int_callback = NULL /* dynamically assigned in probe() */
    + .read_int_callback = mos7720_interrupt_callback,
    };

    static struct usb_serial_driver * const serial_drivers[] = {
    diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
    index 57426d703a09..4f9af47e6a29 100644
    --- a/drivers/usb/serial/mos7840.c
    +++ b/drivers/usb/serial/mos7840.c
    @@ -2116,6 +2116,17 @@ static int mos7840_calc_num_ports(struct usb_serial *serial)
    return mos7840_num_ports;
    }

    +static int mos7840_attach(struct usb_serial *serial)
    +{
    + if (serial->num_bulk_in < serial->num_ports ||
    + serial->num_bulk_out < serial->num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int mos7840_port_probe(struct usb_serial_port *port)
    {
    struct usb_serial *serial = port->serial;
    @@ -2391,6 +2402,7 @@ static struct usb_serial_driver moschip7840_4port_device = {
    .tiocmset = mos7840_tiocmset,
    .tiocmiwait = usb_serial_generic_tiocmiwait,
    .get_icount = usb_serial_generic_get_icount,
    + .attach = mos7840_attach,
    .port_probe = mos7840_port_probe,
    .port_remove = mos7840_port_remove,
    .read_bulk_callback = mos7840_bulk_in_callback,
    diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
    index f6c6900bccf0..a180b17d2432 100644
    --- a/drivers/usb/serial/omninet.c
    +++ b/drivers/usb/serial/omninet.c
    @@ -38,6 +38,7 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port,
    const unsigned char *buf, int count);
    static int omninet_write_room(struct tty_struct *tty);
    static void omninet_disconnect(struct usb_serial *serial);
    +static int omninet_attach(struct usb_serial *serial);
    static int omninet_port_probe(struct usb_serial_port *port);
    static int omninet_port_remove(struct usb_serial_port *port);

    @@ -56,6 +57,7 @@ static struct usb_serial_driver zyxel_omninet_device = {
    .description = "ZyXEL - omni.net lcd plus usb",
    .id_table = id_table,
    .num_ports = 1,
    + .attach = omninet_attach,
    .port_probe = omninet_port_probe,
    .port_remove = omninet_port_remove,
    .open = omninet_open,
    @@ -104,6 +106,17 @@ struct omninet_data {
    __u8 od_outseq; /* Sequence number for bulk_out URBs */
    };

    +static int omninet_attach(struct usb_serial *serial)
    +{
    + /* The second bulk-out endpoint is used for writing. */
    + if (serial->num_bulk_out < 2) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int omninet_port_probe(struct usb_serial_port *port)
    {
    struct omninet_data *od;
    diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
    index a4b88bc038b6..b8bf52bf7a94 100644
    --- a/drivers/usb/serial/oti6858.c
    +++ b/drivers/usb/serial/oti6858.c
    @@ -134,6 +134,7 @@ static int oti6858_chars_in_buffer(struct tty_struct *tty);
    static int oti6858_tiocmget(struct tty_struct *tty);
    static int oti6858_tiocmset(struct tty_struct *tty,
    unsigned int set, unsigned int clear);
    +static int oti6858_attach(struct usb_serial *serial);
    static int oti6858_port_probe(struct usb_serial_port *port);
    static int oti6858_port_remove(struct usb_serial_port *port);

    @@ -158,6 +159,7 @@ static struct usb_serial_driver oti6858_device = {
    .write_bulk_callback = oti6858_write_bulk_callback,
    .write_room = oti6858_write_room,
    .chars_in_buffer = oti6858_chars_in_buffer,
    + .attach = oti6858_attach,
    .port_probe = oti6858_port_probe,
    .port_remove = oti6858_port_remove,
    };
    @@ -324,6 +326,20 @@ static void send_data(struct work_struct *work)
    usb_serial_port_softint(port);
    }

    +static int oti6858_attach(struct usb_serial *serial)
    +{
    + unsigned char num_ports = serial->num_ports;
    +
    + if (serial->num_bulk_in < num_ports ||
    + serial->num_bulk_out < num_ports ||
    + serial->num_interrupt_in < num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int oti6858_port_probe(struct usb_serial_port *port)
    {
    struct oti6858_private *priv;
    diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
    index ae682e4eeaef..46fca6b75846 100644
    --- a/drivers/usb/serial/pl2303.c
    +++ b/drivers/usb/serial/pl2303.c
    @@ -220,9 +220,17 @@ static int pl2303_probe(struct usb_serial *serial,
    static int pl2303_startup(struct usb_serial *serial)
    {
    struct pl2303_serial_private *spriv;
    + unsigned char num_ports = serial->num_ports;
    enum pl2303_type type = TYPE_01;
    unsigned char *buf;

    + if (serial->num_bulk_in < num_ports ||
    + serial->num_bulk_out < num_ports ||
    + serial->num_interrupt_in < num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    spriv = kzalloc(sizeof(*spriv), GFP_KERNEL);
    if (!spriv)
    return -ENOMEM;
    diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
    index 85acb50a7ee2..bd1a1307e0f0 100644
    --- a/drivers/usb/serial/quatech2.c
    +++ b/drivers/usb/serial/quatech2.c
    @@ -408,16 +408,12 @@ static void qt2_close(struct usb_serial_port *port)
    {
    struct usb_serial *serial;
    struct qt2_port_private *port_priv;
    - unsigned long flags;
    int i;

    serial = port->serial;
    port_priv = usb_get_serial_port_data(port);

    - spin_lock_irqsave(&port_priv->urb_lock, flags);
    usb_kill_urb(port_priv->write_urb);
    - port_priv->urb_in_use = false;
    - spin_unlock_irqrestore(&port_priv->urb_lock, flags);

    /* flush the port transmit buffer */
    i = usb_control_msg(serial->dev,
    diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
    index ef0dbf0703c5..475e6c31b266 100644
    --- a/drivers/usb/serial/spcp8x5.c
    +++ b/drivers/usb/serial/spcp8x5.c
    @@ -154,6 +154,19 @@ static int spcp8x5_probe(struct usb_serial *serial,
    return 0;
    }

    +static int spcp8x5_attach(struct usb_serial *serial)
    +{
    + unsigned char num_ports = serial->num_ports;
    +
    + if (serial->num_bulk_in < num_ports ||
    + serial->num_bulk_out < num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + return -ENODEV;
    + }
    +
    + return 0;
    +}
    +
    static int spcp8x5_port_probe(struct usb_serial_port *port)
    {
    const struct usb_device_id *id = usb_get_serial_data(port->serial);
    @@ -477,6 +490,7 @@ static struct usb_serial_driver spcp8x5_device = {
    .tiocmget = spcp8x5_tiocmget,
    .tiocmset = spcp8x5_tiocmset,
    .probe = spcp8x5_probe,
    + .attach = spcp8x5_attach,
    .port_probe = spcp8x5_port_probe,
    .port_remove = spcp8x5_port_remove,
    };
    diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    index a8b9bdba314f..bdbddbc8bd4d 100644
    --- a/drivers/usb/serial/ti_usb_3410_5052.c
    +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    @@ -579,6 +579,13 @@ static int ti_startup(struct usb_serial *serial)
    goto free_tdev;
    }

    + if (serial->num_bulk_in < serial->num_ports ||
    + serial->num_bulk_out < serial->num_ports) {
    + dev_err(&serial->interface->dev, "missing endpoints\n");
    + status = -ENODEV;
    + goto free_tdev;
    + }
    +
    return 0;

    free_tdev:
    diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    index af3c7eecff91..16cc18369111 100644
    --- a/drivers/usb/storage/unusual_devs.h
    +++ b/drivers/usb/storage/unusual_devs.h
    @@ -2109,6 +2109,13 @@ UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114,
    USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    US_FL_BROKEN_FUA ),

    +/* Reported-by George Cherian <george.cherian@cavium.com> */
    +UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
    + "JMicron",
    + "JMS56x",
    + USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    + US_FL_NO_REPORT_OPCODES),
    +
    /*
    * Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
    * and Mac USB Dock USB-SCSI */
    diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
    index 6865663aac69..abc18847b98d 100644
    --- a/fs/crypto/policy.c
    +++ b/fs/crypto/policy.c
    @@ -171,6 +171,11 @@ int fscrypt_has_permitted_context(struct inode *parent, struct inode *child)
    BUG_ON(1);
    }

    + /* No restrictions on file types which are never encrypted */
    + if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) &&
    + !S_ISLNK(child->i_mode))
    + return 1;
    +
    /* no restrictions if the parent directory is not encrypted */
    if (!parent->i_sb->s_cop->is_encrypted(parent))
    return 1;
    diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
    index 9ae194fd2fdb..14db4b712021 100644
    --- a/fs/f2fs/data.c
    +++ b/fs/f2fs/data.c
    @@ -716,7 +716,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
    }

    prealloc = 0;
    - ofs_in_node = dn.ofs_in_node;
    + last_ofs_in_node = ofs_in_node = dn.ofs_in_node;
    end_offset = ADDRS_PER_PAGE(dn.node_page, inode);

    next_block:
    diff --git a/fs/f2fs/debug.c b/fs/f2fs/debug.c
    index 1c35e80732e0..687998e9557c 100644
    --- a/fs/f2fs/debug.c
    +++ b/fs/f2fs/debug.c
    @@ -310,17 +310,17 @@ static int stat_show(struct seq_file *s, void *v)
    seq_printf(s, " - Inner Struct Count: tree: %d(%d), node: %d\n",
    si->ext_tree, si->zombie_tree, si->ext_node);
    seq_puts(s, "\nBalancing F2FS Async:\n");
    - seq_printf(s, " - inmem: %4lld, wb_bios: %4d\n",
    + seq_printf(s, " - inmem: %4d, wb_bios: %4d\n",
    si->inmem_pages, si->wb_bios);
    - seq_printf(s, " - nodes: %4lld in %4d\n",
    + seq_printf(s, " - nodes: %4d in %4d\n",
    si->ndirty_node, si->node_pages);
    - seq_printf(s, " - dents: %4lld in dirs:%4d (%4d)\n",
    + seq_printf(s, " - dents: %4d in dirs:%4d (%4d)\n",
    si->ndirty_dent, si->ndirty_dirs, si->ndirty_all);
    - seq_printf(s, " - datas: %4lld in files:%4d\n",
    + seq_printf(s, " - datas: %4d in files:%4d\n",
    si->ndirty_data, si->ndirty_files);
    - seq_printf(s, " - meta: %4lld in %4d\n",
    + seq_printf(s, " - meta: %4d in %4d\n",
    si->ndirty_meta, si->meta_pages);
    - seq_printf(s, " - imeta: %4lld\n",
    + seq_printf(s, " - imeta: %4d\n",
    si->ndirty_imeta);
    seq_printf(s, " - NATs: %9d/%9d\n - SITs: %9d/%9d\n",
    si->dirty_nats, si->nats, si->dirty_sits, si->sits);
    diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
    index 6dd03115789b..506af456412f 100644
    --- a/fs/f2fs/f2fs.h
    +++ b/fs/f2fs/f2fs.h
    @@ -819,7 +819,7 @@ struct f2fs_sb_info {
    atomic_t nr_wb_bios; /* # of writeback bios */

    /* # of pages, see count_type */
    - struct percpu_counter nr_pages[NR_COUNT_TYPE];
    + atomic_t nr_pages[NR_COUNT_TYPE];
    /* # of allocated blocks */
    struct percpu_counter alloc_valid_block_count;

    @@ -1233,7 +1233,7 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi,

    static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type)
    {
    - percpu_counter_inc(&sbi->nr_pages[count_type]);
    + atomic_inc(&sbi->nr_pages[count_type]);

    if (count_type == F2FS_DIRTY_DATA || count_type == F2FS_INMEM_PAGES)
    return;
    @@ -1250,7 +1250,7 @@ static inline void inode_inc_dirty_pages(struct inode *inode)

    static inline void dec_page_count(struct f2fs_sb_info *sbi, int count_type)
    {
    - percpu_counter_dec(&sbi->nr_pages[count_type]);
    + atomic_dec(&sbi->nr_pages[count_type]);
    }

    static inline void inode_dec_dirty_pages(struct inode *inode)
    @@ -1266,7 +1266,7 @@ static inline void inode_dec_dirty_pages(struct inode *inode)

    static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type)
    {
    - return percpu_counter_sum_positive(&sbi->nr_pages[count_type]);
    + return atomic_read(&sbi->nr_pages[count_type]);
    }

    static inline int get_dirty_pages(struct inode *inode)
    @@ -2187,8 +2187,8 @@ struct f2fs_stat_info {
    unsigned long long hit_largest, hit_cached, hit_rbtree;
    unsigned long long hit_total, total_ext;
    int ext_tree, zombie_tree, ext_node;
    - s64 ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta;
    - s64 inmem_pages;
    + int ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta;
    + int inmem_pages;
    unsigned int ndirty_dirs, ndirty_files, ndirty_all;
    int nats, dirty_nats, sits, dirty_sits, fnids;
    int total_count, utilization;
    diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
    index 8021d35df7b0..013c6a541d6b 100644
    --- a/fs/f2fs/super.c
    +++ b/fs/f2fs/super.c
    @@ -688,10 +688,6 @@ static void f2fs_destroy_inode(struct inode *inode)

    static void destroy_percpu_info(struct f2fs_sb_info *sbi)
    {
    - int i;
    -
    - for (i = 0; i < NR_COUNT_TYPE; i++)
    - percpu_counter_destroy(&sbi->nr_pages[i]);
    percpu_counter_destroy(&sbi->alloc_valid_block_count);
    percpu_counter_destroy(&sbi->total_valid_inode_count);
    }
    @@ -1442,6 +1438,7 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
    static void init_sb_info(struct f2fs_sb_info *sbi)
    {
    struct f2fs_super_block *raw_super = sbi->raw_super;
    + int i;

    sbi->log_sectors_per_block =
    le32_to_cpu(raw_super->log_sectors_per_block);
    @@ -1466,6 +1463,9 @@ static void init_sb_info(struct f2fs_sb_info *sbi)
    sbi->interval_time[REQ_TIME] = DEF_IDLE_INTERVAL;
    clear_sbi_flag(sbi, SBI_NEED_FSCK);

    + for (i = 0; i < NR_COUNT_TYPE; i++)
    + atomic_set(&sbi->nr_pages[i], 0);
    +
    INIT_LIST_HEAD(&sbi->s_list);
    mutex_init(&sbi->umount_mutex);
    mutex_init(&sbi->wio_mutex[NODE]);
    @@ -1481,13 +1481,7 @@ static void init_sb_info(struct f2fs_sb_info *sbi)

    static int init_percpu_info(struct f2fs_sb_info *sbi)
    {
    - int i, err;
    -
    - for (i = 0; i < NR_COUNT_TYPE; i++) {
    - err = percpu_counter_init(&sbi->nr_pages[i], 0, GFP_KERNEL);
    - if (err)
    - return err;
    - }
    + int err;

    err = percpu_counter_init(&sbi->alloc_valid_block_count, 0, GFP_KERNEL);
    if (err)
    diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c
    index e5ebc3770460..d346d42c54d1 100644
    --- a/fs/xfs/libxfs/xfs_ag_resv.c
    +++ b/fs/xfs/libxfs/xfs_ag_resv.c
    @@ -256,6 +256,9 @@ xfs_ag_resv_init(
    goto out;
    }

    + ASSERT(xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved +
    + xfs_perag_resv(pag, XFS_AG_RESV_AGFL)->ar_reserved <=
    + pag->pagf_freeblks + pag->pagf_flcount);
    out:
    return error;
    }
    diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
    index effb64cf714f..5050056a0b06 100644
    --- a/fs/xfs/libxfs/xfs_alloc.c
    +++ b/fs/xfs/libxfs/xfs_alloc.c
    @@ -2455,12 +2455,15 @@ xfs_agf_verify(
    be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp)))
    return false;

    - if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS ||
    + if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 ||
    + be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) < 1 ||
    + be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) > XFS_BTREE_MAXLEVELS ||
    be32_to_cpu(agf->agf_levels[XFS_BTNUM_CNT]) > XFS_BTREE_MAXLEVELS)
    return false;

    if (xfs_sb_version_hasrmapbt(&mp->m_sb) &&
    - be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS)
    + (be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) < 1 ||
    + be32_to_cpu(agf->agf_levels[XFS_BTNUM_RMAP]) > XFS_BTREE_MAXLEVELS))
    return false;

