Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.14/0136-4.14.37-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.14/0136-4.14.37-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3238 - (hide annotations) (download)
    Fri Nov 9 12:14:58 2018 UTC (5 years, 7 months ago) by niro
    File size: 271556 byte(s) 
    -added up to patches-4.14.79
    1 niro 3238 diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt
    2     index 1699a55b7b70..ef639960b272 100644
    3     --- a/Documentation/device-mapper/thin-provisioning.txt
    4     +++ b/Documentation/device-mapper/thin-provisioning.txt
    5     @@ -112,9 +112,11 @@ $low_water_mark is expressed in blocks of size $data_block_size. If
    6     free space on the data device drops below this level then a dm event
    7     will be triggered which a userspace daemon should catch allowing it to
    8     extend the pool device. Only one such event will be sent.
    9     -Resuming a device with a new table itself triggers an event so the
    10     -userspace daemon can use this to detect a situation where a new table
    11     -already exceeds the threshold.
    12     +
    13     +No special event is triggered if a just resumed device's free space is below
    14     +the low water mark. However, resuming a device always triggers an
    15     +event; a userspace daemon should verify that free space exceeds the low
    16     +water mark when handling this event.
    17    
    18     A low water mark for the metadata device is maintained in the kernel and
    19     will trigger a dm event if free space on the metadata device drops below
    20     diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
    21     index e63a35fafef0..0f9089416b4c 100644
    22     --- a/Documentation/virtual/kvm/api.txt
    23     +++ b/Documentation/virtual/kvm/api.txt
    24     @@ -1837,6 +1837,7 @@ registers, find a list below:
    25     PPC | KVM_REG_PPC_DBSR | 32
    26     PPC | KVM_REG_PPC_TIDR | 64
    27     PPC | KVM_REG_PPC_PSSCR | 64
    28     + PPC | KVM_REG_PPC_DEC_EXPIRY | 64
    29     PPC | KVM_REG_PPC_TM_GPR0 | 64
    30     ...
    31     PPC | KVM_REG_PPC_TM_GPR31 | 64
    32     diff --git a/Makefile b/Makefile
    33     index 0a1f941899f4..ee330f5449e6 100644
    34     --- a/Makefile
    35     +++ b/Makefile
    36     @@ -1,7 +1,7 @@
    37     # SPDX-License-Identifier: GPL-2.0
    38     VERSION = 4
    39     PATCHLEVEL = 14
    40     -SUBLEVEL = 36
    41     +SUBLEVEL = 37
    42     EXTRAVERSION =
    43     NAME = Petit Gorille
    44    
    45     diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
    46     index 95ad7102b63c..82375b896be5 100644
    47     --- a/arch/arm64/include/asm/spinlock.h
    48     +++ b/arch/arm64/include/asm/spinlock.h
    49     @@ -89,8 +89,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
    50     " cbnz %w1, 1f\n"
    51     " add %w1, %w0, %3\n"
    52     " casa %w0, %w1, %2\n"
    53     - " and %w1, %w1, #0xffff\n"
    54     - " eor %w1, %w1, %w0, lsr #16\n"
    55     + " sub %w1, %w1, %3\n"
    56     + " eor %w1, %w1, %w0\n"
    57     "1:")
    58     : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock)
    59     : "I" (1 << TICKET_SHIFT)
    60     diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
    61     index c675eece389a..adce180f3ee4 100644
    62     --- a/arch/mips/boot/compressed/Makefile
    63     +++ b/arch/mips/boot/compressed/Makefile
    64     @@ -133,4 +133,8 @@ vmlinuz.srec: vmlinuz
    65     uzImage.bin: vmlinuz.bin FORCE
    66     $(call if_changed,uimage,none)
    67    
    68     -clean-files := $(objtree)/vmlinuz $(objtree)/vmlinuz.{32,ecoff,bin,srec}
    69     +clean-files += $(objtree)/vmlinuz
    70     +clean-files += $(objtree)/vmlinuz.32
    71     +clean-files += $(objtree)/vmlinuz.ecoff
    72     +clean-files += $(objtree)/vmlinuz.bin
    73     +clean-files += $(objtree)/vmlinuz.srec
    74     diff --git a/arch/mips/generic/irq.c b/arch/mips/generic/irq.c
    75     index 394f8161e462..cb7fdaeef426 100644
    76     --- a/arch/mips/generic/irq.c
    77     +++ b/arch/mips/generic/irq.c
    78     @@ -22,10 +22,10 @@ int get_c0_fdc_int(void)
    79     {
    80     int mips_cpu_fdc_irq;
    81    
    82     - if (cpu_has_veic)
    83     - panic("Unimplemented!");
    84     - else if (mips_gic_present())
    85     + if (mips_gic_present())
    86     mips_cpu_fdc_irq = gic_get_c0_fdc_int();
    87     + else if (cpu_has_veic)
    88     + panic("Unimplemented!");
    89     else if (cp0_fdc_irq >= 0)
    90     mips_cpu_fdc_irq = MIPS_CPU_IRQ_BASE + cp0_fdc_irq;
    91     else
    92     @@ -38,10 +38,10 @@ int get_c0_perfcount_int(void)
    93     {
    94     int mips_cpu_perf_irq;
    95    
    96     - if (cpu_has_veic)
    97     - panic("Unimplemented!");
    98     - else if (mips_gic_present())
    99     + if (mips_gic_present())
    100     mips_cpu_perf_irq = gic_get_c0_perfcount_int();
    101     + else if (cpu_has_veic)
    102     + panic("Unimplemented!");
    103     else if (cp0_perfcount_irq >= 0)
    104     mips_cpu_perf_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq;
    105     else
    106     @@ -54,10 +54,10 @@ unsigned int get_c0_compare_int(void)
    107     {
    108     int mips_cpu_timer_irq;
    109    
    110     - if (cpu_has_veic)
    111     - panic("Unimplemented!");
    112     - else if (mips_gic_present())
    113     + if (mips_gic_present())
    114     mips_cpu_timer_irq = gic_get_c0_compare_int();
    115     + else if (cpu_has_veic)
    116     + panic("Unimplemented!");
    117     else
    118     mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
    119    
    120     diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
    121     index 8b937300fb7f..fd26fadc8617 100644
    122     --- a/arch/mips/txx9/rbtx4939/setup.c
    123     +++ b/arch/mips/txx9/rbtx4939/setup.c
    124     @@ -186,7 +186,7 @@ static void __init rbtx4939_update_ioc_pen(void)
    125    
    126     #define RBTX4939_MAX_7SEGLEDS 8
    127    
    128     -#if IS_ENABLED(CONFIG_LEDS_CLASS)
    129     +#if IS_BUILTIN(CONFIG_LEDS_CLASS)
    130     static u8 led_val[RBTX4939_MAX_7SEGLEDS];
    131     struct rbtx4939_led_data {
    132     struct led_classdev cdev;
    133     @@ -261,7 +261,7 @@ static inline void rbtx4939_led_setup(void)
    134    
    135     static void __rbtx4939_7segled_putc(unsigned int pos, unsigned char val)
    136     {
    137     -#if IS_ENABLED(CONFIG_LEDS_CLASS)
    138     +#if IS_BUILTIN(CONFIG_LEDS_CLASS)
    139     unsigned long flags;
    140     local_irq_save(flags);
    141     /* bit7: reserved for LED class */
    142     diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
    143     index 1fcfa425cefa..f326b40b7c7b 100644
    144     --- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
    145     +++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
    146     @@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd)
    147    
    148     static inline pgd_t *pgd_alloc(struct mm_struct *mm)
    149     {
    150     + pgd_t *pgd;
    151     +
    152     if (radix_enabled())
    153     return radix__pgd_alloc(mm);
    154     - return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
    155     - pgtable_gfp_flags(mm, GFP_KERNEL));
    156     +
    157     + pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE),
    158     + pgtable_gfp_flags(mm, GFP_KERNEL));
    159     + memset(pgd, 0, PGD_TABLE_SIZE);
    160     +
    161     + return pgd;
    162     }
    163    
    164     static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
    165     diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
    166     index 61d6049f4c1e..8aaec831053a 100644
    167     --- a/arch/powerpc/include/uapi/asm/kvm.h
    168     +++ b/arch/powerpc/include/uapi/asm/kvm.h
    169     @@ -607,6 +607,8 @@ struct kvm_ppc_rmmu_info {
    170     #define KVM_REG_PPC_TIDR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc)
    171     #define KVM_REG_PPC_PSSCR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd)
    172    
    173     +#define KVM_REG_PPC_DEC_EXPIRY (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe)
    174     +
    175     /* Transactional Memory checkpointed state:
    176     * This is all GPRs, all VSX regs and a subset of SPRs
    177     */
    178     diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
    179     index 13c9dcdcba69..d17007451f62 100644
    180     --- a/arch/powerpc/kernel/traps.c
    181     +++ b/arch/powerpc/kernel/traps.c
    182     @@ -336,7 +336,7 @@ void system_reset_exception(struct pt_regs *regs)
    183     * No debugger or crash dump registered, print logs then
    184     * panic.