    /*
    @@ -2477,7 +2480,8 @@ xfs_agf_verify(
    return false;

    if (xfs_sb_version_hasreflink(&mp->m_sb) &&
    - be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS)
    + (be32_to_cpu(agf->agf_refcount_level) < 1 ||
    + be32_to_cpu(agf->agf_refcount_level) > XFS_BTREE_MAXLEVELS))
    return false;

    return true;;
    diff --git a/fs/xfs/libxfs/xfs_alloc_btree.c b/fs/xfs/libxfs/xfs_alloc_btree.c
    index 5ba2dac5e67c..c06ec77a9418 100644
    --- a/fs/xfs/libxfs/xfs_alloc_btree.c
    +++ b/fs/xfs/libxfs/xfs_alloc_btree.c
    @@ -421,7 +421,7 @@ xfs_allocbt_init_cursor(

    ASSERT(btnum == XFS_BTNUM_BNO || btnum == XFS_BTNUM_CNT);

    - cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_SLEEP);
    + cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_NOFS);

    cur->bc_tp = tp;
    cur->bc_mp = mp;
    diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
    index 8ea91f363093..2852521fc8ec 100644
    --- a/fs/xfs/libxfs/xfs_attr_leaf.c
    +++ b/fs/xfs/libxfs/xfs_attr_leaf.c
    @@ -253,6 +253,7 @@ xfs_attr3_leaf_verify(
    {
    struct xfs_mount *mp = bp->b_target->bt_mount;
    struct xfs_attr_leafblock *leaf = bp->b_addr;
    + struct xfs_perag *pag = bp->b_pag;
    struct xfs_attr3_icleaf_hdr ichdr;

    xfs_attr3_leaf_hdr_from_disk(mp->m_attr_geo, &ichdr, leaf);
    @@ -273,7 +274,12 @@ xfs_attr3_leaf_verify(
    if (ichdr.magic != XFS_ATTR_LEAF_MAGIC)
    return false;
    }
    - if (ichdr.count == 0)
    + /*
    + * In recovery there is a transient state where count == 0 is valid
    + * because we may have transitioned an empty shortform attr to a leaf
    + * if the attr didn't fit in shortform.
    + */
    + if (pag && pag->pagf_init && ichdr.count == 0)
    return false;

    /* XXX: need to range check rest of attr header values */
    diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
    index c6eb21940783..89d727b659fc 100644
    --- a/fs/xfs/libxfs/xfs_bmap.c
    +++ b/fs/xfs/libxfs/xfs_bmap.c
    @@ -49,6 +49,8 @@
    #include "xfs_rmap.h"
    #include "xfs_ag_resv.h"
    #include "xfs_refcount.h"
    +#include "xfs_rmap_btree.h"
    +#include "xfs_icache.h"


    kmem_zone_t *xfs_bmap_free_item_zone;
    @@ -190,8 +192,12 @@ xfs_bmap_worst_indlen(
    int maxrecs; /* maximum record count at this level */
    xfs_mount_t *mp; /* mount structure */
    xfs_filblks_t rval; /* return value */
    + xfs_filblks_t orig_len;

    mp = ip->i_mount;
    +
    + /* Calculate the worst-case size of the bmbt. */
    + orig_len = len;
    maxrecs = mp->m_bmap_dmxr[0];
    for (level = 0, rval = 0;
    level < XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK);
    @@ -199,12 +205,20 @@ xfs_bmap_worst_indlen(
    len += maxrecs - 1;
    do_div(len, maxrecs);
    rval += len;
    - if (len == 1)
    - return rval + XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
    + if (len == 1) {
    + rval += XFS_BM_MAXLEVELS(mp, XFS_DATA_FORK) -
    level - 1;
    + break;
    + }
    if (level == 0)
    maxrecs = mp->m_bmap_dmxr[1];
    }
    +
    + /* Calculate the worst-case size of the rmapbt. */
    + if (xfs_sb_version_hasrmapbt(&mp->m_sb))
    + rval += 1 + xfs_rmapbt_calc_size(mp, orig_len) +
    + mp->m_rmap_maxlevels;
    +
    return rval;
    }

    @@ -504,7 +518,7 @@ void
    xfs_bmap_trace_exlist(
    xfs_inode_t *ip, /* incore inode pointer */
    xfs_extnum_t cnt, /* count of entries in the list */
    - int whichfork, /* data or attr fork */
    + int whichfork, /* data or attr or cow fork */
    unsigned long caller_ip)
    {
    xfs_extnum_t idx; /* extent record index */
    @@ -513,11 +527,13 @@ xfs_bmap_trace_exlist(

    if (whichfork == XFS_ATTR_FORK)
    state |= BMAP_ATTRFORK;
    + else if (whichfork == XFS_COW_FORK)
    + state |= BMAP_COWFORK;

    ifp = XFS_IFORK_PTR(ip, whichfork);
    - ASSERT(cnt == (ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t)));
    + ASSERT(cnt == xfs_iext_count(ifp));
    for (idx = 0; idx < cnt; idx++)
    - trace_xfs_extlist(ip, idx, whichfork, caller_ip);
    + trace_xfs_extlist(ip, idx, state, caller_ip);
    }

    /*
    @@ -811,7 +827,7 @@ xfs_bmap_extents_to_btree(
    XFS_BTREE_LONG_PTRS);

    arp = XFS_BMBT_REC_ADDR(mp, ablock, 1);
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    for (cnt = i = 0; i < nextents; i++) {
    ep = xfs_iext_get_ext(ifp, i);
    if (!isnullstartblock(xfs_bmbt_get_startblock(ep))) {
    @@ -1137,6 +1153,10 @@ xfs_bmap_add_attrfork(
    goto trans_cancel;
    if (XFS_IFORK_Q(ip))
    goto trans_cancel;
    + if (ip->i_d.di_anextents != 0) {
    + error = -EFSCORRUPTED;
    + goto trans_cancel;
    + }
    if (ip->i_d.di_aformat != XFS_DINODE_FMT_EXTENTS) {
    /*
    * For inodes coming from pre-6.2 filesystems.
    @@ -1144,7 +1164,6 @@ xfs_bmap_add_attrfork(
    ASSERT(ip->i_d.di_aformat == 0);
    ip->i_d.di_aformat = XFS_DINODE_FMT_EXTENTS;
    }
    - ASSERT(ip->i_d.di_anextents == 0);

    xfs_trans_ijoin(tp, ip, 0);
    xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
    @@ -1296,7 +1315,7 @@ xfs_bmap_read_extents(
    /*
    * Here with bp and block set to the leftmost leaf node in the tree.
    */
    - room = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + room = xfs_iext_count(ifp);
    i = 0;
    /*
    * Loop over all leaf nodes. Copy information to the extent records.
    @@ -1361,8 +1380,9 @@ xfs_bmap_read_extents(
    return error;
    block = XFS_BUF_TO_BLOCK(bp);
    }
    - ASSERT(i == (ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t)));
    - ASSERT(i == XFS_IFORK_NEXTENTS(ip, whichfork));
    + if (i != XFS_IFORK_NEXTENTS(ip, whichfork))
    + return -EFSCORRUPTED;
    + ASSERT(i == xfs_iext_count(ifp));
    XFS_BMAP_TRACE_EXLIST(ip, i, whichfork);
    return 0;
    error0:
    @@ -1404,7 +1424,7 @@ xfs_bmap_search_multi_extents(
    if (lastx > 0) {
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, lastx - 1), prevp);
    }
    - if (lastx < (ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t))) {
    + if (lastx < xfs_iext_count(ifp)) {
    xfs_bmbt_get_all(ep, gotp);
    *eofp = 0;
    } else {
    @@ -1497,7 +1517,7 @@ xfs_bmap_first_unused(
    (error = xfs_iread_extents(tp, ip, whichfork)))
    return error;
    lowest = *first_unused;
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    for (idx = 0, lastaddr = 0, max = lowest; idx < nextents; idx++) {
    xfs_bmbt_rec_host_t *ep = xfs_iext_get_ext(ifp, idx);
    off = xfs_bmbt_get_startoff(ep);
    @@ -1582,7 +1602,7 @@ xfs_bmap_last_extent(
    return error;
    }

    - nextents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    if (nextents == 0) {
    *is_empty = 1;
    return 0;
    @@ -1735,7 +1755,7 @@ xfs_bmap_add_extent_delay_real(
    &bma->ip->i_d.di_nextents);

    ASSERT(bma->idx >= 0);
    - ASSERT(bma->idx <= ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
    + ASSERT(bma->idx <= xfs_iext_count(ifp));
    ASSERT(!isnullstartblock(new->br_startblock));
    ASSERT(!bma->cur ||
    (bma->cur->bc_private.b.flags & XFS_BTCUR_BPRV_WASDEL));
    @@ -1794,7 +1814,7 @@ xfs_bmap_add_extent_delay_real(
    * Don't set contiguous if the combined extent would be too large.
    * Also check for all-three-contiguous being too large.
    */
    - if (bma->idx < ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t) - 1) {
    + if (bma->idx < xfs_iext_count(ifp) - 1) {
    state |= BMAP_RIGHT_VALID;
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, bma->idx + 1), &RIGHT);

    @@ -2300,7 +2320,7 @@ xfs_bmap_add_extent_unwritten_real(
    ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);

    ASSERT(*idx >= 0);
    - ASSERT(*idx <= ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
    + ASSERT(*idx <= xfs_iext_count(ifp));
    ASSERT(!isnullstartblock(new->br_startblock));

    XFS_STATS_INC(mp, xs_add_exlist);
    @@ -2356,7 +2376,7 @@ xfs_bmap_add_extent_unwritten_real(
    * Don't set contiguous if the combined extent would be too large.
    * Also check for all-three-contiguous being too large.
    */
    - if (*idx < ip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t) - 1) {
    + if (*idx < xfs_iext_count(&ip->i_df) - 1) {
    state |= BMAP_RIGHT_VALID;
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *idx + 1), &RIGHT);
    if (isnullstartblock(RIGHT.br_startblock))
    @@ -2836,7 +2856,7 @@ xfs_bmap_add_extent_hole_delay(
    * Check and set flags if the current (right) segment exists.
    * If it doesn't exist, we're converting the hole at end-of-file.
    */
    - if (*idx < ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t)) {
    + if (*idx < xfs_iext_count(ifp)) {
    state |= BMAP_RIGHT_VALID;
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *idx), &right);

    @@ -2966,7 +2986,7 @@ xfs_bmap_add_extent_hole_real(
    ifp = XFS_IFORK_PTR(bma->ip, whichfork);

    ASSERT(bma->idx >= 0);
    - ASSERT(bma->idx <= ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
    + ASSERT(bma->idx <= xfs_iext_count(ifp));
    ASSERT(!isnullstartblock(new->br_startblock));
    ASSERT(!bma->cur ||
    !(bma->cur->bc_private.b.flags & XFS_BTCUR_BPRV_WASDEL));
    @@ -2992,7 +3012,7 @@ xfs_bmap_add_extent_hole_real(
    * Check and set flags if this segment has a current value.
    * Not true if we're inserting into the "hole" at eof.
    */
    - if (bma->idx < ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t)) {
    + if (bma->idx < xfs_iext_count(ifp)) {
    state |= BMAP_RIGHT_VALID;
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, bma->idx), &right);
    if (isnullstartblock(right.br_startblock))
    @@ -4221,7 +4241,7 @@ xfs_bmapi_read(
    break;

    /* Else go on to the next record. */
    - if (++lastx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t))
    + if (++lastx < xfs_iext_count(ifp))
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, lastx), &got);
    else
    eof = 1;
    @@ -4234,10 +4254,10 @@ int
    xfs_bmapi_reserve_delalloc(
    struct xfs_inode *ip,
    int whichfork,
    - xfs_fileoff_t aoff,
    + xfs_fileoff_t off,
    xfs_filblks_t len,
    + xfs_filblks_t prealloc,
    struct xfs_bmbt_irec *got,
    - struct xfs_bmbt_irec *prev,
    xfs_extnum_t *lastx,
    int eof)
    {
    @@ -4248,10 +4268,17 @@ xfs_bmapi_reserve_delalloc(
    char rt = XFS_IS_REALTIME_INODE(ip);
    xfs_extlen_t extsz;
    int error;
    + xfs_fileoff_t aoff = off;

    - alen = XFS_FILBLKS_MIN(len, MAXEXTLEN);
    + /*
    + * Cap the alloc length. Keep track of prealloc so we know whether to
    + * tag the inode before we return.
    + */
    + alen = XFS_FILBLKS_MIN(len + prealloc, MAXEXTLEN);
    if (!eof)
    alen = XFS_FILBLKS_MIN(alen, got->br_startoff - aoff);
    + if (prealloc && alen >= len)
    + prealloc = alen - len;

    /* Figure out the extent size, adjust alen */
    if (whichfork == XFS_COW_FORK)
    @@ -4259,7 +4286,12 @@ xfs_bmapi_reserve_delalloc(
    else
    extsz = xfs_get_extsz_hint(ip);
    if (extsz) {
    - error = xfs_bmap_extsize_align(mp, got, prev, extsz, rt, eof,
    + struct xfs_bmbt_irec prev;
    +
    + if (!xfs_iext_get_extent(ifp, *lastx - 1, &prev))
    + prev.br_startoff = NULLFILEOFF;
    +
    + error = xfs_bmap_extsize_align(mp, got, &prev, extsz, rt, eof,
    1, 0, &aoff, &alen);
    ASSERT(!error);
    }
    @@ -4312,6 +4344,16 @@ xfs_bmapi_reserve_delalloc(
    */
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, *lastx), got);

    + /*
    + * Tag the inode if blocks were preallocated. Note that COW fork
    + * preallocation can occur at the start or end of the extent, even when
    + * prealloc == 0, so we must also check the aligned offset and length.
    + */
    + if (whichfork == XFS_DATA_FORK && prealloc)
    + xfs_inode_set_eofblocks_tag(ip);
    + if (whichfork == XFS_COW_FORK && (prealloc || aoff < off || alen > len))
    + xfs_inode_set_cowblocks_tag(ip);
    +
    ASSERT(got->br_startoff <= aoff);
    ASSERT(got->br_startoff + got->br_blockcount >= aoff + alen);
    ASSERT(isnullstartblock(got->br_startblock));
    @@ -4733,7 +4775,7 @@ xfs_bmapi_write(

    /* Else go on to the next record. */
    bma.prev = bma.got;
    - if (++bma.idx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t)) {
    + if (++bma.idx < xfs_iext_count(ifp)) {
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, bma.idx),
    &bma.got);
    } else
    @@ -4885,7 +4927,7 @@ xfs_bmap_del_extent_delay(
    da_new = 0;

    ASSERT(*idx >= 0);
    - ASSERT(*idx < ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
    + ASSERT(*idx <= xfs_iext_count(ifp));
    ASSERT(del->br_blockcount > 0);
    ASSERT(got->br_startoff <= del->br_startoff);
    ASSERT(got_endoff >= del_endoff);
    @@ -4902,8 +4944,11 @@ xfs_bmap_del_extent_delay(
    * sb counters as we might have to borrow some blocks for the
    * indirect block accounting.
    */
    - xfs_trans_reserve_quota_nblks(NULL, ip, -((long)del->br_blockcount), 0,
    + error = xfs_trans_reserve_quota_nblks(NULL, ip,
    + -((long)del->br_blockcount), 0,
    isrt ? XFS_QMOPT_RES_RTBLKS : XFS_QMOPT_RES_REGBLKS);
    + if (error)
    + return error;
    ip->i_delayed_blks -= del->br_blockcount;

    if (whichfork == XFS_COW_FORK)
    @@ -5013,7 +5058,7 @@ xfs_bmap_del_extent_cow(
    got_endoff = got->br_startoff + got->br_blockcount;