    185     */
    186     - __die("System Reset", regs, SIGABRT);
    187     + die("System Reset", regs, SIGABRT);
    188    
    189     mdelay(2*MSEC_PER_SEC); /* Wait a little while for others to print */
    190     add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
    191     diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
    192     index 2645d484e945..df9b53f40b1e 100644
    193     --- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
    194     +++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
    195     @@ -1348,12 +1348,8 @@ static unsigned long resize_hpt_rehash_hpte(struct kvm_resize_hpt *resize,
    196     }
    197    
    198     new_pteg = hash & new_hash_mask;
    199     - if (vpte & HPTE_V_SECONDARY) {
    200     - BUG_ON(~pteg != (hash & old_hash_mask));
    201     - new_pteg = ~new_pteg;
    202     - } else {
    203     - BUG_ON(pteg != (hash & old_hash_mask));
    204     - }
    205     + if (vpte & HPTE_V_SECONDARY)
    206     + new_pteg = ~hash & new_hash_mask;
    207    
    208     new_idx = new_pteg * HPTES_PER_GROUP + (idx % HPTES_PER_GROUP);
    209     new_hptep = (__be64 *)(new->virt + (new_idx << 4));
    210     diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
    211     index f48e3379a18a..e094dc90ff1b 100644
    212     --- a/arch/powerpc/kvm/book3s_hv.c
    213     +++ b/arch/powerpc/kvm/book3s_hv.c
    214     @@ -1497,6 +1497,10 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
    215     case KVM_REG_PPC_ARCH_COMPAT:
    216     *val = get_reg_val(id, vcpu->arch.vcore->arch_compat);
    217     break;
    218     + case KVM_REG_PPC_DEC_EXPIRY:
    219     + *val = get_reg_val(id, vcpu->arch.dec_expires +
    220     + vcpu->arch.vcore->tb_offset);
    221     + break;
    222     default:
    223     r = -EINVAL;
    224     break;
    225     @@ -1724,6 +1728,10 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
    226     case KVM_REG_PPC_ARCH_COMPAT:
    227     r = kvmppc_set_arch_compat(vcpu, set_reg_val(id, *val));
    228     break;
    229     + case KVM_REG_PPC_DEC_EXPIRY:
    230     + vcpu->arch.dec_expires = set_reg_val(id, *val) -
    231     + vcpu->arch.vcore->tb_offset;
    232     + break;
    233     default:
    234     r = -EINVAL;
    235     break;
    236     diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
    237     index 2b02d51d14d8..ecb45361095b 100644
    238     --- a/arch/powerpc/kvm/powerpc.c
    239     +++ b/arch/powerpc/kvm/powerpc.c
    240     @@ -758,7 +758,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
    241    
    242     hrtimer_init(&vcpu->arch.dec_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
    243     vcpu->arch.dec_timer.function = kvmppc_decrementer_wakeup;
    244     - vcpu->arch.dec_expires = ~(u64)0;
    245     + vcpu->arch.dec_expires = get_tb();
    246    
    247     #ifdef CONFIG_KVM_EXIT_TIMING
    248     mutex_init(&vcpu->arch.exit_timing_lock);
    249     diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
    250     index a81279249bfb..9fead0796364 100644
    251     --- a/arch/powerpc/mm/numa.c
    252     +++ b/arch/powerpc/mm/numa.c
    253     @@ -546,7 +546,7 @@ static int numa_setup_cpu(unsigned long lcpu)
    254     nid = of_node_to_nid_single(cpu);
    255    
    256     out_present:
    257     - if (nid < 0 || !node_online(nid))
    258     + if (nid < 0 || !node_possible(nid))
    259     nid = first_online_node;
    260    
    261     map_cpu_to_node(lcpu, nid);
    262     @@ -887,6 +887,32 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
    263     NODE_DATA(nid)->node_spanned_pages = spanned_pages;
    264     }
    265    
    266     +static void __init find_possible_nodes(void)
    267     +{
    268     + struct device_node *rtas;
    269     + u32 numnodes, i;
    270     +
    271     + if (min_common_depth <= 0)
    272     + return;
    273     +
    274     + rtas = of_find_node_by_path("/rtas");
    275     + if (!rtas)
    276     + return;
    277     +
    278     + if (of_property_read_u32_index(rtas,
    279     + "ibm,max-associativity-domains",
    280     + min_common_depth, &numnodes))
    281     + goto out;
    282     +
    283     + for (i = 0; i < numnodes; i++) {
    284     + if (!node_possible(i))
    285     + node_set(i, node_possible_map);
    286     + }
    287     +
    288     +out:
    289     + of_node_put(rtas);
    290     +}
    291     +
    292     void __init initmem_init(void)
    293     {
    294     int nid, cpu;
    295     @@ -900,12 +926,15 @@ void __init initmem_init(void)
    296     memblock_dump_all();
    297    
    298     /*
    299     - * Reduce the possible NUMA nodes to the online NUMA nodes,
    300     - * since we do not support node hotplug. This ensures that we
    301     - * lower the maximum NUMA node ID to what is actually present.
    302     + * Modify the set of possible NUMA nodes to reflect information
    303     + * available about the set of online nodes, and the set of nodes
    304     + * that we expect to make use of for this platform's affinity
    305     + * calculations.
    306     */
    307     nodes_and(node_possible_map, node_possible_map, node_online_map);
    308    
    309     + find_possible_nodes();
    310     +
    311     for_each_online_node(nid) {
    312     unsigned long start_pfn, end_pfn;
    313    
    314     @@ -1246,6 +1275,40 @@ static long vphn_get_associativity(unsigned long cpu,
    315     return rc;
    316     }
    317    
    318     +static inline int find_and_online_cpu_nid(int cpu)
    319     +{
    320     + __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
    321     + int new_nid;
    322     +
    323     + /* Use associativity from first thread for all siblings */
    324     + vphn_get_associativity(cpu, associativity);
    325     + new_nid = associativity_to_nid(associativity);
    326     + if (new_nid < 0 || !node_possible(new_nid))
    327     + new_nid = first_online_node;
    328     +
    329     + if (NODE_DATA(new_nid) == NULL) {
    330     +#ifdef CONFIG_MEMORY_HOTPLUG
    331     + /*
    332     + * Need to ensure that NODE_DATA is initialized for a node from
    333     + * available memory (see memblock_alloc_try_nid). If unable to
    334     + * init the node, then default to nearest node that has memory
    335     + * installed.
    336     + */
    337     + if (try_online_node(new_nid))
    338     + new_nid = first_online_node;
    339     +#else
    340     + /*
    341     + * Default to using the nearest node that has memory installed.
    342     + * Otherwise, it would be necessary to patch the kernel MM code
    343     + * to deal with more memoryless-node error conditions.
    344     + */
    345     + new_nid = first_online_node;
    346     +#endif
    347     + }
    348     +
    349     + return new_nid;
    350     +}
    351     +
    352     /*
    353     * Update the CPU maps and sysfs entries for a single CPU when its NUMA
    354     * characteristics change. This function doesn't perform any locking and is
    355     @@ -1313,7 +1376,6 @@ int numa_update_cpu_topology(bool cpus_locked)
    356     {
    357     unsigned int cpu, sibling, changed = 0;
    358     struct topology_update_data *updates, *ud;
    359     - __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0};
    360     cpumask_t updated_cpus;
    361     struct device *dev;
    362     int weight, new_nid, i = 0;
    363     @@ -1348,11 +1410,7 @@ int numa_update_cpu_topology(bool cpus_locked)
    364     continue;
    365     }
    366    
    367     - /* Use associativity from first thread for all siblings */
    368     - vphn_get_associativity(cpu, associativity);
    369     - new_nid = associativity_to_nid(associativity);
    370     - if (new_nid < 0 || !node_online(new_nid))
    371     - new_nid = first_online_node;
    372     + new_nid = find_and_online_cpu_nid(cpu);
    373    
    374     if (new_nid == numa_cpu_lookup_table[cpu]) {
    375     cpumask_andnot(&cpu_associativity_changes_mask,
    376     diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
    377     index b150f4deaccf..6914b289c86b 100644
    378     --- a/arch/powerpc/platforms/powernv/opal-imc.c
    379     +++ b/arch/powerpc/platforms/powernv/opal-imc.c
    380     @@ -126,9 +126,11 @@ static void disable_nest_pmu_counters(void)
    381     const struct cpumask *l_cpumask;
    382    
    383     get_online_cpus();
    384     - for_each_online_node(nid) {
    385     + for_each_node_with_cpus(nid) {
    386     l_cpumask = cpumask_of_node(nid);
    387     - cpu = cpumask_first(l_cpumask);
    388     + cpu = cpumask_first_and(l_cpumask, cpu_online_mask);
    389     + if (cpu >= nr_cpu_ids)
    390     + continue;
    391     opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
    392     get_hard_smp_processor_id(cpu));
    393     }
    394     diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h
    395     index eb5323161f11..bb63b2afdf6f 100644
    396     --- a/arch/s390/include/asm/eadm.h
    397     +++ b/arch/s390/include/asm/eadm.h
    398     @@ -4,7 +4,7 @@
    399    
    400     #include <linux/types.h>
    401     #include <linux/device.h>
    402     -#include <linux/blkdev.h>
    403     +#include <linux/blk_types.h>
    404    
    405     struct arqb {
    406     u64 data;
    407     diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
    408     index 0fa3a788dd20..0bce918db11a 100644
    409     --- a/arch/s390/kvm/kvm-s390.c
    410     +++ b/arch/s390/kvm/kvm-s390.c
    411     @@ -601,7 +601,7 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap)
    412     case KVM_CAP_S390_GS:
    413     r = -EINVAL;
    414     mutex_lock(&kvm->lock);
    415     - if (atomic_read(&kvm->online_vcpus)) {
    416     + if (kvm->created_vcpus) {
    417     r = -EBUSY;
    418     } else if (test_facility(133)) {
    419     set_kvm_facility(kvm->arch.model.fac_mask, 133);
    420     @@ -1121,7 +1121,7 @@ static int kvm_s390_set_processor_feat(struct kvm *kvm,
    421     return -EINVAL;
    422    
    423     mutex_lock(&kvm->lock);
    424     - if (!atomic_read(&kvm->online_vcpus)) {
    425     + if (!kvm->created_vcpus) {
    426     bitmap_copy(kvm->arch.cpu_feat, (unsigned long *) data.feat,
    427     KVM_S390_VM_CPU_FEAT_NR_BITS);
    428     ret = 0;
    429     diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
    430     index b18b5652e5c5..a74204db759b 100644
    431     --- a/arch/s390/kvm/vsie.c
    432     +++ b/arch/s390/kvm/vsie.c
    433     @@ -31,7 +31,11 @@ struct vsie_page {
    434     * the same offset as that in struct sie_page!
    435     */
    436     struct mcck_volatile_info mcck_info; /* 0x0200 */
    437     - /* the pinned originial scb */
    438     + /*
    439     + * The pinned original scb. Be aware that other VCPUs can modify
    440     + * it while we read from it. Values that are used for conditions or
    441     + * are reused conditionally, should be accessed via READ_ONCE.
    442     + */
    443     struct kvm_s390_sie_block *scb_o; /* 0x0218 */
    444     /* the shadow gmap in use by the vsie_page */
    445     struct gmap *gmap; /* 0x0220 */
    446     @@ -143,12 +147,13 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    447     {
    448     struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
    449     struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
    450     - u32 crycb_addr = scb_o->crycbd & 0x7ffffff8U;
    451     + const uint32_t crycbd_o = READ_ONCE(scb_o->crycbd);
    452     + const u32 crycb_addr = crycbd_o & 0x7ffffff8U;
    453     unsigned long *b1, *b2;
    454     u8 ecb3_flags;
    455    
    456     scb_s->crycbd = 0;
    457     - if (!(scb_o->crycbd & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1))
    458     + if (!(crycbd_o & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1))
    459     return 0;
    460     /* format-1 is supported with message-security-assist extension 3 */
    461     if (!test_kvm_facility(vcpu->kvm, 76))
    462     @@ -186,12 +191,15 @@ static void prepare_ibc(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    463     {
    464     struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
    465     struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
    466     + /* READ_ONCE does not work on bitfields - use a temporary variable */
    467     + const uint32_t __new_ibc = scb_o->ibc;
    468     + const uint32_t new_ibc = READ_ONCE(__new_ibc) & 0x0fffU;
    469     __u64 min_ibc = (sclp.ibc >> 16) & 0x0fffU;
    470    
    471     scb_s->ibc = 0;
    472     /* ibc installed in g2 and requested for g3 */
    473     - if (vcpu->kvm->arch.model.ibc && (scb_o->ibc & 0x0fffU)) {
    474     - scb_s->ibc = scb_o->ibc & 0x0fffU;
    475     + if (vcpu->kvm->arch.model.ibc && new_ibc) {
    476     + scb_s->ibc = new_ibc;
    477     /* takte care of the minimum ibc level of the machine */
    478     if (scb_s->ibc < min_ibc)
    479     scb_s->ibc = min_ibc;
    480     @@ -256,6 +264,10 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    481     {
    482     struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
    483     struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
    484     + /* READ_ONCE does not work on bitfields - use a temporary variable */
    485     + const uint32_t __new_prefix = scb_o->prefix;
    486     + const uint32_t new_prefix = READ_ONCE(__new_prefix);
    487     + const bool wants_tx = READ_ONCE(scb_o->ecb) & ECB_TE;
    488     bool had_tx = scb_s->ecb & ECB_TE;
    489     unsigned long new_mso = 0;
    490     int rc;
    491     @@ -302,14 +314,14 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    492     scb_s->icpua = scb_o->icpua;
    493    
    494     if (!(atomic_read(&scb_s->cpuflags) & CPUSTAT_SM))
    495     - new_mso = scb_o->mso & 0xfffffffffff00000UL;
    496     + new_mso = READ_ONCE(scb_o->mso) & 0xfffffffffff00000UL;
    497     /* if the hva of the prefix changes, we have to remap the prefix */
    498     - if (scb_s->mso != new_mso || scb_s->prefix != scb_o->prefix)
    499     + if (scb_s->mso != new_mso || scb_s->prefix != new_prefix)
    500     prefix_unmapped(vsie_page);
    501     /* SIE will do mso/msl validity and exception checks for us */
    502     scb_s->msl = scb_o->msl & 0xfffffffffff00000UL;
    503     scb_s->mso = new_mso;
    504     - scb_s->prefix = scb_o->prefix;
    505     + scb_s->prefix = new_prefix;
    506    