    ASSERT(*idx >= 0);
    - ASSERT(*idx < ifp->if_bytes / sizeof(struct xfs_bmbt_rec));
    + ASSERT(*idx <= xfs_iext_count(ifp));
    ASSERT(del->br_blockcount > 0);
    ASSERT(got->br_startoff <= del->br_startoff);
    ASSERT(got_endoff >= del_endoff);
    @@ -5119,8 +5164,7 @@ xfs_bmap_del_extent(
    state |= BMAP_COWFORK;

    ifp = XFS_IFORK_PTR(ip, whichfork);
    - ASSERT((*idx >= 0) && (*idx < ifp->if_bytes /
    - (uint)sizeof(xfs_bmbt_rec_t)));
    + ASSERT((*idx >= 0) && (*idx < xfs_iext_count(ifp)));
    ASSERT(del->br_blockcount > 0);
    ep = xfs_iext_get_ext(ifp, *idx);
    xfs_bmbt_get_all(ep, &got);
    @@ -5445,7 +5489,6 @@ __xfs_bunmapi(
    int logflags; /* transaction logging flags */
    xfs_extlen_t mod; /* rt extent offset */
    xfs_mount_t *mp; /* mount structure */
    - xfs_extnum_t nextents; /* number of file extents */
    xfs_bmbt_irec_t prev; /* previous extent record */
    xfs_fileoff_t start; /* first file offset deleted */
    int tmp_logflags; /* partial logging flags */
    @@ -5477,8 +5520,7 @@ __xfs_bunmapi(
    if (!(ifp->if_flags & XFS_IFEXTENTS) &&
    (error = xfs_iread_extents(tp, ip, whichfork)))
    return error;
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    - if (nextents == 0) {
    + if (xfs_iext_count(ifp) == 0) {
    *rlen = 0;
    return 0;
    }
    @@ -5963,7 +6005,7 @@ xfs_bmse_shift_one(

    mp = ip->i_mount;
    ifp = XFS_IFORK_PTR(ip, whichfork);
    - total_extents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
    + total_extents = xfs_iext_count(ifp);

    xfs_bmbt_get_all(gotp, &got);

    @@ -6140,7 +6182,7 @@ xfs_bmap_shift_extents(
    * are collapsing out, so we cannot use the count of real extents here.
    * Instead we have to calculate it from the incore fork.
    */
    - total_extents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
    + total_extents = xfs_iext_count(ifp);
    if (total_extents == 0) {
    *done = 1;
    goto del_cursor;
    @@ -6200,7 +6242,7 @@ xfs_bmap_shift_extents(
    * count can change. Update the total and grade the next record.
    */
    if (direction == SHIFT_LEFT) {
    - total_extents = ifp->if_bytes / sizeof(xfs_bmbt_rec_t);
    + total_extents = xfs_iext_count(ifp);
    stop_extent = total_extents;
    }

    diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
    index 7cae6ec27fa6..d6d175a4fdec 100644
    --- a/fs/xfs/libxfs/xfs_bmap.h
    +++ b/fs/xfs/libxfs/xfs_bmap.h
    @@ -242,9 +242,8 @@ struct xfs_bmbt_rec_host *
    int fork, int *eofp, xfs_extnum_t *lastxp,
    struct xfs_bmbt_irec *gotp, struct xfs_bmbt_irec *prevp);
    int xfs_bmapi_reserve_delalloc(struct xfs_inode *ip, int whichfork,
    - xfs_fileoff_t aoff, xfs_filblks_t len,
    - struct xfs_bmbt_irec *got, struct xfs_bmbt_irec *prev,
    - xfs_extnum_t *lastx, int eof);
    + xfs_fileoff_t off, xfs_filblks_t len, xfs_filblks_t prealloc,
    + struct xfs_bmbt_irec *got, xfs_extnum_t *lastx, int eof);

    enum xfs_bmap_intent_type {
    XFS_BMAP_MAP = 1,
    diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
    index 8007d2ba9aef..049fa597ae91 100644
    --- a/fs/xfs/libxfs/xfs_bmap_btree.c
    +++ b/fs/xfs/libxfs/xfs_bmap_btree.c
    @@ -796,7 +796,7 @@ xfs_bmbt_init_cursor(
    struct xfs_btree_cur *cur;
    ASSERT(whichfork != XFS_COW_FORK);

    - cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_SLEEP);
    + cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_NOFS);

    cur->bc_tp = tp;
    cur->bc_mp = mp;
    diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
    index 0e80993c8a59..21e6a6ab6b9a 100644
    --- a/fs/xfs/libxfs/xfs_btree.c
    +++ b/fs/xfs/libxfs/xfs_btree.c
    @@ -1769,8 +1769,28 @@ xfs_btree_lookup_get_block(
    if (error)
    return error;

    + /* Check the inode owner since the verifiers don't. */
    + if (xfs_sb_version_hascrc(&cur->bc_mp->m_sb) &&
    + (cur->bc_flags & XFS_BTREE_LONG_PTRS) &&
    + be64_to_cpu((*blkp)->bb_u.l.bb_owner) !=
    + cur->bc_private.b.ip->i_ino)
    + goto out_bad;
    +
    + /* Did we get the level we were looking for? */
    + if (be16_to_cpu((*blkp)->bb_level) != level)
    + goto out_bad;
    +
    + /* Check that internal nodes have at least one record. */
    + if (level != 0 && be16_to_cpu((*blkp)->bb_numrecs) == 0)
    + goto out_bad;
    +
    xfs_btree_setbuf(cur, level, bp);
    return 0;
    +
    +out_bad:
    + *blkp = NULL;
    + xfs_trans_brelse(cur->bc_tp, bp);
    + return -EFSCORRUPTED;
    }

    /*
    diff --git a/fs/xfs/libxfs/xfs_dir2_data.c b/fs/xfs/libxfs/xfs_dir2_data.c
    index 725fc7841fde..e526f5a5f0be 100644
    --- a/fs/xfs/libxfs/xfs_dir2_data.c
    +++ b/fs/xfs/libxfs/xfs_dir2_data.c
    @@ -329,7 +329,7 @@ xfs_dir3_data_read(

    err = xfs_da_read_buf(tp, dp, bno, mapped_bno, bpp,
    XFS_DATA_FORK, &xfs_dir3_data_buf_ops);
    - if (!err && tp)
    + if (!err && tp && *bpp)
    xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_DATA_BUF);
    return err;
    }
    diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
    index 51b4e0de1fdc..d45c03779dae 100644
    --- a/fs/xfs/libxfs/xfs_ialloc.c
    +++ b/fs/xfs/libxfs/xfs_ialloc.c
    @@ -2450,8 +2450,6 @@ xfs_ialloc_log_agi(
    ASSERT(agi->agi_magicnum == cpu_to_be32(XFS_AGI_MAGIC));
    #endif

    - xfs_trans_buf_set_type(tp, bp, XFS_BLFT_AGI_BUF);
    -
    /*
    * Compute byte offsets for the first and last fields in the first
    * region and log the agi buffer. This only logs up through
    @@ -2512,8 +2510,15 @@ xfs_agi_verify(
    if (!XFS_AGI_GOOD_VERSION(be32_to_cpu(agi->agi_versionnum)))
    return false;

    - if (be32_to_cpu(agi->agi_level) > XFS_BTREE_MAXLEVELS)
    + if (be32_to_cpu(agi->agi_level) < 1 ||
    + be32_to_cpu(agi->agi_level) > XFS_BTREE_MAXLEVELS)
    + return false;
    +
    + if (xfs_sb_version_hasfinobt(&mp->m_sb) &&
    + (be32_to_cpu(agi->agi_free_level) < 1 ||
    + be32_to_cpu(agi->agi_free_level) > XFS_BTREE_MAXLEVELS))
    return false;
    +
    /*
    * during growfs operations, the perag is not fully initialised,
    * so we can't use it for any useful checking. growfs ensures we can't
    @@ -2592,6 +2597,8 @@ xfs_read_agi(
    XFS_FSS_TO_BB(mp, 1), 0, bpp, &xfs_agi_buf_ops);
    if (error)
    return error;
    + if (tp)
    + xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_AGI_BUF);

    xfs_buf_set_ref(*bpp, XFS_AGI_REF);
    return 0;
    diff --git a/fs/xfs/libxfs/xfs_ialloc_btree.c b/fs/xfs/libxfs/xfs_ialloc_btree.c
    index eab68ae2e011..6c6b95947e71 100644
    --- a/fs/xfs/libxfs/xfs_ialloc_btree.c
    +++ b/fs/xfs/libxfs/xfs_ialloc_btree.c
    @@ -357,7 +357,7 @@ xfs_inobt_init_cursor(
    struct xfs_agi *agi = XFS_BUF_TO_AGI(agbp);
    struct xfs_btree_cur *cur;

    - cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_SLEEP);
    + cur = kmem_zone_zalloc(xfs_btree_cur_zone, KM_NOFS);

    cur->bc_tp = tp;
    cur->bc_mp = mp;
    diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
    index 134424fac434..c906e50515f0 100644
    --- a/fs/xfs/libxfs/xfs_inode_buf.c
    +++ b/fs/xfs/libxfs/xfs_inode_buf.c
    @@ -392,6 +392,14 @@ xfs_dinode_verify(
    if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC))
    return false;

    + /* don't allow invalid i_size */
    + if (be64_to_cpu(dip->di_size) & (1ULL << 63))
    + return false;
    +
    + /* No zero-length symlinks. */
    + if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
    + return false;
    +
    /* only version 3 or greater inodes are extensively verified here */
    if (dip->di_version < 3)
    return true;
    diff --git a/fs/xfs/libxfs/xfs_inode_fork.c b/fs/xfs/libxfs/xfs_inode_fork.c
    index 5dd56d3dbb3a..222e103356c6 100644
    --- a/fs/xfs/libxfs/xfs_inode_fork.c
    +++ b/fs/xfs/libxfs/xfs_inode_fork.c
    @@ -775,6 +775,13 @@ xfs_idestroy_fork(
    }
    }

    +/* Count number of incore extents based on if_bytes */
    +xfs_extnum_t
    +xfs_iext_count(struct xfs_ifork *ifp)
    +{
    + return ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    +}
    +
    /*
    * Convert in-core extents to on-disk form
    *
    @@ -803,7 +810,7 @@ xfs_iextents_copy(
    ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL|XFS_ILOCK_SHARED));
    ASSERT(ifp->if_bytes > 0);

    - nrecs = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nrecs = xfs_iext_count(ifp);
    XFS_BMAP_TRACE_EXLIST(ip, nrecs, whichfork);
    ASSERT(nrecs > 0);

    @@ -941,7 +948,7 @@ xfs_iext_get_ext(
    xfs_extnum_t idx) /* index of target extent */
    {
    ASSERT(idx >= 0);
    - ASSERT(idx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t));
    + ASSERT(idx < xfs_iext_count(ifp));

    if ((ifp->if_flags & XFS_IFEXTIREC) && (idx == 0)) {
    return ifp->if_u1.if_ext_irec->er_extbuf;
    @@ -1017,7 +1024,7 @@ xfs_iext_add(
    int new_size; /* size of extents after adding */
    xfs_extnum_t nextents; /* number of extents in file */

    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    ASSERT((idx >= 0) && (idx <= nextents));
    byte_diff = ext_diff * sizeof(xfs_bmbt_rec_t);
    new_size = ifp->if_bytes + byte_diff;
    @@ -1241,7 +1248,7 @@ xfs_iext_remove(
    trace_xfs_iext_remove(ip, idx, state, _RET_IP_);

    ASSERT(ext_diff > 0);
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    new_size = (nextents - ext_diff) * sizeof(xfs_bmbt_rec_t);

    if (new_size == 0) {
    @@ -1270,7 +1277,7 @@ xfs_iext_remove_inline(

    ASSERT(!(ifp->if_flags & XFS_IFEXTIREC));
    ASSERT(idx < XFS_INLINE_EXTS);
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    ASSERT(((nextents - ext_diff) > 0) &&
    (nextents - ext_diff) < XFS_INLINE_EXTS);

    @@ -1309,7 +1316,7 @@ xfs_iext_remove_direct(
    ASSERT(!(ifp->if_flags & XFS_IFEXTIREC));
    new_size = ifp->if_bytes -
    (ext_diff * sizeof(xfs_bmbt_rec_t));
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);

    if (new_size == 0) {
    xfs_iext_destroy(ifp);
    @@ -1546,7 +1553,7 @@ xfs_iext_indirect_to_direct(
    int size; /* size of file extents */

    ASSERT(ifp->if_flags & XFS_IFEXTIREC);
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    ASSERT(nextents <= XFS_LINEAR_EXTS);
    size = nextents * sizeof(xfs_bmbt_rec_t);

    @@ -1620,7 +1627,7 @@ xfs_iext_bno_to_ext(
    xfs_extnum_t nextents; /* number of file extents */
    xfs_fileoff_t startoff = 0; /* start offset of extent */

    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    if (nextents == 0) {
    *idxp = 0;
    return NULL;
    @@ -1733,8 +1740,8 @@ xfs_iext_idx_to_irec(

    ASSERT(ifp->if_flags & XFS_IFEXTIREC);
    ASSERT(page_idx >= 0);
    - ASSERT(page_idx <= ifp->if_bytes / sizeof(xfs_bmbt_rec_t));
    - ASSERT(page_idx < ifp->if_bytes / sizeof(xfs_bmbt_rec_t) || realloc);
    + ASSERT(page_idx <= xfs_iext_count(ifp));
    + ASSERT(page_idx < xfs_iext_count(ifp) || realloc);

    nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
    erp_idx = 0;
    @@ -1782,7 +1789,7 @@ xfs_iext_irec_init(
    xfs_extnum_t nextents; /* number of extents in file */

    ASSERT(!(ifp->if_flags & XFS_IFEXTIREC));
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    ASSERT(nextents <= XFS_LINEAR_EXTS);

    erp = kmem_alloc(sizeof(xfs_ext_irec_t), KM_NOFS);
    @@ -1906,7 +1913,7 @@ xfs_iext_irec_compact(

    ASSERT(ifp->if_flags & XFS_IFEXTIREC);
    nlists = ifp->if_real_bytes / XFS_IEXT_BUFSZ;
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);

    if (nextents == 0) {
    xfs_iext_destroy(ifp);
    @@ -1996,3 +2003,49 @@ xfs_ifork_init_cow(
    ip->i_cformat = XFS_DINODE_FMT_EXTENTS;
    ip->i_cnextents = 0;
    }
    +
    +/*
    + * Lookup the extent covering bno.
    + *
    + * If there is an extent covering bno return the extent index, and store the
    + * expanded extent structure in *gotp, and the extent index in *idx.
    + * If there is no extent covering bno, but there is an extent after it (e.g.
    + * it lies in a hole) return that extent in *gotp and its index in *idx
    + * instead.
    + * If bno is beyond the last extent return false, and return the index after
    + * the last valid index in *idxp.
    + */
    +bool
    +xfs_iext_lookup_extent(
    + struct xfs_inode *ip,
    + struct xfs_ifork *ifp,
    + xfs_fileoff_t bno,
    + xfs_extnum_t *idxp,
    + struct xfs_bmbt_irec *gotp)
    +{
    + struct xfs_bmbt_rec_host *ep;
    +
    + XFS_STATS_INC(ip->i_mount, xs_look_exlist);
    +
    + ep = xfs_iext_bno_to_ext(ifp, bno, idxp);
    + if (!ep)
    + return false;
    + xfs_bmbt_get_all(ep, gotp);
    + return true;
    +}
    +
    +/*
    + * Return true if there is an extent at index idx, and return the expanded
    + * extent structure at idx in that case. Else return false.
    + */
    +bool
    +xfs_iext_get_extent(
    + struct xfs_ifork *ifp,
    + xfs_extnum_t idx,
    + struct xfs_bmbt_irec *gotp)
    +{
    + if (idx < 0 || idx >= xfs_iext_count(ifp))
    + return false;
    + xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), gotp);
    + return true;
    +}
    diff --git a/fs/xfs/libxfs/xfs_inode_fork.h b/fs/xfs/libxfs/xfs_inode_fork.h
    index c9476f50e32d..7fb8365326d1 100644
    --- a/fs/xfs/libxfs/xfs_inode_fork.h
    +++ b/fs/xfs/libxfs/xfs_inode_fork.h
    @@ -152,6 +152,7 @@ void xfs_init_local_fork(struct xfs_inode *, int, const void *, int);

    struct xfs_bmbt_rec_host *
    xfs_iext_get_ext(struct xfs_ifork *, xfs_extnum_t);
    +xfs_extnum_t xfs_iext_count(struct xfs_ifork *);
    void xfs_iext_insert(struct xfs_inode *, xfs_extnum_t, xfs_extnum_t,
    struct xfs_bmbt_irec *, int);
    void xfs_iext_add(struct xfs_ifork *, xfs_extnum_t, int);
    @@ -181,6 +182,12 @@ void xfs_iext_irec_compact_pages(struct xfs_ifork *);
    void xfs_iext_irec_compact_full(struct xfs_ifork *);
    void xfs_iext_irec_update_extoffs(struct xfs_ifork *, int, int);