    507     /* We have to definetly flush the tlb if this scb never ran */
    508     if (scb_s->ihcpu != 0xffffU)
    509     @@ -321,11 +333,11 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    510     if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_ESOP))
    511     scb_s->ecb |= scb_o->ecb & ECB_HOSTPROTINT;
    512     /* transactional execution */
    513     - if (test_kvm_facility(vcpu->kvm, 73)) {
    514     + if (test_kvm_facility(vcpu->kvm, 73) && wants_tx) {
    515     /* remap the prefix is tx is toggled on */
    516     - if ((scb_o->ecb & ECB_TE) && !had_tx)
    517     + if (!had_tx)
    518     prefix_unmapped(vsie_page);
    519     - scb_s->ecb |= scb_o->ecb & ECB_TE;
    520     + scb_s->ecb |= ECB_TE;
    521     }
    522     /* SIMD */
    523     if (test_kvm_facility(vcpu->kvm, 129)) {
    524     @@ -544,9 +556,9 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    525     gpa_t gpa;
    526     int rc = 0;
    527    
    528     - gpa = scb_o->scaol & ~0xfUL;
    529     + gpa = READ_ONCE(scb_o->scaol) & ~0xfUL;
    530     if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_64BSCAO))
    531     - gpa |= (u64) scb_o->scaoh << 32;
    532     + gpa |= (u64) READ_ONCE(scb_o->scaoh) << 32;
    533     if (gpa) {
    534     if (!(gpa & ~0x1fffUL))
    535     rc = set_validity_icpt(scb_s, 0x0038U);
    536     @@ -566,7 +578,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    537     scb_s->scaol = (u32)(u64)hpa;
    538     }
    539    
    540     - gpa = scb_o->itdba & ~0xffUL;
    541     + gpa = READ_ONCE(scb_o->itdba) & ~0xffUL;
    542     if (gpa && (scb_s->ecb & ECB_TE)) {
    543     if (!(gpa & ~0x1fffU)) {
    544     rc = set_validity_icpt(scb_s, 0x0080U);
    545     @@ -581,7 +593,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    546     scb_s->itdba = hpa;
    547     }
    548    
    549     - gpa = scb_o->gvrd & ~0x1ffUL;
    550     + gpa = READ_ONCE(scb_o->gvrd) & ~0x1ffUL;
    551     if (gpa && (scb_s->eca & ECA_VX) && !(scb_s->ecd & ECD_HOSTREGMGMT)) {
    552     if (!(gpa & ~0x1fffUL)) {
    553     rc = set_validity_icpt(scb_s, 0x1310U);
    554     @@ -599,7 +611,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    555     scb_s->gvrd = hpa;
    556     }
    557    
    558     - gpa = scb_o->riccbd & ~0x3fUL;
    559     + gpa = READ_ONCE(scb_o->riccbd) & ~0x3fUL;
    560     if (gpa && (scb_s->ecb3 & ECB3_RI)) {
    561     if (!(gpa & ~0x1fffUL)) {
    562     rc = set_validity_icpt(scb_s, 0x0043U);
    563     @@ -617,8 +629,8 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    564     if ((scb_s->ecb & ECB_GS) && !(scb_s->ecd & ECD_HOSTREGMGMT)) {
    565     unsigned long sdnxc;
    566    
    567     - gpa = scb_o->sdnxo & ~0xfUL;
    568     - sdnxc = scb_o->sdnxo & 0xfUL;
    569     + gpa = READ_ONCE(scb_o->sdnxo) & ~0xfUL;
    570     + sdnxc = READ_ONCE(scb_o->sdnxo) & 0xfUL;
    571     if (!gpa || !(gpa & ~0x1fffUL)) {
    572     rc = set_validity_icpt(scb_s, 0x10b0U);
    573     goto unpin;
    574     @@ -785,7 +797,7 @@ static void retry_vsie_icpt(struct vsie_page *vsie_page)
    575     static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    576     {
    577     struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
    578     - __u32 fac = vsie_page->scb_o->fac & 0x7ffffff8U;
    579     + __u32 fac = READ_ONCE(vsie_page->scb_o->fac) & 0x7ffffff8U;
    580    
    581     if (fac && test_kvm_facility(vcpu->kvm, 7)) {
    582     retry_vsie_icpt(vsie_page);
    583     diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
    584     index fd9d9bac7cfa..79c3bdaaa0b4 100644
    585     --- a/arch/sparc/include/asm/pgtable_64.h
    586     +++ b/arch/sparc/include/asm/pgtable_64.h
    587     @@ -980,7 +980,7 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
    588     pmd_t *pmd);
    589    
    590     #define __HAVE_ARCH_PMDP_INVALIDATE
    591     -extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    592     +extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    593     pmd_t *pmdp);
    594    
    595     #define __HAVE_ARCH_PGTABLE_DEPOSIT
    596     diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
    597     index 4ae86bc0d35c..847ddffbf38a 100644
    598     --- a/arch/sparc/mm/tlb.c
    599     +++ b/arch/sparc/mm/tlb.c
    600     @@ -219,17 +219,28 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
    601     }
    602     }
    603    
    604     +static inline pmd_t pmdp_establish(struct vm_area_struct *vma,
    605     + unsigned long address, pmd_t *pmdp, pmd_t pmd)
    606     +{
    607     + pmd_t old;
    608     +
    609     + do {
    610     + old = *pmdp;
    611     + } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd);
    612     +
    613     + return old;
    614     +}
    615     +
    616     /*
    617     * This routine is only called when splitting a THP
    618     */
    619     -void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    620     +pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    621     pmd_t *pmdp)
    622     {
    623     - pmd_t entry = *pmdp;
    624     -
    625     - pmd_val(entry) &= ~_PAGE_VALID;
    626     + pmd_t old, entry;
    627    
    628     - set_pmd_at(vma->vm_mm, address, pmdp, entry);
    629     + entry = __pmd(pmd_val(*pmdp) & ~_PAGE_VALID);
    630     + old = pmdp_establish(vma, address, pmdp, entry);
    631     flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
    632    
    633     /*
    634     @@ -240,6 +251,8 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    635     if ((pmd_val(entry) & _PAGE_PMD_HUGE) &&
    636     !is_huge_zero_page(pmd_page(entry)))
    637     (vma->vm_mm)->context.thp_pte_count--;
    638     +
    639     + return old;
    640     }
    641    
    642     void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
    643     diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
    644     index a0b86cf486e0..2e9d58cc371e 100644
    645     --- a/arch/x86/hyperv/hv_init.c
    646     +++ b/arch/x86/hyperv/hv_init.c
    647     @@ -110,12 +110,19 @@ static int hv_cpu_init(unsigned int cpu)
    648     */
    649     void hyperv_init(void)
    650     {
    651     - u64 guest_id;
    652     + u64 guest_id, required_msrs;
    653     union hv_x64_msr_hypercall_contents hypercall_msr;
    654    
    655     if (x86_hyper_type != X86_HYPER_MS_HYPERV)
    656     return;
    657    
    658     + /* Absolutely required MSRs */
    659     + required_msrs = HV_X64_MSR_HYPERCALL_AVAILABLE |
    660     + HV_X64_MSR_VP_INDEX_AVAILABLE;
    661     +
    662     + if ((ms_hyperv.features & required_msrs) != required_msrs)
    663     + return;
    664     +
    665     /* Allocate percpu VP index */
    666     hv_vp_index = kmalloc_array(num_possible_cpus(), sizeof(*hv_vp_index),
    667     GFP_KERNEL);
    668     diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
    669     index 9cc9e1c1e2db..56c9ebac946f 100644
    670     --- a/arch/x86/hyperv/mmu.c
    671     +++ b/arch/x86/hyperv/mmu.c
    672     @@ -137,7 +137,12 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus,
    673     }
    674    
    675     if (info->mm) {
    676     + /*
    677     + * AddressSpace argument must match the CR3 with PCID bits
    678     + * stripped out.
    679     + */
    680     flush->address_space = virt_to_phys(info->mm->pgd);
    681     + flush->address_space &= CR3_ADDR_MASK;
    682     flush->flags = 0;
    683     } else {
    684     flush->address_space = 0;
    685     @@ -219,7 +224,12 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus,
    686     }
    687    
    688     if (info->mm) {
    689     + /*
    690     + * AddressSpace argument must match the CR3 with PCID bits
    691     + * stripped out.