    +bool xfs_iext_lookup_extent(struct xfs_inode *ip,
    + struct xfs_ifork *ifp, xfs_fileoff_t bno,
    + xfs_extnum_t *idxp, struct xfs_bmbt_irec *gotp);
    +bool xfs_iext_get_extent(struct xfs_ifork *ifp, xfs_extnum_t idx,
    + struct xfs_bmbt_irec *gotp);
    +
    extern struct kmem_zone *xfs_ifork_zone;

    extern void xfs_ifork_init_cow(struct xfs_inode *ip);
    diff --git a/fs/xfs/libxfs/xfs_refcount_btree.c b/fs/xfs/libxfs/xfs_refcount_btree.c
    index 453bb2757ec2..2ba216966002 100644
    --- a/fs/xfs/libxfs/xfs_refcount_btree.c
    +++ b/fs/xfs/libxfs/xfs_refcount_btree.c
    @@ -408,13 +408,14 @@ xfs_refcountbt_calc_size(
    */
    xfs_extlen_t
    xfs_refcountbt_max_size(
    - struct xfs_mount *mp)
    + struct xfs_mount *mp,
    + xfs_agblock_t agblocks)
    {
    /* Bail out if we're uninitialized, which can happen in mkfs. */
    if (mp->m_refc_mxr[0] == 0)
    return 0;

    - return xfs_refcountbt_calc_size(mp, mp->m_sb.sb_agblocks);
    + return xfs_refcountbt_calc_size(mp, agblocks);
    }

    /*
    @@ -429,22 +430,24 @@ xfs_refcountbt_calc_reserves(
    {
    struct xfs_buf *agbp;
    struct xfs_agf *agf;
    + xfs_agblock_t agblocks;
    xfs_extlen_t tree_len;
    int error;

    if (!xfs_sb_version_hasreflink(&mp->m_sb))
    return 0;

    - *ask += xfs_refcountbt_max_size(mp);

    error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
    if (error)
    return error;

    agf = XFS_BUF_TO_AGF(agbp);
    + agblocks = be32_to_cpu(agf->agf_length);
    tree_len = be32_to_cpu(agf->agf_refcount_blocks);
    xfs_buf_relse(agbp);

    + *ask += xfs_refcountbt_max_size(mp, agblocks);
    *used += tree_len;

    return error;
    diff --git a/fs/xfs/libxfs/xfs_refcount_btree.h b/fs/xfs/libxfs/xfs_refcount_btree.h
    index 3be7768bd51a..9db008b955b7 100644
    --- a/fs/xfs/libxfs/xfs_refcount_btree.h
    +++ b/fs/xfs/libxfs/xfs_refcount_btree.h
    @@ -66,7 +66,8 @@ extern void xfs_refcountbt_compute_maxlevels(struct xfs_mount *mp);

    extern xfs_extlen_t xfs_refcountbt_calc_size(struct xfs_mount *mp,
    unsigned long long len);
    -extern xfs_extlen_t xfs_refcountbt_max_size(struct xfs_mount *mp);
    +extern xfs_extlen_t xfs_refcountbt_max_size(struct xfs_mount *mp,
    + xfs_agblock_t agblocks);

    extern int xfs_refcountbt_calc_reserves(struct xfs_mount *mp,
    xfs_agnumber_t agno, xfs_extlen_t *ask, xfs_extlen_t *used);
    diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
    index 83e672ff7577..33a28efc3085 100644
    --- a/fs/xfs/libxfs/xfs_rmap_btree.c
    +++ b/fs/xfs/libxfs/xfs_rmap_btree.c
    @@ -549,13 +549,14 @@ xfs_rmapbt_calc_size(
    */
    xfs_extlen_t
    xfs_rmapbt_max_size(
    - struct xfs_mount *mp)
    + struct xfs_mount *mp,
    + xfs_agblock_t agblocks)
    {
    /* Bail out if we're uninitialized, which can happen in mkfs. */
    if (mp->m_rmap_mxr[0] == 0)
    return 0;

    - return xfs_rmapbt_calc_size(mp, mp->m_sb.sb_agblocks);
    + return xfs_rmapbt_calc_size(mp, agblocks);
    }

    /*
    @@ -570,25 +571,24 @@ xfs_rmapbt_calc_reserves(
    {
    struct xfs_buf *agbp;
    struct xfs_agf *agf;
    - xfs_extlen_t pool_len;
    + xfs_agblock_t agblocks;
    xfs_extlen_t tree_len;
    int error;

    if (!xfs_sb_version_hasrmapbt(&mp->m_sb))
    return 0;

    - /* Reserve 1% of the AG or enough for 1 block per record. */
    - pool_len = max(mp->m_sb.sb_agblocks / 100, xfs_rmapbt_max_size(mp));
    - *ask += pool_len;
    -
    error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
    if (error)
    return error;

    agf = XFS_BUF_TO_AGF(agbp);
    + agblocks = be32_to_cpu(agf->agf_length);
    tree_len = be32_to_cpu(agf->agf_rmap_blocks);
    xfs_buf_relse(agbp);

    + /* Reserve 1% of the AG or enough for 1 block per record. */
    + *ask += max(agblocks / 100, xfs_rmapbt_max_size(mp, agblocks));
    *used += tree_len;

    return error;
    diff --git a/fs/xfs/libxfs/xfs_rmap_btree.h b/fs/xfs/libxfs/xfs_rmap_btree.h
    index 2a9ac472fb15..19c08e933049 100644
    --- a/fs/xfs/libxfs/xfs_rmap_btree.h
    +++ b/fs/xfs/libxfs/xfs_rmap_btree.h
    @@ -60,7 +60,8 @@ extern void xfs_rmapbt_compute_maxlevels(struct xfs_mount *mp);

    extern xfs_extlen_t xfs_rmapbt_calc_size(struct xfs_mount *mp,
    unsigned long long len);
    -extern xfs_extlen_t xfs_rmapbt_max_size(struct xfs_mount *mp);
    +extern xfs_extlen_t xfs_rmapbt_max_size(struct xfs_mount *mp,
    + xfs_agblock_t agblocks);

    extern int xfs_rmapbt_calc_reserves(struct xfs_mount *mp,
    xfs_agnumber_t agno, xfs_extlen_t *ask, xfs_extlen_t *used);
    diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
    index a70aec910626..2580262e4ea0 100644
    --- a/fs/xfs/libxfs/xfs_sb.c
    +++ b/fs/xfs/libxfs/xfs_sb.c
    @@ -262,6 +262,12 @@ xfs_mount_validate_sb(
    return -EFSCORRUPTED;
    }

    + if (xfs_sb_version_hascrc(&mp->m_sb) &&
    + sbp->sb_blocksize < XFS_MIN_CRC_BLOCKSIZE) {
    + xfs_notice(mp, "v5 SB sanity check failed");
    + return -EFSCORRUPTED;
    + }
    +
    /*
    * Until this is fixed only page-sized or smaller data blocks work.
    */
    @@ -338,13 +344,16 @@ xfs_sb_quota_from_disk(struct xfs_sb *sbp)
    XFS_PQUOTA_CHKD : XFS_GQUOTA_CHKD;
    sbp->sb_qflags &= ~(XFS_OQUOTA_ENFD | XFS_OQUOTA_CHKD);

    - if (sbp->sb_qflags & XFS_PQUOTA_ACCT) {
    + if (sbp->sb_qflags & XFS_PQUOTA_ACCT &&
    + sbp->sb_gquotino != NULLFSINO) {
    /*
    * In older version of superblock, on-disk superblock only
    * has sb_gquotino, and in-core superblock has both sb_gquotino
    * and sb_pquotino. But, only one of them is supported at any
    * point of time. So, if PQUOTA is set in disk superblock,
    - * copy over sb_gquotino to sb_pquotino.
    + * copy over sb_gquotino to sb_pquotino. The NULLFSINO test
    + * above is to make sure we don't do this twice and wipe them
    + * both out!
    */
    sbp->sb_pquotino = sbp->sb_gquotino;
    sbp->sb_gquotino = NULLFSINO;
    diff --git a/fs/xfs/libxfs/xfs_types.h b/fs/xfs/libxfs/xfs_types.h
    index 8d74870468c2..cf044c0f4d41 100644
    --- a/fs/xfs/libxfs/xfs_types.h
    +++ b/fs/xfs/libxfs/xfs_types.h
    @@ -75,11 +75,14 @@ typedef __int64_t xfs_sfiloff_t; /* signed block number in a file */
    * Minimum and maximum blocksize and sectorsize.
    * The blocksize upper limit is pretty much arbitrary.
    * The sectorsize upper limit is due to sizeof(sb_sectsize).
    + * CRC enable filesystems use 512 byte inodes, meaning 512 byte block sizes
    + * cannot be used.
    */
    #define XFS_MIN_BLOCKSIZE_LOG 9 /* i.e. 512 bytes */
    #define XFS_MAX_BLOCKSIZE_LOG 16 /* i.e. 65536 bytes */
    #define XFS_MIN_BLOCKSIZE (1 << XFS_MIN_BLOCKSIZE_LOG)
    #define XFS_MAX_BLOCKSIZE (1 << XFS_MAX_BLOCKSIZE_LOG)
    +#define XFS_MIN_CRC_BLOCKSIZE (1 << (XFS_MIN_BLOCKSIZE_LOG + 1))
    #define XFS_MIN_SECTORSIZE_LOG 9 /* i.e. 512 bytes */
    #define XFS_MAX_SECTORSIZE_LOG 15 /* i.e. 32768 bytes */
    #define XFS_MIN_SECTORSIZE (1 << XFS_MIN_SECTORSIZE_LOG)
    diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
    index 3e57a56cf829..2693ba84ec25 100644
    --- a/fs/xfs/xfs_aops.c
    +++ b/fs/xfs/xfs_aops.c
    @@ -1361,6 +1361,26 @@ __xfs_get_blocks(
    if (error)
    goto out_unlock;

    + /*
    + * The only time we can ever safely find delalloc blocks on direct I/O
    + * is a dio write to post-eof speculative preallocation. All other
    + * scenarios are indicative of a problem or misuse (such as mixing
    + * direct and mapped I/O).
    + *
    + * The file may be unmapped by the time we get here so we cannot
    + * reliably fail the I/O based on mapping. Instead, fail the I/O if this
    + * is a read or a write within eof. Otherwise, carry on but warn as a
    + * precuation if the file happens to be mapped.
    + */
    + if (direct && imap.br_startblock == DELAYSTARTBLOCK) {
    + if (!create || offset < i_size_read(VFS_I(ip))) {
    + WARN_ON_ONCE(1);
    + error = -EIO;
    + goto out_unlock;
    + }
    + WARN_ON_ONCE(mapping_mapped(VFS_I(ip)->i_mapping));
    + }
    +
    /* for DAX, we convert unwritten extents directly */
    if (create &&
    (!nimaps ||
    @@ -1450,8 +1470,6 @@ __xfs_get_blocks(
    (new || ISUNWRITTEN(&imap))))
    set_buffer_new(bh_result);

    - BUG_ON(direct && imap.br_startblock == DELAYSTARTBLOCK);
    -
    return 0;

    out_unlock:
    diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
    index 47074e0c33f3..0670a8bd5818 100644
    --- a/fs/xfs/xfs_bmap_util.c
    +++ b/fs/xfs/xfs_bmap_util.c
    @@ -359,9 +359,7 @@ xfs_bmap_count_blocks(
    mp = ip->i_mount;
    ifp = XFS_IFORK_PTR(ip, whichfork);
    if ( XFS_IFORK_FORMAT(ip, whichfork) == XFS_DINODE_FMT_EXTENTS ) {
    - xfs_bmap_count_leaves(ifp, 0,
    - ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t),
    - count);
    + xfs_bmap_count_leaves(ifp, 0, xfs_iext_count(ifp), count);
    return 0;
    }

    @@ -426,7 +424,7 @@ xfs_getbmapx_fix_eof_hole(
    ifp = XFS_IFORK_PTR(ip, whichfork);
    if (!moretocome &&
    xfs_iext_bno_to_ext(ifp, fileblock, &lastx) &&
    - (lastx == (ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t))-1))
    + (lastx == xfs_iext_count(ifp) - 1))
    out->bmv_oflags |= BMV_OF_LAST;
    }

    @@ -1878,15 +1876,13 @@ xfs_swap_extent_forks(

    switch (ip->i_d.di_format) {
    case XFS_DINODE_FMT_EXTENTS:
    - /* If the extents fit in the inode, fix the
    - * pointer. Otherwise it's already NULL or
    - * pointing to the extent.
    + /*
    + * If the extents fit in the inode, fix the pointer. Otherwise
    + * it's already NULL or pointing to the extent.
    */
    - nextents = ip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    - if (nextents <= XFS_INLINE_EXTS) {
    - ifp->if_u1.if_extents =
    - ifp->if_u2.if_inline_ext;
    - }
    + nextents = xfs_iext_count(&ip->i_df);
    + if (nextents <= XFS_INLINE_EXTS)
    + ifp->if_u1.if_extents = ifp->if_u2.if_inline_ext;
    (*src_log_flags) |= XFS_ILOG_DEXT;
    break;
    case XFS_DINODE_FMT_BTREE:
    @@ -1898,15 +1894,13 @@ xfs_swap_extent_forks(

    switch (tip->i_d.di_format) {
    case XFS_DINODE_FMT_EXTENTS:
    - /* If the extents fit in the inode, fix the
    - * pointer. Otherwise it's already NULL or
    - * pointing to the extent.
    + /*
    + * If the extents fit in the inode, fix the pointer. Otherwise
    + * it's already NULL or pointing to the extent.
    */
    - nextents = tip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    - if (nextents <= XFS_INLINE_EXTS) {
    - tifp->if_u1.if_extents =
    - tifp->if_u2.if_inline_ext;
    - }
    + nextents = xfs_iext_count(&tip->i_df);
    + if (nextents <= XFS_INLINE_EXTS)
    + tifp->if_u1.if_extents = tifp->if_u2.if_inline_ext;
    (*target_log_flags) |= XFS_ILOG_DEXT;
    break;
    case XFS_DINODE_FMT_BTREE:
    diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
    index 6e4f7f900fea..9a5d64b5f35a 100644
    --- a/fs/xfs/xfs_file.c
    +++ b/fs/xfs/xfs_file.c
    @@ -939,7 +939,6 @@ xfs_file_clone_range(
    len, false);
    }

    -#define XFS_MAX_DEDUPE_LEN (16 * 1024 * 1024)
    STATIC ssize_t
    xfs_file_dedupe_range(
    struct file *src_file,
    @@ -950,14 +949,6 @@ xfs_file_dedupe_range(
    {
    int error;

    - /*
    - * Limit the total length we will dedupe for each operation.
    - * This is intended to bound the total time spent in this
    - * ioctl to something sane.
    - */
    - if (len > XFS_MAX_DEDUPE_LEN)
    - len = XFS_MAX_DEDUPE_LEN;
    -
    error = xfs_reflink_remap_range(src_file, loff, dst_file, dst_loff,
    len, true);
    if (error)
    diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
    index 93d12fa2670d..242e8091296d 100644
    --- a/fs/xfs/xfs_fsops.c
    +++ b/fs/xfs/xfs_fsops.c
    @@ -631,6 +631,20 @@ xfs_growfs_data_private(
    xfs_set_low_space_thresholds(mp);
    mp->m_alloc_set_aside = xfs_alloc_set_aside(mp);

    + /*
    + * If we expanded the last AG, free the per-AG reservation
    + * so we can reinitialize it with the new size.
    + */
    + if (new) {
    + struct xfs_perag *pag;
    +
    + pag = xfs_perag_get(mp, agno);
    + error = xfs_ag_resv_free(pag);
    + xfs_perag_put(pag);
    + if (error)
    + goto out;
    + }
    +
    /* Reserve AG metadata blocks. */
    error = xfs_fs_reserve_ag_blocks(mp);
    if (error && error != -ENOSPC)
    diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c
    index f295049db681..29cc9886a3cb 100644
    --- a/fs/xfs/xfs_icache.c
    +++ b/fs/xfs/xfs_icache.c
    @@ -123,7 +123,6 @@ __xfs_inode_free(
    {
    /* asserts to verify all state is correct here */
    ASSERT(atomic_read(&ip->i_pincount) == 0);
    - ASSERT(!xfs_isiflocked(ip));
    XFS_STATS_DEC(ip->i_mount, vn_active);

    call_rcu(&VFS_I(ip)->i_rcu, xfs_inode_free_callback);
    @@ -133,6 +132,8 @@ void
    xfs_inode_free(
    struct xfs_inode *ip)
    {
    + ASSERT(!xfs_isiflocked(ip));
    +
    /*
    * Because we use RCU freeing we need to ensure the inode always
    * appears to be reclaimed with an invalid inode number when in the
    @@ -981,6 +982,7 @@ xfs_reclaim_inode(

    if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
    xfs_iunpin_wait(ip);
    + /* xfs_iflush_abort() drops the flush lock */
    xfs_iflush_abort(ip, false);
    goto reclaim;
    }
    @@ -989,10 +991,10 @@ xfs_reclaim_inode(
    goto out_ifunlock;
    xfs_iunpin_wait(ip);
    }
    - if (xfs_iflags_test(ip, XFS_ISTALE))
    - goto reclaim;
    - if (xfs_inode_clean(ip))
    + if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) {
    + xfs_ifunlock(ip);
    goto reclaim;
    + }

    /*
    * Never flush out dirty data during non-blocking reclaim, as it would
    @@ -1030,25 +1032,24 @@ xfs_reclaim_inode(
    xfs_buf_relse(bp);
    }

    - xfs_iflock(ip);
    reclaim:
    + ASSERT(!xfs_isiflocked(ip));
    +
    /*
    * Because we use RCU freeing we need to ensure the inode always appears
    * to be reclaimed with an invalid inode number when in the free state.
    - * We do this as early as possible under the ILOCK and flush lock so
    - * that xfs_iflush_cluster() can be guaranteed to detect races with us
    - * here. By doing this, we guarantee that once xfs_iflush_cluster has
    - * locked both the XFS_ILOCK and the flush lock that it will see either
    - * a valid, flushable inode that will serialise correctly against the
    - * locks below, or it will see a clean (and invalid) inode that it can
    - * skip.
    + * We do this as early as possible under the ILOCK so that
    + * xfs_iflush_cluster() can be guaranteed to detect races with us here.
    + * By doing this, we guarantee that once xfs_iflush_cluster has locked
    + * XFS_ILOCK that it will see either a valid, flushable inode that will
    + * serialise correctly, or it will see a clean (and invalid) inode that
    + * it can skip.
    */
    spin_lock(&ip->i_flags_lock);
    ip->i_flags = XFS_IRECLAIM;
    ip->i_ino = 0;
    spin_unlock(&ip->i_flags_lock);

    - xfs_ifunlock(ip);
    xfs_iunlock(ip, XFS_ILOCK_EXCL);

    XFS_STATS_INC(ip->i_mount, xs_ig_reclaims);
    @@ -1580,10 +1581,15 @@ xfs_inode_free_cowblocks(
    struct xfs_eofblocks *eofb = args;
    bool need_iolock = true;
    int match;
    + struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);

    ASSERT(!eofb || (eofb && eofb->eof_scan_owner != 0));

    - if (!xfs_reflink_has_real_cow_blocks(ip)) {
    + /*
    + * Just clear the tag if we have an empty cow fork or none at all. It's
    + * possible the inode was fully unshared since it was originally tagged.
    + */
    + if (!xfs_is_reflink_inode(ip) || !ifp->if_bytes) {
    trace_xfs_inode_free_cowblocks_invalid(ip);
    xfs_inode_clear_cowblocks_tag(ip);
    return 0;
    @@ -1593,7 +1599,8 @@ xfs_inode_free_cowblocks(
    * If the mapping is dirty or under writeback we cannot touch the
    * CoW fork. Leave it alone if we're in the midst of a directio.
    */
    - if (mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_DIRTY) ||
    + if ((VFS_I(ip)->i_state & I_DIRTY_PAGES) ||
    + mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_DIRTY) ||
    mapping_tagged(VFS_I(ip)->i_mapping, PAGECACHE_TAG_WRITEBACK) ||
    atomic_read(&VFS_I(ip)->i_dio_count))
    return 0;
    diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
    index 4e560e6a12c1..512ff13ed66a 100644
    --- a/fs/xfs/xfs_inode.c
    +++ b/fs/xfs/xfs_inode.c
    @@ -2041,7 +2041,6 @@ xfs_iunlink(
    agi->agi_unlinked[bucket_index] = cpu_to_be32(agino);
    offset = offsetof(xfs_agi_t, agi_unlinked) +
    (sizeof(xfs_agino_t) * bucket_index);
    - xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
    xfs_trans_log_buf(tp, agibp, offset,
    (offset + sizeof(xfs_agino_t) - 1));
    return 0;
    @@ -2133,7 +2132,6 @@ xfs_iunlink_remove(
    agi->agi_unlinked[bucket_index] = cpu_to_be32(next_agino);
    offset = offsetof(xfs_agi_t, agi_unlinked) +
    (sizeof(xfs_agino_t) * bucket_index);
    - xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
    xfs_trans_log_buf(tp, agibp, offset,
    (offset + sizeof(xfs_agino_t) - 1));
    } else {
    diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
    index f14c1de2549d..71e8a81c91a3 100644
    --- a/fs/xfs/xfs_inode.h
    +++ b/fs/xfs/xfs_inode.h
    @@ -246,6 +246,11 @@ static inline bool xfs_is_reflink_inode(struct xfs_inode *ip)
    * Synchronize processes attempting to flush the in-core inode back to disk.
    */

    +static inline int xfs_isiflocked(struct xfs_inode *ip)
    +{
    + return xfs_iflags_test(ip, XFS_IFLOCK);
    +}
    +
    extern void __xfs_iflock(struct xfs_inode *ip);

    static inline int xfs_iflock_nowait(struct xfs_inode *ip)
    @@ -261,16 +266,12 @@ static inline void xfs_iflock(struct xfs_inode *ip)

    static inline void xfs_ifunlock(struct xfs_inode *ip)
    {
    + ASSERT(xfs_isiflocked(ip));
    xfs_iflags_clear(ip, XFS_IFLOCK);
    smp_mb();
    wake_up_bit(&ip->i_flags, __XFS_IFLOCK_BIT);
    }

    -static inline int xfs_isiflocked(struct xfs_inode *ip)
    -{
    - return xfs_iflags_test(ip, XFS_IFLOCK);
    -}
    -
    /*
    * Flags for inode locking.
    * Bit ranges: 1<<1 - 1<<16-1 -- iolock/ilock modes (bitfield)
    diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
    index 9610e9c00952..d90e7811ccdd 100644
    --- a/fs/xfs/xfs_inode_item.c
    +++ b/fs/xfs/xfs_inode_item.c
    @@ -164,7 +164,7 @@ xfs_inode_item_format_data_fork(
    struct xfs_bmbt_rec *p;

    ASSERT(ip->i_df.if_u1.if_extents != NULL);
    - ASSERT(ip->i_df.if_bytes / sizeof(xfs_bmbt_rec_t) > 0);
    + ASSERT(xfs_iext_count(&ip->i_df) > 0);

    p = xlog_prepare_iovec(lv, vecp, XLOG_REG_TYPE_IEXT);
    data_bytes = xfs_iextents_copy(ip, p, XFS_DATA_FORK);
    @@ -261,7 +261,7 @@ xfs_inode_item_format_attr_fork(
    ip->i_afp->if_bytes > 0) {
    struct xfs_bmbt_rec *p;

    - ASSERT(ip->i_afp->if_bytes / sizeof(xfs_bmbt_rec_t) ==
    + ASSERT(xfs_iext_count(ip->i_afp) ==
    ip->i_d.di_anextents);
    ASSERT(ip->i_afp->if_u1.if_extents != NULL);

    diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
    index c245bed3249b..a39197501a7c 100644
    --- a/fs/xfs/xfs_ioctl.c
    +++ b/fs/xfs/xfs_ioctl.c
    @@ -910,16 +910,14 @@ xfs_ioc_fsgetxattr(
    if (attr) {
    if (ip->i_afp) {
    if (ip->i_afp->if_flags & XFS_IFEXTENTS)
    - fa.fsx_nextents = ip->i_afp->if_bytes /
    - sizeof(xfs_bmbt_rec_t);
    + fa.fsx_nextents = xfs_iext_count(ip->i_afp);
    else
    fa.fsx_nextents = ip->i_d.di_anextents;
    } else
    fa.fsx_nextents = 0;
    } else {
    if (ip->i_df.if_flags & XFS_IFEXTENTS)
    - fa.fsx_nextents = ip->i_df.if_bytes /
    - sizeof(xfs_bmbt_rec_t);
    + fa.fsx_nextents = xfs_iext_count(&ip->i_df);
    else
    fa.fsx_nextents = ip->i_d.di_nextents;
    }
    diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
    index 436e109bb01e..15a83813b708 100644
    --- a/fs/xfs/xfs_iomap.c
    +++ b/fs/xfs/xfs_iomap.c
    @@ -395,11 +395,12 @@ xfs_iomap_prealloc_size(
    struct xfs_inode *ip,
    loff_t offset,
    loff_t count,
    - xfs_extnum_t idx,
    - struct xfs_bmbt_irec *prev)
    + xfs_extnum_t idx)
    {
    struct xfs_mount *mp = ip->i_mount;
    + struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, XFS_DATA_FORK);
    xfs_fileoff_t offset_fsb = XFS_B_TO_FSBT(mp, offset);
    + struct xfs_bmbt_irec prev;
    int shift = 0;
    int64_t freesp;
    xfs_fsblock_t qblocks;
    @@ -419,8 +420,8 @@ xfs_iomap_prealloc_size(
    */
    if ((mp->m_flags & XFS_MOUNT_DFLT_IOSIZE) ||
    XFS_ISIZE(ip) < XFS_FSB_TO_B(mp, mp->m_dalign) ||
    - idx == 0 ||
    - prev->br_startoff + prev->br_blockcount < offset_fsb)
    + !xfs_iext_get_extent(ifp, idx - 1, &prev) ||
    + prev.br_startoff + prev.br_blockcount < offset_fsb)
    return mp->m_writeio_blocks;

    /*
    @@ -439,8 +440,8 @@ xfs_iomap_prealloc_size(
    * always extends to MAXEXTLEN rather than falling short due to things
    * like stripe unit/width alignment of real extents.
    */
    - if (prev->br_blockcount <= (MAXEXTLEN >> 1))
    - alloc_blocks = prev->br_blockcount << 1;
    + if (prev.br_blockcount <= (MAXEXTLEN >> 1))
    + alloc_blocks = prev.br_blockcount << 1;
    else
    alloc_blocks = XFS_B_TO_FSB(mp, offset);
    if (!alloc_blocks)
    @@ -535,11 +536,11 @@ xfs_file_iomap_begin_delay(
    xfs_fileoff_t offset_fsb = XFS_B_TO_FSBT(mp, offset);
    xfs_fileoff_t maxbytes_fsb =
    XFS_B_TO_FSB(mp, mp->m_super->s_maxbytes);
    - xfs_fileoff_t end_fsb, orig_end_fsb;
    + xfs_fileoff_t end_fsb;
    int error = 0, eof = 0;
    struct xfs_bmbt_irec got;
    - struct xfs_bmbt_irec prev;
    xfs_extnum_t idx;
    + xfs_fsblock_t prealloc_blocks = 0;

    ASSERT(!XFS_IS_REALTIME_INODE(ip));
    ASSERT(!xfs_get_extsz_hint(ip));
    @@ -563,8 +564,7 @@ xfs_file_iomap_begin_delay(
    goto out_unlock;
    }

    - xfs_bmap_search_extents(ip, offset_fsb, XFS_DATA_FORK, &eof, &idx,
    - &got, &prev);
    + eof = !xfs_iext_lookup_extent(ip, ifp, offset_fsb, &idx, &got);
    if (!eof && got.br_startoff <= offset_fsb) {
    if (xfs_is_reflink_inode(ip)) {
    bool shared;
    @@ -595,35 +595,32 @@ xfs_file_iomap_begin_delay(
    * the lower level functions are updated.
    */
    count = min_t(loff_t, count, 1024 * PAGE_SIZE);
    - end_fsb = orig_end_fsb =
    - min(XFS_B_TO_FSB(mp, offset + count), maxbytes_fsb);
    + end_fsb = min(XFS_B_TO_FSB(mp, offset + count), maxbytes_fsb);

    if (eof) {
    - xfs_fsblock_t prealloc_blocks;
    -
    - prealloc_blocks =
    - xfs_iomap_prealloc_size(ip, offset, count, idx, &prev);
    + prealloc_blocks = xfs_iomap_prealloc_size(ip, offset, count, idx);
    if (prealloc_blocks) {
    xfs_extlen_t align;
    xfs_off_t end_offset;
    + xfs_fileoff_t p_end_fsb;

    end_offset = XFS_WRITEIO_ALIGN(mp, offset + count - 1);
    - end_fsb = XFS_B_TO_FSBT(mp, end_offset) +
    - prealloc_blocks;
    + p_end_fsb = XFS_B_TO_FSBT(mp, end_offset) +
    + prealloc_blocks;

    align = xfs_eof_alignment(ip, 0);
    if (align)
    - end_fsb = roundup_64(end_fsb, align);
    + p_end_fsb = roundup_64(p_end_fsb, align);

    - end_fsb = min(end_fsb, maxbytes_fsb);
    - ASSERT(end_fsb > offset_fsb);
    + p_end_fsb = min(p_end_fsb, maxbytes_fsb);
    + ASSERT(p_end_fsb > offset_fsb);
    + prealloc_blocks = p_end_fsb - end_fsb;
    }
    }

    retry:
    error = xfs_bmapi_reserve_delalloc(ip, XFS_DATA_FORK, offset_fsb,
    - end_fsb - offset_fsb, &got,
    - &prev, &idx, eof);
    + end_fsb - offset_fsb, prealloc_blocks, &got, &idx, eof);
    switch (error) {
    case 0:
    break;
    @@ -631,8 +628,8 @@ xfs_file_iomap_begin_delay(
    case -EDQUOT:
    /* retry without any preallocation */
    trace_xfs_delalloc_enospc(ip, offset, count);
    - if (end_fsb != orig_end_fsb) {
    - end_fsb = orig_end_fsb;
    + if (prealloc_blocks) {
    + prealloc_blocks = 0;
    goto retry;
    }
    /*FALLTHRU*/
    @@ -640,13 +637,6 @@ xfs_file_iomap_begin_delay(
    goto out_unlock;
    }

    - /*
    - * Tag the inode as speculatively preallocated so we can reclaim this
    - * space on demand, if necessary.
    - */
    - if (end_fsb != orig_end_fsb)
    - xfs_inode_set_eofblocks_tag(ip);
    -
    trace_xfs_iomap_alloc(ip, offset, count, 0, &got);
    done:
    if (isnullstartblock(got.br_startblock))
    diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
    index 2d91f5ab7538..9b3d7c76915d 100644
    --- a/fs/xfs/xfs_log_recover.c
    +++ b/fs/xfs/xfs_log_recover.c
    @@ -4929,7 +4929,6 @@ xlog_recover_clear_agi_bucket(
    agi->agi_unlinked[bucket] = cpu_to_be32(NULLAGINO);
    offset = offsetof(xfs_agi_t, agi_unlinked) +
    (sizeof(xfs_agino_t) * bucket);
    - xfs_trans_buf_set_type(tp, agibp, XFS_BLFT_AGI_BUF);
    xfs_trans_log_buf(tp, agibp, offset,
    (offset + sizeof(xfs_agino_t) - 1));

    diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
    index a60d9e2739d1..45e50ea90769 100644
    --- a/fs/xfs/xfs_qm.c
    +++ b/fs/xfs/xfs_qm.c
    @@ -1135,7 +1135,7 @@ xfs_qm_get_rtblks(
    return error;
    }
    rtblks = 0;
    - nextents = ifp->if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
    + nextents = xfs_iext_count(ifp);
    for (idx = 0; idx < nextents; idx++)
    rtblks += xfs_bmbt_get_blockcount(xfs_iext_get_ext(ifp, idx));
    *O_rtblks = (xfs_qcnt_t)rtblks;
    diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
    index fe86a668a57e..6e4c7446c3d4 100644
    --- a/fs/xfs/xfs_refcount_item.c
    +++ b/fs/xfs/xfs_refcount_item.c
    @@ -526,13 +526,14 @@ xfs_cui_recover(
    xfs_refcount_finish_one_cleanup(tp, rcur, error);
    error = xfs_defer_finish(&tp, &dfops, NULL);
    if (error)
    - goto abort_error;
    + goto abort_defer;
    set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
    error = xfs_trans_commit(tp);
    return error;

    abort_error:
    xfs_refcount_finish_one_cleanup(tp, rcur, error);
    +abort_defer:
    xfs_defer_cancel(&dfops);
    xfs_trans_cancel(tp);
    return error;
    diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
    index a279b4e7f5fe..4d3f74e3c5e1 100644
    --- a/fs/xfs/xfs_reflink.c
    +++ b/fs/xfs/xfs_reflink.c
    @@ -243,12 +243,11 @@ xfs_reflink_reserve_cow(
    struct xfs_bmbt_irec *imap,
    bool *shared)
    {
    - struct xfs_bmbt_irec got, prev;
    - xfs_fileoff_t end_fsb, orig_end_fsb;
    - int eof = 0, error = 0;
    - bool trimmed;
    + struct xfs_ifork *ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
    + struct xfs_bmbt_irec got;
    + int error = 0;
    + bool eof = false, trimmed;
    xfs_extnum_t idx;
    - xfs_extlen_t align;