    692     + */
    693     flush->address_space = virt_to_phys(info->mm->pgd);
    694     + flush->address_space &= CR3_ADDR_MASK;
    695     flush->flags = 0;
    696     } else {
    697     flush->address_space = 0;
    698     @@ -278,8 +288,6 @@ void hyperv_setup_mmu_ops(void)
    699     if (!(ms_hyperv.hints & HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED))
    700     return;
    701    
    702     - setup_clear_cpu_cap(X86_FEATURE_PCID);
    703     -
    704     if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED)) {
    705     pr_info("Using hypercall for remote TLB flush\n");
    706     pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others;
    707     diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h
    708     index c8376b40e882..5cdcdbd4d892 100644
    709     --- a/arch/x86/include/asm/i8259.h
    710     +++ b/arch/x86/include/asm/i8259.h
    711     @@ -69,6 +69,11 @@ struct legacy_pic {
    712     extern struct legacy_pic *legacy_pic;
    713     extern struct legacy_pic null_legacy_pic;
    714    
    715     +static inline bool has_legacy_pic(void)
    716     +{
    717     + return legacy_pic != &null_legacy_pic;
    718     +}
    719     +
    720     static inline int nr_legacy_irqs(void)
    721     {
    722     return legacy_pic->nr_legacy_irqs;
    723     diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
    724     index 9c2a002d9297..6dda3595acf8 100644
    725     --- a/arch/x86/kernel/acpi/boot.c
    726     +++ b/arch/x86/kernel/acpi/boot.c
    727     @@ -215,6 +215,10 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end)
    728     apic_id = processor->local_apic_id;
    729     enabled = processor->lapic_flags & ACPI_MADT_ENABLED;
    730    
    731     + /* Ignore invalid ID */
    732     + if (apic_id == 0xffffffff)
    733     + return 0;
    734     +
    735     /*
    736     * We need to register disabled CPU as well to permit
    737     * counting disabled CPUs. This allows us to size
    738     diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
    739     index c0b694810ff4..02cfc615e3fb 100644
    740     --- a/arch/x86/kernel/apic/x2apic_uv_x.c
    741     +++ b/arch/x86/kernel/apic/x2apic_uv_x.c
    742     @@ -1140,16 +1140,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
    743    
    744     uv_gre_table = gre;
    745     for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
    746     + unsigned long size = ((unsigned long)(gre->limit - lgre)
    747     + << UV_GAM_RANGE_SHFT);
    748     + int order = 0;
    749     + char suffix[] = " KMGTPE";
    750     +
    751     + while (size > 9999 && order < sizeof(suffix)) {
    752     + size /= 1024;
    753     + order++;
    754     + }
    755     +
    756     if (!index) {
    757     pr_info("UV: GAM Range Table...\n");
    758     pr_info("UV: # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN");
    759     }
    760     - pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d %04x %02x %02x\n",
    761     + pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d %04x %02x %02x\n",
    762     index++,
    763     (unsigned long)lgre << UV_GAM_RANGE_SHFT,
    764     (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
    765     - ((unsigned long)(gre->limit - lgre)) >>
    766     - (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */
    767     + size, suffix[order],
    768     gre->type, gre->nasid, gre->sockid, gre->pnode);
    769    
    770     lgre = gre->limit;
    771     diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
    772     index afbecff161d1..a2d8a3908670 100644
    773     --- a/arch/x86/kernel/dumpstack.c
    774     +++ b/arch/x86/kernel/dumpstack.c
    775     @@ -109,7 +109,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
    776     struct stack_info stack_info = {0};
    777     unsigned long visit_mask = 0;
    778     int graph_idx = 0;
    779     - bool partial;
    780     + bool partial = false;
    781    
    782     printk("%sCall Trace:\n", log_lvl);
    783    
    784     diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
    785     index 47506567435e..0bf06fa3027e 100644
    786     --- a/arch/x86/kernel/tsc.c
    787     +++ b/arch/x86/kernel/tsc.c
    788     @@ -25,6 +25,7 @@
    789     #include <asm/geode.h>
    790     #include <asm/apic.h>
    791     #include <asm/intel-family.h>
    792     +#include <asm/i8259.h>
    793    
    794     unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */
    795     EXPORT_SYMBOL(cpu_khz);
    796     @@ -316,7 +317,7 @@ static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2)
    797     hpet2 -= hpet1;
    798     tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
    799     do_div(tmp, 1000000);
    800     - do_div(deltatsc, tmp);
    801     + deltatsc = div64_u64(deltatsc, tmp);
    802    
    803     return (unsigned long) deltatsc;
    804     }
    805     @@ -363,6 +364,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
    806     unsigned long tscmin, tscmax;
    807     int pitcnt;
    808    
    809     + if (!has_legacy_pic()) {
    810     + /*
    811     + * Relies on tsc_early_delay_calibrate() to have given us semi
    812     + * usable udelay(), wait for the same 50ms we would have with
    813     + * the PIT loop below.
    814     + */
    815     + udelay(10 * USEC_PER_MSEC);
    816     + udelay(10 * USEC_PER_MSEC);
    817     + udelay(10 * USEC_PER_MSEC);
    818     + udelay(10 * USEC_PER_MSEC);
    819     + udelay(10 * USEC_PER_MSEC);
    820     + return ULONG_MAX;
    821     + }
    822     +
    823     /* Set the Gate high, disable speaker */
    824     outb((inb(0x61) & ~0x02) | 0x01, 0x61);
    825    
    826     @@ -487,6 +502,9 @@ static unsigned long quick_pit_calibrate(void)
    827     u64 tsc, delta;
    828     unsigned long d1, d2;
    829    
    830     + if (!has_legacy_pic())
    831     + return 0;
    832     +
    833     /* Set the Gate high, disable speaker */
    834     outb((inb(0x61) & ~0x02) | 0x01, 0x61);
    835    
    836     diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
    837     index f438e0c4aa8c..43bbece92632 100644
    838     --- a/arch/x86/kvm/mmu.c
    839     +++ b/arch/x86/kvm/mmu.c
    840     @@ -3019,7 +3019,7 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn)
    841     return RET_PF_RETRY;
    842     }
    843    
    844     - return RET_PF_EMULATE;
    845     + return -EFAULT;
    846     }
    847    
    848     static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
    849     diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    850     index ae4803b213d0..bdd84ce4491e 100644
    851     --- a/arch/x86/kvm/vmx.c
    852     +++ b/arch/x86/kvm/vmx.c
    853     @@ -6765,7 +6765,21 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
    854     if (!is_guest_mode(vcpu) &&
    855     !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) {
    856     trace_kvm_fast_mmio(gpa);
    857     - return kvm_skip_emulated_instruction(vcpu);
    858     + /*
    859     + * Doing kvm_skip_emulated_instruction() depends on undefined
    860     + * behavior: Intel's manual doesn't mandate
    861     + * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG
    862     + * occurs and while on real hardware it was observed to be set,
    863     + * other hypervisors (namely Hyper-V) don't set it, we end up
    864     + * advancing IP with some random value. Disable fast mmio when
    865     + * running nested and keep it for real hardware in hope that
    866     + * VM_EXIT_INSTRUCTION_LEN will always be set correctly.
    867     + */
    868     + if (!static_cpu_has(X86_FEATURE_HYPERVISOR))
    869     + return kvm_skip_emulated_instruction(vcpu);
    870     + else
    871     + return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP,
    872     + NULL, 0) == EMULATE_DONE;
    873     }
    874    
    875     ret = kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0);
    876     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    877     index b9afb4784d12..3b2c3aa2cd07 100644
    878     --- a/arch/x86/kvm/x86.c
    879     +++ b/arch/x86/kvm/x86.c
    880     @@ -4225,13 +4225,14 @@ long kvm_arch_vm_ioctl(struct file *filp,
    881     mutex_unlock(&kvm->lock);
    882     break;
    883     case KVM_XEN_HVM_CONFIG: {
    884     + struct kvm_xen_hvm_config xhc;
    885     r = -EFAULT;
    886     - if (copy_from_user(&kvm->arch.xen_hvm_config, argp,
    887     - sizeof(struct kvm_xen_hvm_config)))
    888     + if (copy_from_user(&xhc, argp, sizeof(xhc)))
    889     goto out;
    890     r = -EINVAL;
    891     - if (kvm->arch.xen_hvm_config.flags)
    892     + if (xhc.flags)
    893     goto out;
    894     + memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc));
    895     r = 0;
    896     break;
    897     }
    898     @@ -5698,7 +5699,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu,
    899     * handle watchpoints yet, those would be handled in
    900     * the emulate_ops.