    /*
    * Search the COW fork extent list first. This serves two purposes:
    @@ -258,8 +257,9 @@ xfs_reflink_reserve_cow(
    * extent list is generally faster than going out to the shared extent
    * tree.
    */
    - xfs_bmap_search_extents(ip, imap->br_startoff, XFS_COW_FORK, &eof, &idx,
    - &got, &prev);
    +
    + if (!xfs_iext_lookup_extent(ip, ifp, imap->br_startoff, &idx, &got))
    + eof = true;
    if (!eof && got.br_startoff <= imap->br_startoff) {
    trace_xfs_reflink_cow_found(ip, imap);
    xfs_trim_extent(imap, got.br_startoff, got.br_blockcount);
    @@ -285,33 +285,12 @@ xfs_reflink_reserve_cow(
    if (error)
    return error;

    - end_fsb = orig_end_fsb = imap->br_startoff + imap->br_blockcount;
    -
    - align = xfs_eof_alignment(ip, xfs_get_cowextsz_hint(ip));
    - if (align)
    - end_fsb = roundup_64(end_fsb, align);
    -
    -retry:
    error = xfs_bmapi_reserve_delalloc(ip, XFS_COW_FORK, imap->br_startoff,
    - end_fsb - imap->br_startoff, &got, &prev, &idx, eof);
    - switch (error) {
    - case 0:
    - break;
    - case -ENOSPC:
    - case -EDQUOT:
    - /* retry without any preallocation */
    + imap->br_blockcount, 0, &got, &idx, eof);
    + if (error == -ENOSPC || error == -EDQUOT)
    trace_xfs_reflink_cow_enospc(ip, imap);
    - if (end_fsb != orig_end_fsb) {
    - end_fsb = orig_end_fsb;
    - goto retry;
    - }
    - /*FALLTHRU*/
    - default:
    + if (error)
    return error;
    - }
    -
    - if (end_fsb != orig_end_fsb)
    - xfs_inode_set_cowblocks_tag(ip);

    trace_xfs_reflink_cow_alloc(ip, &got);
    return 0;
    @@ -486,7 +465,7 @@ xfs_reflink_trim_irec_to_next_cow(
    /* This is the extent before; try sliding up one. */
    if (irec.br_startoff < offset_fsb) {
    idx++;
    - if (idx >= ifp->if_bytes / sizeof(xfs_bmbt_rec_t))
    + if (idx >= xfs_iext_count(ifp))
    return 0;
    gotp = xfs_iext_get_ext(ifp, idx);
    xfs_bmbt_get_all(gotp, &irec);
    @@ -566,7 +545,7 @@ xfs_reflink_cancel_cow_blocks(
    xfs_bmap_del_extent_cow(ip, &idx, &got, &del);
    }

    - if (++idx >= ifp->if_bytes / sizeof(struct xfs_bmbt_rec))
    + if (++idx >= xfs_iext_count(ifp))
    break;
    xfs_bmbt_get_all(xfs_iext_get_ext(ifp, idx), &got);
    }
    @@ -1345,8 +1324,14 @@ xfs_reflink_remap_range(
    goto out_unlock;
    }

    - if (len == 0)
    + /* Zero length dedupe exits immediately; reflink goes to EOF. */
    + if (len == 0) {
    + if (is_dedupe) {
    + ret = 0;
    + goto out_unlock;
    + }
    len = isize - pos_in;
    + }

    /* Ensure offsets don't wrap and the input is inside i_size */
    if (pos_in + len < pos_in || pos_out + len < pos_out ||
    @@ -1697,37 +1682,3 @@ xfs_reflink_unshare(
    trace_xfs_reflink_unshare_error(ip, error, _RET_IP_);
    return error;
    }
    -
    -/*
    - * Does this inode have any real CoW reservations?
    - */
    -bool
    -xfs_reflink_has_real_cow_blocks(
    - struct xfs_inode *ip)
    -{
    - struct xfs_bmbt_irec irec;
    - struct xfs_ifork *ifp;
    - struct xfs_bmbt_rec_host *gotp;
    - xfs_extnum_t idx;
    -
    - if (!xfs_is_reflink_inode(ip))
    - return false;
    -
    - /* Go find the old extent in the CoW fork. */
    - ifp = XFS_IFORK_PTR(ip, XFS_COW_FORK);
    - gotp = xfs_iext_bno_to_ext(ifp, 0, &idx);
    - while (gotp) {
    - xfs_bmbt_get_all(gotp, &irec);
    -
    - if (!isnullstartblock(irec.br_startblock))
    - return true;
    -
    - /* Roll on... */
    - idx++;
    - if (idx >= ifp->if_bytes / sizeof(xfs_bmbt_rec_t))
    - break;
    - gotp = xfs_iext_get_ext(ifp, idx);
    - }
    -
    - return false;
    -}
    diff --git a/fs/xfs/xfs_reflink.h b/fs/xfs/xfs_reflink.h
    index fad11607c9ad..97ea9b487884 100644
    --- a/fs/xfs/xfs_reflink.h
    +++ b/fs/xfs/xfs_reflink.h
    @@ -50,6 +50,4 @@ extern int xfs_reflink_clear_inode_flag(struct xfs_inode *ip,
    extern int xfs_reflink_unshare(struct xfs_inode *ip, xfs_off_t offset,
    xfs_off_t len);

    -extern bool xfs_reflink_has_real_cow_blocks(struct xfs_inode *ip);
    -
    #endif /* __XFS_REFLINK_H */
    diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
    index 276d3023d60f..de6195e38910 100644
    --- a/fs/xfs/xfs_sysfs.c
    +++ b/fs/xfs/xfs_sysfs.c
    @@ -396,7 +396,7 @@ max_retries_show(
    int retries;
    struct xfs_error_cfg *cfg = to_error_cfg(kobject);

    - if (cfg->retry_timeout == XFS_ERR_RETRY_FOREVER)
    + if (cfg->max_retries == XFS_ERR_RETRY_FOREVER)
    retries = -1;
    else
    retries = cfg->max_retries;
    @@ -422,7 +422,7 @@ max_retries_store(
    return -EINVAL;

    if (val == -1)
    - cfg->retry_timeout = XFS_ERR_RETRY_FOREVER;
    + cfg->max_retries = XFS_ERR_RETRY_FOREVER;
    else
    cfg->max_retries = val;
    return count;
    diff --git a/include/asm-generic/asm-prototypes.h b/include/asm-generic/asm-prototypes.h
    index df13637e4017..939869c772b1 100644
    --- a/include/asm-generic/asm-prototypes.h
    +++ b/include/asm-generic/asm-prototypes.h
    @@ -1,7 +1,13 @@
    #include <linux/bitops.h>
    +#undef __memset
    extern void *__memset(void *, int, __kernel_size_t);
    +#undef __memcpy
    extern void *__memcpy(void *, const void *, __kernel_size_t);
    +#undef __memmove
    extern void *__memmove(void *, const void *, __kernel_size_t);
    +#undef memset
    extern void *memset(void *, int, __kernel_size_t);
    +#undef memcpy
    extern void *memcpy(void *, const void *, __kernel_size_t);
    +#undef memmove
    extern void *memmove(void *, const void *, __kernel_size_t);
    diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
    index afe641c02dca..ba1cad7b97cf 100644
    --- a/include/linux/cpuhotplug.h
    +++ b/include/linux/cpuhotplug.h
    @@ -80,7 +80,6 @@ enum cpuhp_state {
    CPUHP_AP_ARM_L2X0_STARTING,
    CPUHP_AP_ARM_ARCH_TIMER_STARTING,
    CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
    - CPUHP_AP_DUMMY_TIMER_STARTING,
    CPUHP_AP_JCORE_TIMER_STARTING,
    CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
    CPUHP_AP_ARM_TWD_STARTING,
    @@ -94,6 +93,8 @@ enum cpuhp_state {
    CPUHP_AP_KVM_ARM_VGIC_INIT_STARTING,
    CPUHP_AP_KVM_ARM_VGIC_STARTING,
    CPUHP_AP_KVM_ARM_TIMER_STARTING,
    + /* Must be the last timer callback */
    + CPUHP_AP_DUMMY_TIMER_STARTING,
    CPUHP_AP_ARM_XEN_STARTING,
    CPUHP_AP_ARM_CORESIGHT_STARTING,
    CPUHP_AP_ARM_CORESIGHT4_STARTING,
    diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h
    index 4d3f0d1aec73..1b413a9aab81 100644
    --- a/include/linux/debugfs.h
    +++ b/include/linux/debugfs.h
    @@ -62,6 +62,21 @@ static inline const struct file_operations *debugfs_real_fops(struct file *filp)
    return filp->f_path.dentry->d_fsdata;
    }

    +#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \
    +static int __fops ## _open(struct inode *inode, struct file *file) \
    +{ \
    + __simple_attr_check_format(__fmt, 0ull); \
    + return simple_attr_open(inode, file, __get, __set, __fmt); \
    +} \
    +static const struct file_operations __fops = { \
    + .owner = THIS_MODULE, \
    + .open = __fops ## _open, \
    + .release = simple_attr_release, \
    + .read = debugfs_attr_read, \
    + .write = debugfs_attr_write, \
    + .llseek = generic_file_llseek, \
    +}
    +
    #if defined(CONFIG_DEBUG_FS)

    struct dentry *debugfs_create_file(const char *name, umode_t mode,
    @@ -99,21 +114,6 @@ ssize_t debugfs_attr_read(struct file *file, char __user *buf,
    ssize_t debugfs_attr_write(struct file *file, const char __user *buf,
    size_t len, loff_t *ppos);

    -#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \
    -static int __fops ## _open(struct inode *inode, struct file *file) \
    -{ \
    - __simple_attr_check_format(__fmt, 0ull); \
    - return simple_attr_open(inode, file, __get, __set, __fmt); \
    -} \
    -static const struct file_operations __fops = { \
    - .owner = THIS_MODULE, \
    - .open = __fops ## _open, \
    - .release = simple_attr_release, \
    - .read = debugfs_attr_read, \
    - .write = debugfs_attr_write, \
    - .llseek = generic_file_llseek, \
    -}
    -
    struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
    struct dentry *new_dir, const char *new_name);

    @@ -233,8 +233,18 @@ static inline void debugfs_use_file_finish(int srcu_idx)
    __releases(&debugfs_srcu)
    { }

    -#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \
    - static const struct file_operations __fops = { 0 }
    +static inline ssize_t debugfs_attr_read(struct file *file, char __user *buf,
    + size_t len, loff_t *ppos)
    +{
    + return -ENODEV;
    +}
    +
    +static inline ssize_t debugfs_attr_write(struct file *file,
    + const char __user *buf,
    + size_t len, loff_t *ppos)
    +{
    + return -ENODEV;
    +}

    static inline struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry,
    struct dentry *new_dir, char *new_name)
    diff --git a/include/linux/iio/common/st_sensors.h b/include/linux/iio/common/st_sensors.h
    index 228bd44efa4c..497f2b3a5a62 100644
    --- a/include/linux/iio/common/st_sensors.h
    +++ b/include/linux/iio/common/st_sensors.h
    @@ -116,6 +116,16 @@ struct st_sensor_bdu {
    };

    /**
    + * struct st_sensor_das - ST sensor device data alignment selection
    + * @addr: address of the register.
    + * @mask: mask to write the das flag for left alignment.
    + */
    +struct st_sensor_das {
    + u8 addr;
    + u8 mask;
    +};
    +
    +/**
    * struct st_sensor_data_ready_irq - ST sensor device data-ready interrupt
    * @addr: address of the register.
    * @mask_int1: mask to enable/disable IRQ on INT1 pin.
    @@ -185,6 +195,7 @@ struct st_sensor_transfer_function {
    * @enable_axis: Enable one or more axis of the sensor.
    * @fs: Full scale register and full scale list available.
    * @bdu: Block data update register.
    + * @das: Data Alignment Selection register.
    * @drdy_irq: Data ready register of the sensor.
    * @multi_read_bit: Use or not particular bit for [I2C/SPI] multi-read.
    * @bootime: samples to discard when sensor passing from power-down to power-up.
    @@ -200,6 +211,7 @@ struct st_sensor_settings {
    struct st_sensor_axis enable_axis;
    struct st_sensor_fullscale fs;
    struct st_sensor_bdu bdu;
    + struct st_sensor_das das;
    struct st_sensor_data_ready_irq drdy_irq;
    bool multi_read_bit;
    unsigned int bootime;
    diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
    index c58752fe16c4..f020ab4079d3 100644
    --- a/include/linux/pci_ids.h
    +++ b/include/linux/pci_ids.h
    @@ -2256,12 +2256,29 @@
    #define PCI_DEVICE_ID_ZOLTRIX_2BD0 0x2bd0

    #define PCI_VENDOR_ID_MELLANOX 0x15b3
    -#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX3 0x1003
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO 0x1007
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTIB 0x1011
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX4 0x1013
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX 0x1015
    +#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44
    #define PCI_DEVICE_ID_MELLANOX_TAVOR_BRIDGE 0x5a46
    -#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278
    -#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282
    -#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c
    -#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274
    +#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c
    +#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274
    +#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278
    +#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_SDR 0x6340
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR 0x634a
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR 0x6354
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_EN 0x6368
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN 0x6372
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2 0x6732
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2 0x673c
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2 0x6746
    +#define PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2 0x6750
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2 0x675a
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2 0x6764
    +#define PCI_DEVICE_ID_MELLANOX_CONNECTX2 0x676e

    #define PCI_VENDOR_ID_DFI 0x15bd

    diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h
    index 8e81f9eb95e4..e4516e9ded0f 100644
    --- a/include/linux/usb/gadget.h
    +++ b/include/linux/usb/gadget.h
    @@ -429,7 +429,9 @@ static inline struct usb_gadget *dev_to_usb_gadget(struct device *dev)
    */
    static inline size_t usb_ep_align(struct usb_ep *ep, size_t len)
    {
    - return round_up(len, (size_t)le16_to_cpu(ep->desc->wMaxPacketSize));
    + int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc) & 0x7ff;
    +
    + return round_up(len, max_packet_size);
    }

    /**
    diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
    index 56368e9b4622..d3cbe48b286d 100644
    --- a/include/uapi/linux/nl80211.h
    +++ b/include/uapi/linux/nl80211.h
    @@ -323,7 +323,7 @@
    * @NL80211_CMD_GET_SCAN: get scan results
    * @NL80211_CMD_TRIGGER_SCAN: trigger a new scan with the given parameters
    * %NL80211_ATTR_TX_NO_CCK_RATE is used to decide whether to send the
    - * probe requests at CCK rate or not. %NL80211_ATTR_MAC can be used to
    + * probe requests at CCK rate or not. %NL80211_ATTR_BSSID can be used to
    * specify a BSSID to scan for; if not included, the wildcard BSSID will
    * be used.
    * @NL80211_CMD_NEW_SCAN_RESULTS: scan notification (as a reply to
    @@ -1937,6 +1937,9 @@ enum nl80211_commands {
    * @NL80211_ATTR_NAN_MATCH: used to report a match. This is a nested attribute.
    * See &enum nl80211_nan_match_attributes.
    *
    + * @NL80211_ATTR_BSSID: The BSSID of the AP. Note that %NL80211_ATTR_MAC is also
    + * used in various commands/events for specifying the BSSID.
    + *
    * @NUM_NL80211_ATTR: total number of nl80211_attrs available
    * @NL80211_ATTR_MAX: highest attribute number currently defined
    * @__NL80211_ATTR_AFTER_LAST: internal use
    @@ -2336,6 +2339,8 @@ enum nl80211_attrs {
    NL80211_ATTR_NAN_FUNC,
    NL80211_ATTR_NAN_MATCH,

    + NL80211_ATTR_BSSID,
    +
    /* add attributes here, update the policy in nl80211.c */

    __NL80211_ATTR_AFTER_LAST,
    diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
    index 17f51d63da56..668f51b861f7 100644
    --- a/kernel/irq/affinity.c
    +++ b/kernel/irq/affinity.c
    @@ -37,10 +37,10 @@ static void irq_spread_init_one(struct cpumask *irqmsk, struct cpumask *nmsk,

    static int get_nodes_in_cpumask(const struct cpumask *mask, nodemask_t *nodemsk)
    {
    - int n, nodes;
    + int n, nodes = 0;

    /* Calculate the number of nodes in the supplied affinity mask */
    - for (n = 0, nodes = 0; n < num_online_nodes(); n++) {
    + for_each_online_node(n) {
    if (cpumask_intersects(mask, cpumask_of_node(n))) {
    node_set(n, *nodemsk);
    nodes++;
    @@ -81,7 +81,7 @@ struct cpumask *irq_create_affinity_masks(const struct cpumask *affinity,
    nodes = get_nodes_in_cpumask(affinity, &nodemsk);

    /*
    - * If the number of nodes in the mask is less than or equal the
    + * If the number of nodes in the mask is greater than or equal the
    * number of vectors we just spread the vectors across the nodes.
    */
    if (nvec <= nodes) {
    diff --git a/kernel/relay.c b/kernel/relay.c
    index da79a109dbeb..8f18d314a96a 100644
    --- a/kernel/relay.c
    +++ b/kernel/relay.c
    @@ -809,11 +809,11 @@ void relay_subbufs_consumed(struct rchan *chan,
    {
    struct rchan_buf *buf;

    - if (!chan)
    + if (!chan || cpu >= NR_CPUS)
    return;

    buf = *per_cpu_ptr(chan->buf, cpu);
    - if (cpu >= NR_CPUS || !buf || subbufs_consumed > chan->n_subbufs)
    + if (!buf || subbufs_consumed > chan->n_subbufs)
    return;

    if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed)
    diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
    index f6aae7977824..d2a20e83ebae 100644
    --- a/kernel/time/tick-broadcast.c
    +++ b/kernel/time/tick-broadcast.c
    @@ -871,6 +871,9 @@ void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
    {
    int cpu = smp_processor_id();

    + if (!bc)
    + return;
    +
    /* Set it up only once ! */
    if (bc->event_handler != tick_handle_oneshot_broadcast) {
    int was_periodic = clockevent_state_periodic(bc);
    diff --git a/mm/compaction.c b/mm/compaction.c
    index 0409a4ad6ea1..70e6bec46dc2 100644
    --- a/mm/compaction.c
    +++ b/mm/compaction.c
    @@ -634,22 +634,6 @@ isolate_freepages_range(struct compact_control *cc,
    return pfn;
    }

    -/* Update the number of anon and file isolated pages in the zone */
    -static void acct_isolated(struct zone *zone, struct compact_control *cc)
    -{
    - struct page *page;
    - unsigned int count[2] = { 0, };
    -
    - if (list_empty(&cc->migratepages))
    - return;
    -
    - list_for_each_entry(page, &cc->migratepages, lru)
    - count[!!page_is_file_cache(page)]++;
    -
    - mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_ANON, count[0]);
    - mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, count[1]);
    -}
    -
    /* Similar to reclaim, but different enough that they don't share logic */
    static bool too_many_isolated(struct zone *zone)
    {
    @@ -866,6 +850,8 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,

    /* Successfully isolated */
    del_page_from_lru_list(page, lruvec, page_lru(page));
    + inc_node_page_state(page,
    + NR_ISOLATED_ANON + page_is_file_cache(page));

    isolate_success:
    list_add(&page->lru, &cc->migratepages);
    @@ -902,7 +888,6 @@ isolate_migratepages_block(struct compact_control *cc, unsigned long low_pfn,
    spin_unlock_irqrestore(zone_lru_lock(zone), flags);
    locked = false;
    }
    - acct_isolated(zone, cc);
    putback_movable_pages(&cc->migratepages);
    cc->nr_migratepages = 0;
    cc->last_migrated_pfn = 0;
    @@ -988,7 +973,6 @@ isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn,
    if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
    break;
    }
    - acct_isolated(cc->zone, cc);

    return pfn;
    }
    @@ -1258,10 +1242,8 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
    low_pfn = isolate_migratepages_block(cc, low_pfn,
    block_end_pfn, isolate_mode);

    - if (!low_pfn || cc->contended) {
    - acct_isolated(zone, cc);
    + if (!low_pfn || cc->contended)
    return ISOLATE_ABORT;
    - }

    /*
    * Either we isolated something and proceed with migration. Or
    @@ -1271,7 +1253,6 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
    break;
    }

    - acct_isolated(zone, cc);
    /* Record where migration scanner will be restarted. */
    cc->migrate_pfn = low_pfn;

    diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    index 418bf01a50ed..23aec01836aa 100644
    --- a/mm/hugetlb.c
    +++ b/mm/hugetlb.c
    @@ -3450,15 +3450,17 @@ static void unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
    * Keep the pte_same checks anyway to make transition from the mutex easier.
    */
    static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
    - unsigned long address, pte_t *ptep, pte_t pte,
    - struct page *pagecache_page, spinlock_t *ptl)
    + unsigned long address, pte_t *ptep,
    + struct page *pagecache_page, spinlock_t *ptl)
    {
    + pte_t pte;
    struct hstate *h = hstate_vma(vma);
    struct page *old_page, *new_page;
    int ret = 0, outside_reserve = 0;
    unsigned long mmun_start; /* For mmu_notifiers */
    unsigned long mmun_end; /* For mmu_notifiers */

    + pte = huge_ptep_get(ptep);
    old_page = pte_page(pte);

    retry_avoidcopy:
    @@ -3733,7 +3735,7 @@ static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
    hugetlb_count_add(pages_per_huge_page(h), mm);
    if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
    /* Optimization, do the COW without a second fault */
    - ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page, ptl);
    + ret = hugetlb_cow(mm, vma, address, ptep, page, ptl);
    }

    spin_unlock(ptl);
    @@ -3888,8 +3890,8 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,

    if (flags & FAULT_FLAG_WRITE) {
    if (!huge_pte_write(entry)) {
    - ret = hugetlb_cow(mm, vma, address, ptep, entry,
    - pagecache_page, ptl);
    + ret = hugetlb_cow(mm, vma, address, ptep,
    + pagecache_page, ptl);
    goto out_put_page;
    }
    entry = huge_pte_mkdirty(entry);
    diff --git a/mm/khugepaged.c b/mm/khugepaged.c
    index 87e1a7ca3846..5d7c006373d3 100644
    --- a/mm/khugepaged.c
    +++ b/mm/khugepaged.c
    @@ -1403,6 +1403,9 @@ static void collapse_shmem(struct mm_struct *mm,

    spin_lock_irq(&mapping->tree_lock);

    + slot = radix_tree_lookup_slot(&mapping->page_tree, index);
    + VM_BUG_ON_PAGE(page != radix_tree_deref_slot_protected(slot,
    + &mapping->tree_lock), page);
    VM_BUG_ON_PAGE(page_mapped(page), page);

    /*
    @@ -1426,6 +1429,7 @@ static void collapse_shmem(struct mm_struct *mm,
    radix_tree_replace_slot(slot,
    new_page + (index % HPAGE_PMD_NR));

    + slot = radix_tree_iter_next(&iter);
    index++;
    continue;
    out_lru:
    @@ -1521,9 +1525,11 @@ static void collapse_shmem(struct mm_struct *mm,
    if (!page || iter.index < page->index) {
    if (!nr_none)
    break;
    - /* Put holes back where they were */
    - radix_tree_replace_slot(slot, NULL);
    nr_none--;
    + /* Put holes back where they were */
    + radix_tree_delete(&mapping->page_tree,
    + iter.index);
    + slot = radix_tree_iter_next(&iter);
    continue;
    }

    @@ -1537,6 +1543,7 @@ static void collapse_shmem(struct mm_struct *mm,
    putback_lru_page(page);
    unlock_page(page);
    spin_lock_irq(&mapping->tree_lock);
    + slot = radix_tree_iter_next(&iter);
    }
    VM_BUG_ON(nr_none);
    spin_unlock_irq(&mapping->tree_lock);
    diff --git a/mm/migrate.c b/mm/migrate.c
    index 99250aee1ac1..66ce6b490b13 100644
    --- a/mm/migrate.c
    +++ b/mm/migrate.c
    @@ -168,8 +168,6 @@ void putback_movable_pages(struct list_head *l)
    continue;
    }
    list_del(&page->lru);
    - dec_node_page_state(page, NR_ISOLATED_ANON +
    - page_is_file_cache(page));
    /*
    * We isolated non-lru movable page so here we can use
    * __PageMovable because LRU page's mapping cannot have
    @@ -186,6 +184,8 @@ void putback_movable_pages(struct list_head *l)
    put_page(page);
    } else {
    putback_lru_page(page);
    + dec_node_page_state(page, NR_ISOLATED_ANON +
    + page_is_file_cache(page));
    }
    }
    }
    @@ -1121,8 +1121,15 @@ static ICE_noinline int unmap_and_move(new_page_t get_new_page,
    * restored.
    */
    list_del(&page->lru);
    - dec_node_page_state(page, NR_ISOLATED_ANON +
    - page_is_file_cache(page));
    +
    + /*
    + * Compaction can migrate also non-LRU pages which are
    + * not accounted to NR_ISOLATED_*. They can be recognized
    + * as __PageMovable
    + */
    + if (likely(!__PageMovable(page)))
    + dec_node_page_state(page, NR_ISOLATED_ANON +
    + page_is_file_cache(page));
    }

    /*
    diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
    index f6749dced021..3b5fd4188f2a 100644
    --- a/net/mac80211/agg-rx.c
    +++ b/net/mac80211/agg-rx.c
    @@ -315,11 +315,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
    mutex_lock(&sta->ampdu_mlme.mtx);

    if (test_bit(tid, sta->ampdu_mlme.agg_session_valid)) {
    - tid_agg_rx = rcu_dereference_protected(
    - sta->ampdu_mlme.tid_rx[tid],
    - lockdep_is_held(&sta->ampdu_mlme.mtx));
    -
    - if (tid_agg_rx->dialog_token == dialog_token) {
    + if (sta->ampdu_mlme.tid_rx_token[tid] == dialog_token) {
    ht_dbg_ratelimited(sta->sdata,
    "updated AddBA Req from %pM on tid %u\n",
    sta->sta.addr, tid);
    @@ -396,7 +392,6 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
    }

    /* update data */
    - tid_agg_rx->dialog_token = dialog_token;
    tid_agg_rx->ssn = start_seq_num;
    tid_agg_rx->head_seq_num = start_seq_num;
    tid_agg_rx->buf_size = buf_size;
    @@ -418,6 +413,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
    if (status == WLAN_STATUS_SUCCESS) {
    __set_bit(tid, sta->ampdu_mlme.agg_session_valid);
    __clear_bit(tid, sta->ampdu_mlme.unexpected_agg);
    + sta->ampdu_mlme.tid_rx_token[tid] = dialog_token;
    }
    mutex_unlock(&sta->ampdu_mlme.mtx);

    diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
    index a2fcdb47a0e6..14ec63a02669 100644
    --- a/net/mac80211/debugfs_sta.c
    +++ b/net/mac80211/debugfs_sta.c
    @@ -205,7 +205,7 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
    p += scnprintf(p, sizeof(buf) + buf - p, "%02d", i);
    p += scnprintf(p, sizeof(buf) + buf - p, "\t\t%x", !!tid_rx);
    p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.2x",
    - tid_rx ? tid_rx->dialog_token : 0);
    + tid_rx ? sta->ampdu_mlme.tid_rx_token[i] : 0);
    p += scnprintf(p, sizeof(buf) + buf - p, "\t%#.3x",
    tid_rx ? tid_rx->ssn : 0);

    diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
    index ed5fcb984a01..dd06ef0b8861 100644
    --- a/net/mac80211/sta_info.h
    +++ b/net/mac80211/sta_info.h
    @@ -184,7 +184,6 @@ struct tid_ampdu_tx {
    * @ssn: Starting Sequence Number expected to be aggregated.
    * @buf_size: buffer size for incoming A-MPDUs
    * @timeout: reset timer value (in TUs).
    - * @dialog_token: dialog token for aggregation session
    * @rcu_head: RCU head used for freeing this struct
    * @reorder_lock: serializes access to reorder buffer, see below.
    * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
    @@ -213,7 +212,6 @@ struct tid_ampdu_rx {
    u16 ssn;
    u16 buf_size;
    u16 timeout;
    - u8 dialog_token;
    bool auto_seq;
    bool removed;
    };
    @@ -225,6 +223,7 @@ struct tid_ampdu_rx {
    * to tid_tx[idx], which are protected by the sta spinlock)
    * tid_start_tx is also protected by sta->lock.
    * @tid_rx: aggregation info for Rx per TID -- RCU protected
    + * @tid_rx_token: dialog tokens for valid aggregation sessions
    * @tid_rx_timer_expired: bitmap indicating on which TIDs the
    * RX timer expired until the work for it runs
    * @tid_rx_stop_requested: bitmap indicating which BA sessions per TID the
    @@ -243,6 +242,7 @@ struct sta_ampdu_mlme {
    struct mutex mtx;
    /* rx */
    struct tid_ampdu_rx __rcu *tid_rx[IEEE80211_NUM_TIDS];
    + u8 tid_rx_token[IEEE80211_NUM_TIDS];
    unsigned long tid_rx_timer_expired[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
    unsigned long tid_rx_stop_requested[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
    unsigned long agg_session_valid[BITS_TO_LONGS(IEEE80211_NUM_TIDS)];
    diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
    index bd5f4be89435..dd190ff3daea 100644
    --- a/net/mac80211/tx.c
    +++ b/net/mac80211/tx.c
    @@ -3262,7 +3262,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
    int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
    int hw_headroom = sdata->local->hw.extra_tx_headroom;
    struct ethhdr eth;
    - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
    + struct ieee80211_tx_info *info;
    struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
    struct ieee80211_tx_data tx;
    ieee80211_tx_result r;
    @@ -3326,6 +3326,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
    memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
    memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);

    + info = IEEE80211_SKB_CB(skb);
    memset(info, 0, sizeof(*info));
    info->band = fast_tx->band;
    info->control.vif = &sdata->vif;
    diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    index c510810f0b7c..a2dd6edaae37 100644
    --- a/net/wireless/nl80211.c
    +++ b/net/wireless/nl80211.c
    @@ -414,6 +414,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
    [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
    [NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
    [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
    + [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
    };

    /* policy for the key attributes */
    @@ -6677,7 +6678,20 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
    request->no_cck =
    nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);

    - if (info->attrs[NL80211_ATTR_MAC])
    + /* Initial implementation used NL80211_ATTR_MAC to set the specific
    + * BSSID to scan for. This was problematic because that same attribute
    + * was already used for another purpose (local random MAC address). The
    + * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
    + * compatibility with older userspace components, also use the
    + * NL80211_ATTR_MAC value here if it can be determined to be used for
    + * the specific BSSID use case instead of the random MAC address
    + * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
    + */
    + if (info->attrs[NL80211_ATTR_BSSID])
    + memcpy(request->bssid,
    + nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
    + else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
    + info->attrs[NL80211_ATTR_MAC])
    memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
    ETH_ALEN);
    else
    diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h
    index 950fd2e64bb7..12262c0cc691 100644
    --- a/scripts/gcc-plugins/gcc-common.h
    +++ b/scripts/gcc-plugins/gcc-common.h
    @@ -39,6 +39,9 @@
    #include "hash-map.h"
    #endif

    +#if BUILDING_GCC_VERSION >= 7000
    +#include "memmodel.h"
    +#endif
    #include "emit-rtl.h"
    #include "debug.h"
    #include "target.h"
    @@ -91,6 +94,9 @@
    #include "tree-ssa-alias.h"
    #include "tree-ssa.h"
    #include "stringpool.h"
    +#if BUILDING_GCC_VERSION >= 7000
    +#include "tree-vrp.h"
    +#endif
    #include "tree-ssanames.h"
    #include "print-tree.h"
    #include "tree-eh.h"
    @@ -287,6 +293,22 @@ static inline struct cgraph_node *cgraph_next_function_with_gimple_body(struct c
    return NULL;
    }