    901     */
    902     - if (kvm_vcpu_check_breakpoint(vcpu, &r))
    903     + if (!(emulation_type & EMULTYPE_SKIP) &&
    904     + kvm_vcpu_check_breakpoint(vcpu, &r))
    905     return r;
    906    
    907     ctxt->interruptibility = 0;
    908     diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
    909     index fe85d1204db8..642357aff216 100644
    910     --- a/arch/x86/mm/init_64.c
    911     +++ b/arch/x86/mm/init_64.c
    912     @@ -1180,8 +1180,7 @@ void __init mem_init(void)
    913     after_bootmem = 1;
    914    
    915     /* Register memory areas for /proc/kcore */
    916     - kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR,
    917     - PAGE_SIZE, KCORE_OTHER);
    918     + kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
    919    
    920     mem_init_print_info(NULL);
    921     }
    922     diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c
    923     index c35fdb585c68..afc4ed7b1578 100644
    924     --- a/arch/x86/power/hibernate_32.c
    925     +++ b/arch/x86/power/hibernate_32.c
    926     @@ -145,7 +145,7 @@ static inline void resume_init_first_level_page_table(pgd_t *pg_dir)
    927     #endif
    928     }
    929    
    930     -int swsusp_arch_resume(void)
    931     +asmlinkage int swsusp_arch_resume(void)
    932     {
    933     int error;
    934    
    935     diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
    936     index f910c514438f..0ef5e5204968 100644
    937     --- a/arch/x86/power/hibernate_64.c
    938     +++ b/arch/x86/power/hibernate_64.c
    939     @@ -174,7 +174,7 @@ static int relocate_restore_code(void)
    940     return 0;
    941     }
    942    
    943     -int swsusp_arch_resume(void)
    944     +asmlinkage int swsusp_arch_resume(void)
    945     {
    946     int error;
    947    
    948     diff --git a/block/bio.c b/block/bio.c
    949     index dbaa82c967f4..90f19d7df66c 100644
    950     --- a/block/bio.c
    951     +++ b/block/bio.c
    952     @@ -1893,7 +1893,7 @@ struct bio *bio_split(struct bio *bio, int sectors,
    953     bio_advance(bio, split->bi_iter.bi_size);
    954    
    955     if (bio_flagged(bio, BIO_TRACE_COMPLETION))
    956     - bio_set_flag(bio, BIO_TRACE_COMPLETION);
    957     + bio_set_flag(split, BIO_TRACE_COMPLETION);
    958    
    959     return split;
    960     }
    961     diff --git a/block/blk-core.c b/block/blk-core.c
    962     index c01f4907dbbc..1feeb1a8aad9 100644
    963     --- a/block/blk-core.c
    964     +++ b/block/blk-core.c
    965     @@ -3065,6 +3065,8 @@ void blk_rq_bio_prep(struct request_queue *q, struct request *rq,
    966     {
    967     if (bio_has_data(bio))
    968     rq->nr_phys_segments = bio_phys_segments(q, bio);
    969     + else if (bio_op(bio) == REQ_OP_DISCARD)
    970     + rq->nr_phys_segments = 1;
    971    
    972     rq->__data_len = bio->bi_iter.bi_size;
    973     rq->bio = rq->biotail = bio;
    974     diff --git a/block/blk-merge.c b/block/blk-merge.c
    975     index f5dedd57dff6..8d60a5bbcef9 100644
    976     --- a/block/blk-merge.c
    977     +++ b/block/blk-merge.c
    978     @@ -551,6 +551,24 @@ static bool req_no_special_merge(struct request *req)
    979     return !q->mq_ops && req->special;
    980     }
    981    
    982     +static bool req_attempt_discard_merge(struct request_queue *q, struct request *req,
    983     + struct request *next)
    984     +{
    985     + unsigned short segments = blk_rq_nr_discard_segments(req);
    986     +
    987     + if (segments >= queue_max_discard_segments(q))
    988     + goto no_merge;
    989     + if (blk_rq_sectors(req) + bio_sectors(next->bio) >
    990     + blk_rq_get_max_sectors(req, blk_rq_pos(req)))
    991     + goto no_merge;
    992     +
    993     + req->nr_phys_segments = segments + blk_rq_nr_discard_segments(next);
    994     + return true;
    995     +no_merge:
    996     + req_set_nomerge(q, req);
    997     + return false;
    998     +}
    999     +
    1000     static int ll_merge_requests_fn(struct request_queue *q, struct request *req,
    1001     struct request *next)
    1002     {
    1003     @@ -684,9 +702,13 @@ static struct request *attempt_merge(struct request_queue *q,
    1004     * If we are allowed to merge, then append bio list
    1005     * from next to rq and release next. merge_requests_fn
    1006     * will have updated segment counts, update sector
    1007     - * counts here.
    1008     + * counts here. Handle DISCARDs separately, as they
    1009     + * have separate settings.
    1010     */
    1011     - if (!ll_merge_requests_fn(q, req, next))
    1012     + if (req_op(req) == REQ_OP_DISCARD) {
    1013     + if (!req_attempt_discard_merge(q, req, next))
    1014     + return NULL;
    1015     + } else if (!ll_merge_requests_fn(q, req, next))
    1016     return NULL;
    1017    
    1018     /*
    1019     @@ -716,7 +738,8 @@ static struct request *attempt_merge(struct request_queue *q,
    1020    
    1021     req->__data_len += blk_rq_bytes(next);
    1022    
    1023     - elv_merge_requests(q, req, next);
    1024     + if (req_op(req) != REQ_OP_DISCARD)
    1025     + elv_merge_requests(q, req, next);
    1026    
    1027     /*
    1028     * 'next' is going away, so update stats accordingly
    1029     diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
    1030     index de294d775acf..d95439154556 100644
    1031     --- a/block/blk-mq-debugfs.c
    1032     +++ b/block/blk-mq-debugfs.c
    1033     @@ -704,7 +704,11 @@ static ssize_t blk_mq_debugfs_write(struct file *file, const char __user *buf,
    1034     const struct blk_mq_debugfs_attr *attr = m->private;
    1035     void *data = d_inode(file->f_path.dentry->d_parent)->i_private;
    1036    
    1037     - if (!attr->write)
    1038     + /*
    1039     + * Attributes that only implement .seq_ops are read-only and 'attr' is
    1040     + * the same with 'data' in this case.
    1041     + */
    1042     + if (attr == data || !attr->write)
    1043     return -EPERM;
    1044    
    1045     return attr->write(data, buf, count, ppos);
    1046     diff --git a/block/blk-mq.c b/block/blk-mq.c
    1047     index 6f899669cbdd..007f96611364 100644
    1048     --- a/block/blk-mq.c
    1049     +++ b/block/blk-mq.c
    1050     @@ -1143,9 +1143,27 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
    1051     /*
    1052     * We should be running this queue from one of the CPUs that
    1053     * are mapped to it.
    1054     + *
    1055     + * There are at least two related races now between setting
    1056     + * hctx->next_cpu from blk_mq_hctx_next_cpu() and running
    1057     + * __blk_mq_run_hw_queue():
    1058     + *
    1059     + * - hctx->next_cpu is found offline in blk_mq_hctx_next_cpu(),
    1060     + * but later it becomes online, then this warning is harmless
    1061     + * at all
    1062     + *
    1063     + * - hctx->next_cpu is found online in blk_mq_hctx_next_cpu(),
    1064     + * but later it becomes offline, then the warning can't be
    1065     + * triggered, and we depend on blk-mq timeout handler to
    1066     + * handle dispatched requests to this hctx
    1067     */
    1068     - WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) &&
    1069     - cpu_online(hctx->next_cpu));
    1070     + if (!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) &&
    1071     + cpu_online(hctx->next_cpu)) {
    1072     + printk(KERN_WARNING "run queue from wrong CPU %d, hctx %s\n",
    1073     + raw_smp_processor_id(),
    1074     + cpumask_empty(hctx->cpumask) ? "inactive": "active");
    1075     + dump_stack();
    1076     + }
    1077    
    1078     /*
    1079     * We can't run the queue inline with ints disabled. Ensure that
    1080     diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
    1081     index 032ae44710e5..a2be3fd2c72b 100644
    1082     --- a/drivers/acpi/acpi_lpss.c
    1083     +++ b/drivers/acpi/acpi_lpss.c
    1084     @@ -465,6 +465,8 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
    1085     acpi_dev_free_resource_list(&resource_list);
    1086    
    1087     if (!pdata->mmio_base) {
    1088     + /* Avoid acpi_bus_attach() instantiating a pdev for this dev. */
    1089     + adev->pnp.type.platform_id = 0;
    1090     /* Skip the device, but continue the namespace scan. */
    1091     ret = 0;
    1092     goto err_out;
    1093     diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
    1094     index b6d58cc58f5f..f0348e388d01 100644
    1095     --- a/drivers/acpi/bus.c
    1096     +++ b/drivers/acpi/bus.c
    1097     @@ -146,6 +146,12 @@ int acpi_bus_get_status(struct acpi_device *device)
    1098     return 0;
    1099     }
    1100    
    1101     + /* Battery devices must have their deps met before calling _STA */
    1102     + if (acpi_device_is_battery(device) && device->dep_unmet) {
    1103     + acpi_set_device_status(device, 0);
    1104     + return 0;
    1105     + }
    1106     +
    1107     status = acpi_bus_get_status_handle(device->handle, &sta);
    1108     if (ACPI_FAILURE(status))
    1109     return -ENODEV;
    1110     diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    1111     index 6adcda057b36..58bc28aff3aa 100644
    1112     --- a/drivers/acpi/ec.c
    1113     +++ b/drivers/acpi/ec.c
    1114     @@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev)
    1115     ec->reference_count >= 1)
    1116     acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE);
    1117    
    1118     + if (acpi_sleep_no_ec_events())
    1119     + acpi_ec_enter_noirq(ec);
    1120     +
    1121     return 0;
    1122     }
    1123    
    1124     @@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev)
    1125     {
    1126     struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev));
    1127    
    1128     + if (acpi_sleep_no_ec_events())
    1129     + acpi_ec_leave_noirq(ec);
    1130     +
    1131     if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) &&
    1132     ec->reference_count >= 1)
    1133     acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE);
    1134     diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
    1135     index 18b72eec3507..c7cf48ad5cb9 100644
    1136     --- a/drivers/acpi/processor_perflib.c
    1137     +++ b/drivers/acpi/processor_perflib.c
    1138     @@ -159,7 +159,7 @@ void acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag)
    1139     {
    1140     int ret;
    1141    
    1142     - if (ignore_ppc) {
    1143     + if (ignore_ppc || !pr->performance) {
    1144     /*
    1145     * Only when it is notification event, the _OST object
    1146     * will be evaluated. Otherwise it is skipped.