    +static inline bool cgraph_for_node_and_aliases(cgraph_node_ptr node, bool (*callback)(cgraph_node_ptr, void *), void *data, bool include_overwritable)
    +{
    + cgraph_node_ptr alias;
    +
    + if (callback(node, data))
    + return true;
    +
    + for (alias = node->same_body; alias; alias = alias->next) {
    + if (include_overwritable || cgraph_function_body_availability(alias) > AVAIL_OVERWRITABLE)
    + if (cgraph_for_node_and_aliases(alias, callback, data, include_overwritable))
    + return true;
    + }
    +
    + return false;
    +}
    +
    #define FOR_EACH_FUNCTION_WITH_GIMPLE_BODY(node) \
    for ((node) = cgraph_first_function_with_gimple_body(); (node); \
    (node) = cgraph_next_function_with_gimple_body(node))
    @@ -399,6 +421,7 @@ typedef union gimple_statement_d gassign;
    typedef union gimple_statement_d gcall;
    typedef union gimple_statement_d gcond;
    typedef union gimple_statement_d gdebug;
    +typedef union gimple_statement_d ggoto;
    typedef union gimple_statement_d gphi;
    typedef union gimple_statement_d greturn;

    @@ -452,6 +475,16 @@ static inline const gdebug *as_a_const_gdebug(const_gimple stmt)
    return stmt;
    }

    +static inline ggoto *as_a_ggoto(gimple stmt)
    +{
    + return stmt;
    +}
    +
    +static inline const ggoto *as_a_const_ggoto(const_gimple stmt)
    +{
    + return stmt;
    +}
    +
    static inline gphi *as_a_gphi(gimple stmt)
    {
    return stmt;
    @@ -496,6 +529,14 @@ static inline const greturn *as_a_const_greturn(const_gimple stmt)

    typedef struct rtx_def rtx_insn;

    +static inline const char *get_decl_section_name(const_tree decl)
    +{
    + if (DECL_SECTION_NAME(decl) == NULL_TREE)
    + return NULL;
    +
    + return TREE_STRING_POINTER(DECL_SECTION_NAME(decl));
    +}
    +
    static inline void set_decl_section_name(tree node, const char *value)
    {
    if (value)
    @@ -511,6 +552,7 @@ typedef struct gimple_statement_base gassign;
    typedef struct gimple_statement_call gcall;
    typedef struct gimple_statement_base gcond;
    typedef struct gimple_statement_base gdebug;
    +typedef struct gimple_statement_base ggoto;
    typedef struct gimple_statement_phi gphi;
    typedef struct gimple_statement_base greturn;

    @@ -564,6 +606,16 @@ static inline const gdebug *as_a_const_gdebug(const_gimple stmt)
    return stmt;
    }

    +static inline ggoto *as_a_ggoto(gimple stmt)
    +{
    + return stmt;
    +}
    +
    +static inline const ggoto *as_a_const_ggoto(const_gimple stmt)
    +{
    + return stmt;
    +}
    +
    static inline gphi *as_a_gphi(gimple stmt)
    {
    return as_a<gphi>(stmt);
    @@ -611,6 +663,11 @@ inline bool is_a_helper<const gassign *>::test(const_gimple gs)

    #define INSN_DELETED_P(insn) (insn)->deleted()

    +static inline const char *get_decl_section_name(const_tree decl)
    +{
    + return DECL_SECTION_NAME(decl);
    +}
    +
    /* symtab/cgraph related */
    #define debug_cgraph_node(node) (node)->debug()
    #define cgraph_get_node(decl) cgraph_node::get(decl)
    @@ -619,6 +676,7 @@ inline bool is_a_helper<const gassign *>::test(const_gimple gs)
    #define cgraph_n_nodes symtab->cgraph_count
    #define cgraph_max_uid symtab->cgraph_max_uid
    #define varpool_get_node(decl) varpool_node::get(decl)
    +#define dump_varpool_node(file, node) (node)->dump(file)

    #define cgraph_create_edge(caller, callee, call_stmt, count, freq, nest) \
    (caller)->create_edge((callee), (call_stmt), (count), (freq))
    @@ -674,6 +732,11 @@ static inline cgraph_node_ptr cgraph_alias_target(cgraph_node_ptr node)
    return node->get_alias_target();
    }

    +static inline bool cgraph_for_node_and_aliases(cgraph_node_ptr node, bool (*callback)(cgraph_node_ptr, void *), void *data, bool include_overwritable)
    +{
    + return node->call_for_symbol_thunks_and_aliases(callback, data, include_overwritable);
    +}
    +
    static inline struct cgraph_node_hook_list *cgraph_add_function_insertion_hook(cgraph_node_hook hook, void *data)
    {
    return symtab->add_cgraph_insertion_hook(hook, data);
    @@ -731,6 +794,13 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l

    template <>
    template <>
    +inline bool is_a_helper<const ggoto *>::test(const_gimple gs)
    +{
    + return gs->code == GIMPLE_GOTO;
    +}
    +
    +template <>
    +template <>
    inline bool is_a_helper<const greturn *>::test(const_gimple gs)
    {
    return gs->code == GIMPLE_RETURN;
    @@ -766,6 +836,16 @@ static inline const gcall *as_a_const_gcall(const_gimple stmt)
    return as_a<const gcall *>(stmt);
    }

    +static inline ggoto *as_a_ggoto(gimple stmt)
    +{
    + return as_a<ggoto *>(stmt);
    +}
    +
    +static inline const ggoto *as_a_const_ggoto(const_gimple stmt)
    +{
    + return as_a<const ggoto *>(stmt);
    +}
    +
    static inline gphi *as_a_gphi(gimple stmt)
    {
    return as_a<gphi *>(stmt);
    @@ -828,4 +908,9 @@ static inline void debug_gimple_stmt(const_gimple s)
    #define debug_gimple_stmt(s) debug_gimple_stmt(CONST_CAST_GIMPLE(s))
    #endif

    +#if BUILDING_GCC_VERSION >= 7000
    +#define get_inner_reference(exp, pbitsize, pbitpos, poffset, pmode, punsignedp, preversep, pvolatilep, keep_aligning) \
    + get_inner_reference(exp, pbitsize, pbitpos, poffset, pmode, punsignedp, preversep, pvolatilep)
    +#endif
    +
    #endif
    diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
    index c07a3844ea0a..3df46906492d 100644
    --- a/security/integrity/ima/ima_fs.c
    +++ b/security/integrity/ima/ima_fs.c
    @@ -401,7 +401,7 @@ static int ima_release_policy(struct inode *inode, struct file *file)
    const char *cause = valid_policy ? "completed" : "failed";

    if ((file->f_flags & O_ACCMODE) == O_RDONLY)
    - return 0;
    + return seq_release(inode, file);

    if (valid_policy && ima_check_policy() < 0) {
    cause = "failed";
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index 3f75d1b83bf2..758ac86a1d3a 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -2230,6 +2230,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
    SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
    SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
    + SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
    SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
    SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
    SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
    @@ -6943,6 +6944,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
    SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
    SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51),
    + SND_PCI_QUIRK(0x1043, 0x1963, "ASUS X71SL", ALC662_FIXUP_ASUS_MODE8),
    SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
    SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
    SND_PCI_QUIRK(0x1043, 0x8469, "ASUS mobo", ALC662_FIXUP_NO_JACK_DETECT),
    diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c
    index 56056ed7fcfd..16c94c45ce50 100644
    --- a/sound/soc/intel/boards/cht_bsw_rt5645.c
    +++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
    @@ -44,6 +44,7 @@ struct cht_acpi_card {
    struct cht_mc_private {
    struct snd_soc_jack jack;
    struct cht_acpi_card *acpi_card;
    + char codec_name[16];
    };

    static inline struct snd_soc_dai *cht_get_codec_dai(struct snd_soc_card *card)
    @@ -354,7 +355,6 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
    int i;
    struct cht_mc_private *drv;
    struct snd_soc_card *card = snd_soc_cards[0].soc_card;
    - char codec_name[16];
    struct sst_acpi_mach *mach;
    const char *i2c_name = NULL;
    int dai_index = 0;
    @@ -374,12 +374,12 @@ static int snd_cht_mc_probe(struct platform_device *pdev)
    }
    card->dev = &pdev->dev;
    mach = card->dev->platform_data;
    - sprintf(codec_name, "i2c-%s:00", drv->acpi_card->codec_id);
    + sprintf(drv->codec_name, "i2c-%s:00", drv->acpi_card->codec_id);

    /* set correct codec name */
    for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
    if (!strcmp(card->dai_link[i].codec_name, "i2c-10EC5645:00")) {
    - card->dai_link[i].codec_name = kstrdup(codec_name, GFP_KERNEL);
    + card->dai_link[i].codec_name = drv->codec_name;
    dai_index = i;
    }

    diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
    index 8dc03039b311..ea162fbf68e5 100644
    --- a/sound/soc/intel/skylake/skl-sst-utils.c
    +++ b/sound/soc/intel/skylake/skl-sst-utils.c
    @@ -179,7 +179,7 @@ static inline int skl_getid_32(struct uuid_module *module, u64 *val,
    index = ffz(mask_val);
    pvt_id = index + word1_mask + word2_mask;
    if (pvt_id <= (max_inst - 1)) {
    - *val |= 1 << (index + word1_mask);
    + *val |= 1ULL << (index + word1_mask);
    return pvt_id;
    }
    }
    diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
    index b392e51de94d..420d200f9a05 100644
    --- a/sound/soc/qcom/lpass-platform.c
    +++ b/sound/soc/qcom/lpass-platform.c
    @@ -78,6 +78,9 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
    dma_ch = 0;
    if (v->alloc_dma_channel)
    dma_ch = v->alloc_dma_channel(drvdata, dir);
    + else
    + dma_ch = 0;
    +
    if (dma_ch < 0)
    return dma_ch;

    diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
    index 7825bff45ae3..85324e61cbd5 100644
    --- a/sound/soc/samsung/i2s.c
    +++ b/sound/soc/samsung/i2s.c
    @@ -1029,12 +1029,13 @@ static int samsung_i2s_dai_probe(struct snd_soc_dai *dai)
    static int samsung_i2s_dai_remove(struct snd_soc_dai *dai)
    {
    struct i2s_dai *i2s = snd_soc_dai_get_drvdata(dai);
    + unsigned long flags;

    if (!is_secondary(i2s)) {
    if (i2s->quirks & QUIRK_NEED_RSTCLR) {
    - spin_lock(i2s->lock);
    + spin_lock_irqsave(i2s->lock, flags);
    writel(0, i2s->addr + I2SCON);
    - spin_unlock(i2s->lock);
    + spin_unlock_irqrestore(i2s->lock, flags);
    }
    }

    diff --git a/sound/usb/card.c b/sound/usb/card.c
    index 2ddc034673a8..f36cb068dad3 100644
    --- a/sound/usb/card.c
    +++ b/sound/usb/card.c
    @@ -206,7 +206,6 @@ static int snd_usb_create_stream(struct snd_usb_audio *chip, int ctrlif, int int
    if (! snd_usb_parse_audio_interface(chip, interface)) {
    usb_set_interface(dev, interface, 0); /* reset the current interface */
    usb_driver_claim_interface(&usb_audio_driver, iface, (void *)-1L);
    - return -EINVAL;
    }

    return 0;
    diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
    index c470251cea4b..c5251aaad844 100644
    --- a/sound/usb/endpoint.c
    +++ b/sound/usb/endpoint.c
    @@ -534,6 +534,11 @@ static int wait_clear_urbs(struct snd_usb_endpoint *ep)
    alive, ep->ep_num);
    clear_bit(EP_FLAG_STOPPING, &ep->flags);

    + ep->data_subs = NULL;
    + ep->sync_slave = NULL;
    + ep->retire_data_urb = NULL;
    + ep->prepare_data_urb = NULL;
    +
    return 0;
    }

    @@ -898,9 +903,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
    /**
    * snd_usb_endpoint_start: start an snd_usb_endpoint
    *
    - * @ep: the endpoint to start
    - * @can_sleep: flag indicating whether the operation is executed in
    - * non-atomic context
    + * @ep: the endpoint to start
    *
    * A call to this function will increment the use count of the endpoint.
    * In case it is not already running, the URBs for this endpoint will be
    @@ -910,7 +913,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
    *
    * Returns an error if the URB submission failed, 0 in all other cases.
    */
    -int snd_usb_endpoint_start(struct snd_usb_endpoint *ep, bool can_sleep)
    +int snd_usb_endpoint_start(struct snd_usb_endpoint *ep)
    {
    int err;
    unsigned int i;
    @@ -924,8 +927,6 @@ int snd_usb_endpoint_start(struct snd_usb_endpoint *ep, bool can_sleep)

    /* just to be sure */
    deactivate_urbs(ep, false);
    - if (can_sleep)
    - wait_clear_urbs(ep);

    ep->active_mask = 0;
    ep->unlink_mask = 0;
    @@ -1006,10 +1007,6 @@ void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep)

    if (--ep->use_count == 0) {
    deactivate_urbs(ep, false);
    - ep->data_subs = NULL;
    - ep->sync_slave = NULL;
    - ep->retire_data_urb = NULL;
    - ep->prepare_data_urb = NULL;
    set_bit(EP_FLAG_STOPPING, &ep->flags);
    }
    }
    diff --git a/sound/usb/endpoint.h b/sound/usb/endpoint.h
    index 6428392d8f62..584f295d7c77 100644
    --- a/sound/usb/endpoint.h
    +++ b/sound/usb/endpoint.h
    @@ -18,7 +18,7 @@ int snd_usb_endpoint_set_params(struct snd_usb_endpoint *ep,
    struct audioformat *fmt,
    struct snd_usb_endpoint *sync_ep);

    -int snd_usb_endpoint_start(struct snd_usb_endpoint *ep, bool can_sleep);
    +int snd_usb_endpoint_start(struct snd_usb_endpoint *ep);
    void snd_usb_endpoint_stop(struct snd_usb_endpoint *ep);
    void snd_usb_endpoint_sync_pending_stop(struct snd_usb_endpoint *ep);
    int snd_usb_endpoint_activate(struct snd_usb_endpoint *ep);
    diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
    index 44d178ee9177..48afae053c56 100644
    --- a/sound/usb/pcm.c
    +++ b/sound/usb/pcm.c
    @@ -218,7 +218,7 @@ int snd_usb_init_pitch(struct snd_usb_audio *chip, int iface,
    }
    }

    -static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep)
    +static int start_endpoints(struct snd_usb_substream *subs)
    {
    int err;

    @@ -231,7 +231,7 @@ static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep)
    dev_dbg(&subs->dev->dev, "Starting data EP @%p\n", ep);

    ep->data_subs = subs;
    - err = snd_usb_endpoint_start(ep, can_sleep);
    + err = snd_usb_endpoint_start(ep);
    if (err < 0) {
    clear_bit(SUBSTREAM_FLAG_DATA_EP_STARTED, &subs->flags);
    return err;
    @@ -260,7 +260,7 @@ static int start_endpoints(struct snd_usb_substream *subs, bool can_sleep)
    dev_dbg(&subs->dev->dev, "Starting sync EP @%p\n", ep);

    ep->sync_slave = subs->data_endpoint;
    - err = snd_usb_endpoint_start(ep, can_sleep);
    + err = snd_usb_endpoint_start(ep);
    if (err < 0) {
    clear_bit(SUBSTREAM_FLAG_SYNC_EP_STARTED, &subs->flags);
    return err;
    @@ -839,7 +839,7 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
    /* for playback, submit the URBs now; otherwise, the first hwptr_done
    * updates for all URBs would happen at the same time when starting */
    if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
    - ret = start_endpoints(subs, true);
    + ret = start_endpoints(subs);

    unlock:
    snd_usb_unlock_shutdown(subs->stream->chip);
    @@ -1655,7 +1655,7 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream

    switch (cmd) {
    case SNDRV_PCM_TRIGGER_START:
    - err = start_endpoints(subs, false);
    + err = start_endpoints(subs);
    if (err < 0)
    return err;

    \
     
     \ /
      Last update: 2017-01-12 11:47    [W:0.465 / U:2.156 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site