    1147     diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
    1148     index 2f2f50322ffb..c0984d33c4c8 100644
    1149     --- a/drivers/acpi/scan.c
    1150     +++ b/drivers/acpi/scan.c
    1151     @@ -1568,6 +1568,8 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle,
    1152     device_initialize(&device->dev);
    1153     dev_set_uevent_suppress(&device->dev, true);
    1154     acpi_init_coherency(device);
    1155     + /* Assume there are unmet deps until acpi_device_dep_initialize() runs */
    1156     + device->dep_unmet = 1;
    1157     }
    1158    
    1159     void acpi_device_add_finalize(struct acpi_device *device)
    1160     @@ -1591,6 +1593,14 @@ static int acpi_add_single_object(struct acpi_device **child,
    1161     }
    1162    
    1163     acpi_init_device_object(device, handle, type, sta);
    1164     + /*
    1165     + * For ACPI_BUS_TYPE_DEVICE getting the status is delayed till here so
    1166     + * that we can call acpi_bus_get_status() and use its quirk handling.
    1167     + * Note this must be done before the get power-/wakeup_dev-flags calls.
    1168     + */
    1169     + if (type == ACPI_BUS_TYPE_DEVICE)
    1170     + acpi_bus_get_status(device);
    1171     +
    1172     acpi_bus_get_power_flags(device);
    1173     acpi_bus_get_wakeup_device_flags(device);
    1174    
    1175     @@ -1663,9 +1673,11 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type,
    1176     return -ENODEV;
    1177    
    1178     *type = ACPI_BUS_TYPE_DEVICE;
    1179     - status = acpi_bus_get_status_handle(handle, sta);
    1180     - if (ACPI_FAILURE(status))
    1181     - *sta = 0;
    1182     + /*
    1183     + * acpi_add_single_object updates this once we've an acpi_device
    1184     + * so that acpi_bus_get_status' quirk handling can be used.
    1185     + */
    1186     + *sta = 0;
    1187     break;
    1188     case ACPI_TYPE_PROCESSOR:
    1189     *type = ACPI_BUS_TYPE_PROCESSOR;
    1190     @@ -1763,6 +1775,8 @@ static void acpi_device_dep_initialize(struct acpi_device *adev)
    1191     acpi_status status;
    1192     int i;
    1193    
    1194     + adev->dep_unmet = 0;
    1195     +
    1196     if (!acpi_has_method(adev->handle, "_DEP"))
    1197     return;
    1198    
    1199     diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
    1200     index 70f8904f46a3..b3b78079aa9f 100644
    1201     --- a/drivers/base/power/domain.c
    1202     +++ b/drivers/base/power/domain.c
    1203     @@ -2206,6 +2206,38 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
    1204     return 0;
    1205     }
    1206    
    1207     +static int genpd_iterate_idle_states(struct device_node *dn,
    1208     + struct genpd_power_state *states)
    1209     +{
    1210     + int ret;
    1211     + struct of_phandle_iterator it;
    1212     + struct device_node *np;
    1213     + int i = 0;
    1214     +
    1215     + ret = of_count_phandle_with_args(dn, "domain-idle-states", NULL);
    1216     + if (ret <= 0)
    1217     + return ret;
    1218     +
    1219     + /* Loop over the phandles until all the requested entry is found */
    1220     + of_for_each_phandle(&it, ret, dn, "domain-idle-states", NULL, 0) {
    1221     + np = it.node;
    1222     + if (!of_match_node(idle_state_match, np))
    1223     + continue;
    1224     + if (states) {
    1225     + ret = genpd_parse_state(&states[i], np);
    1226     + if (ret) {
    1227     + pr_err("Parsing idle state node %pOF failed with err %d\n",
    1228     + np, ret);
    1229     + of_node_put(np);
    1230     + return ret;
    1231     + }
    1232     + }
    1233     + i++;
    1234     + }
    1235     +
    1236     + return i;
    1237     +}
    1238     +
    1239     /**
    1240     * of_genpd_parse_idle_states: Return array of idle states for the genpd.
    1241     *
    1242     @@ -2215,49 +2247,31 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state,
    1243     *
    1244     * Returns the device states parsed from the OF node. The memory for the states
    1245     * is allocated by this function and is the responsibility of the caller to
    1246     - * free the memory after use.
    1247     + * free the memory after use. If no domain idle states is found it returns
    1248     + * -EINVAL and in case of errors, a negative error code.
    1249     */
    1250     int of_genpd_parse_idle_states(struct device_node *dn,
    1251     struct genpd_power_state **states, int *n)
    1252     {
    1253     struct genpd_power_state *st;
    1254     - struct device_node *np;
    1255     - int i = 0;
    1256     - int err, ret;
    1257     - int count;
    1258     - struct of_phandle_iterator it;
    1259     - const struct of_device_id *match_id;
    1260     + int ret;
    1261    
    1262     - count = of_count_phandle_with_args(dn, "domain-idle-states", NULL);
    1263     - if (count <= 0)
    1264     - return -EINVAL;
    1265     + ret = genpd_iterate_idle_states(dn, NULL);
    1266     + if (ret <= 0)
    1267     + return ret < 0 ? ret : -EINVAL;
    1268    
    1269     - st = kcalloc(count, sizeof(*st), GFP_KERNEL);
    1270     + st = kcalloc(ret, sizeof(*st), GFP_KERNEL);
    1271     if (!st)
    1272     return -ENOMEM;
    1273    
    1274     - /* Loop over the phandles until all the requested entry is found */
    1275     - of_for_each_phandle(&it, err, dn, "domain-idle-states", NULL, 0) {
    1276     - np = it.node;
    1277     - match_id = of_match_node(idle_state_match, np);
    1278     - if (!match_id)
    1279     - continue;
    1280     - ret = genpd_parse_state(&st[i++], np);
    1281     - if (ret) {
    1282     - pr_err
    1283     - ("Parsing idle state node %pOF failed with err %d\n",
    1284     - np, ret);
    1285     - of_node_put(np);
    1286     - kfree(st);
    1287     - return ret;
    1288     - }
    1289     + ret = genpd_iterate_idle_states(dn, st);
    1290     + if (ret <= 0) {
    1291     + kfree(st);
    1292     + return ret < 0 ? ret : -EINVAL;
    1293     }
    1294    
    1295     - *n = i;
    1296     - if (!i)
    1297     - kfree(st);
    1298     - else
    1299     - *states = st;
    1300     + *states = st;
    1301     + *n = ret;
    1302    
    1303     return 0;
    1304     }
    1305     diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c
    1306     index ae0429827f31..67c50738834b 100644
    1307     --- a/drivers/base/power/wakeirq.c
    1308     +++ b/drivers/base/power/wakeirq.c
    1309     @@ -323,7 +323,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq)
    1310     return;
    1311    
    1312     if (device_may_wakeup(wirq->dev)) {
    1313     - if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
    1314     + if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
    1315     + !pm_runtime_status_suspended(wirq->dev))
    1316     enable_irq(wirq->irq);
    1317    
    1318     enable_irq_wake(wirq->irq);
    1319     @@ -345,7 +346,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq)
    1320     if (device_may_wakeup(wirq->dev)) {
    1321     disable_irq_wake(wirq->irq);
    1322    
    1323     - if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED)
    1324     + if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED &&
    1325     + !pm_runtime_status_suspended(wirq->dev))
    1326     disable_irq_nosync(wirq->irq);
    1327     }
    1328     }
    1329     diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c
    1330     index b338a4becbf8..845efa0f724f 100644
    1331     --- a/drivers/char/ipmi/ipmi_powernv.c
    1332     +++ b/drivers/char/ipmi/ipmi_powernv.c
    1333     @@ -251,8 +251,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev)
    1334     ipmi->irq = opal_event_request(prop);
    1335     }
    1336    
    1337     - if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
    1338     - "opal-ipmi", ipmi)) {
    1339     + rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH,
    1340     + "opal-ipmi", ipmi);
    1341     + if (rc) {
    1342     dev_warn(dev, "Unable to request irq\n");
    1343     goto err_dispose;
    1344     }
    1345     diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c
    1346     index 21bffdcb2f20..557ed25b42e3 100644
    1347     --- a/drivers/clocksource/timer-imx-tpm.c
    1348     +++ b/drivers/clocksource/timer-imx-tpm.c
    1349     @@ -105,7 +105,7 @@ static int tpm_set_next_event(unsigned long delta,
    1350     * of writing CNT registers which may cause the min_delta event got
    1351     * missed, so we need add a ETIME check here in case it happened.
    1352     */
    1353     - return (int)((next - now) <= 0) ? -ETIME : 0;
    1354     + return (int)(next - now) <= 0 ? -ETIME : 0;
    1355     }
    1356    
    1357     static int tpm_set_state_oneshot(struct clock_event_device *evt)
    1358     diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
    1359     index 93a0e88bef76..20226d4243f2 100644
    1360     --- a/drivers/cpufreq/intel_pstate.c
    1361     +++ b/drivers/cpufreq/intel_pstate.c
    1362     @@ -779,6 +779,8 @@ static int intel_pstate_hwp_save_state(struct cpufreq_policy *policy)
    1363     return 0;
    1364     }
    1365    
    1366     +static void intel_pstate_hwp_enable(struct cpudata *cpudata);
    1367     +
    1368     static int intel_pstate_resume(struct cpufreq_policy *policy)
    1369     {
    1370     if (!hwp_active)
    1371     @@ -786,6 +788,9 @@ static int intel_pstate_resume(struct cpufreq_policy *policy)
    1372    
    1373     mutex_lock(&intel_pstate_limits_lock);
    1374    
    1375     + if (policy->cpu == 0)
    1376     + intel_pstate_hwp_enable(all_cpu_data[policy->cpu]);
    1377     +
    1378     all_cpu_data[policy->cpu]->epp_policy = 0;
    1379     intel_pstate_hwp_set(policy->cpu);
    1380    
    1381     diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
    1382     index fe33c199fc1a..143f8bc403b9 100644
    1383     --- a/drivers/crypto/Kconfig
    1384     +++ b/drivers/crypto/Kconfig
    1385     @@ -721,7 +721,6 @@ config CRYPTO_DEV_ARTPEC6
    1386     select CRYPTO_HASH
    1387     select CRYPTO_SHA1
    1388     select CRYPTO_SHA256
    1389     - select CRYPTO_SHA384
    1390     select CRYPTO_SHA512
    1391     help
    1392     Enables the driver for the on-chip crypto accelerator
    1393     diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
    1394     index 8bf89267dc25..d731b413cb2c 100644
    1395     --- a/drivers/firewire/ohci.c
    1396     +++ b/drivers/firewire/ohci.c
    1397     @@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx)
    1398     return -ENOMEM;
    1399    
    1400     offset = (void *)&desc->buffer - (void *)desc;
    1401     - desc->buffer_size = PAGE_SIZE - offset;
    1402     + /*
    1403     + * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads
    1404     + * for descriptors, even 0x10-byte ones. This can cause page faults when
    1405     + * an IOMMU is in use and the oversized read crosses a page boundary.
    1406     + * Work around this by always leaving at least 0x10 bytes of padding.
    1407     + */
    1408     + desc->buffer_size = PAGE_SIZE - offset - 0x10;
    1409     desc->buffer_bus = bus_addr + offset;
    1410     desc->used = 0;
    1411    
    1412     diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
    1413     index 783041964439..e8db9659a36b 100644
    1414     --- a/drivers/firmware/dmi_scan.c
    1415     +++ b/drivers/firmware/dmi_scan.c
    1416     @@ -18,7 +18,7 @@ EXPORT_SYMBOL_GPL(dmi_kobj);
    1417     * of and an antecedent to, SMBIOS, which stands for System
    1418     * Management BIOS. See further: http://www.dmtf.org/standards
    1419     */
    1420     -static const char dmi_empty_string[] = " ";
    1421     +static const char dmi_empty_string[] = "";
    1422    
    1423     static u32 dmi_ver __initdata;
    1424     static u32 dmi_len;
    1425     @@ -44,25 +44,21 @@ static int dmi_memdev_nr;
    1426     static const char * __init dmi_string_nosave(const struct dmi_header *dm, u8 s)
    1427     {
    1428     const u8 *bp = ((u8 *) dm) + dm->length;
    1429     + const u8 *nsp;
    1430    
    1431     if (s) {
    1432     - s--;
    1433     - while (s > 0 && *bp) {
    1434     + while (--s > 0 && *bp)
    1435     bp += strlen(bp) + 1;
    1436     - s--;
    1437     - }
    1438     -
    1439     - if (*bp != 0) {
    1440     - size_t len = strlen(bp)+1;
    1441     - size_t cmp_len = len > 8 ? 8 : len;
    1442    
    1443     - if (!memcmp(bp, dmi_empty_string, cmp_len))
    1444     - return dmi_empty_string;
    1445     + /* Strings containing only spaces are considered empty */
    1446     + nsp = bp;
    1447     + while (*nsp == ' ')
    1448     + nsp++;
    1449     + if (*nsp != '\0')
    1450     return bp;
    1451     - }
    1452     }
    1453    
    1454     - return "";
    1455     + return dmi_empty_string;
    1456     }
    1457    
    1458     static const char * __init dmi_string(const struct dmi_header *dm, u8 s)
    1459     diff --git a/drivers/gpu/drm/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
    1460     index 02a50929af67..e7f4fe2848a5 100644
    1461     --- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c
    1462     +++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c
    1463     @@ -350,19 +350,44 @@ int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type,
    1464     {
    1465     uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE;
    1466     ssize_t ret;
    1467     + int retry;
    1468    
    1469     if (type < DRM_DP_DUAL_MODE_TYPE2_DVI)
    1470     return 0;
    1471    
    1472     - ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
    1473     - &tmds_oen, sizeof(tmds_oen));
    1474     - if (ret) {
    1475     - DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n",
    1476     - enable ? "enable" : "disable");
    1477     - return ret;
    1478     + /*
    1479     + * LSPCON adapters in low-power state may ignore the first write, so
    1480     + * read back and verify the written value a few times.
    1481     + */
    1482     + for (retry = 0; retry < 3; retry++) {
    1483     + uint8_t tmp;
    1484     +
    1485     + ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN,
    1486     + &tmds_oen, sizeof(tmds_oen));
    1487     + if (ret) {
    1488     + DRM_DEBUG_KMS("Failed to %s TMDS output buffers (%d attempts)\n",
    1489     + enable ? "enable" : "disable",
    1490     + retry + 1);
    1491     + return ret;
    1492     + }
    1493     +
    1494     + ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN,
    1495     + &tmp, sizeof(tmp));
    1496     + if (ret) {
    1497     + DRM_DEBUG_KMS("I2C read failed during TMDS output buffer %s (%d attempts)\n",
    1498     + enable ? "enabling" : "disabling",
    1499     + retry + 1);
    1500     + return ret;
    1501     + }
    1502     +
    1503     + if (tmp == tmds_oen)
    1504     + return 0;
    1505     }
    1506    
    1507     - return 0;
    1508     + DRM_DEBUG_KMS("I2C write value mismatch during TMDS output buffer %s\n",
    1509     + enable ? "enabling" : "disabling");
    1510     +
    1511     + return -EIO;
    1512     }
    1513     EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output);
    1514    
    1515     diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
    1516     index 83e88c70272a..9bf4045cd679 100644
    1517     --- a/drivers/gpu/drm/i915/gvt/kvmgt.c
    1518     +++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
    1519     @@ -1153,7 +1153,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
    1520     return 0;
    1521     }
    1522    
    1523     - return 0;
    1524     + return -ENOTTY;
    1525     }
    1526    
    1527     static ssize_t
    1528     diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
    1529     index 3f818412765c..51411894d2cd 100644
    1530     --- a/drivers/gpu/drm/i915/i915_drv.h
    1531     +++ b/drivers/gpu/drm/i915/i915_drv.h
    1532     @@ -3995,7 +3995,11 @@ extern void intel_display_print_error_state(struct drm_i915_error_state_buf *e,
    1533     struct intel_display_error_state *error);
    1534    
    1535     int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val);
    1536     -int sandybridge_pcode_write(struct drm_i915_private *dev_priv, u32 mbox, u32 val);
    1537     +int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, u32 mbox,
    1538     + u32 val, int timeout_us);
    1539     +#define sandybridge_pcode_write(dev_priv, mbox, val) \
    1540     + sandybridge_pcode_write_timeout(dev_priv, mbox, val, 500)
    1541     +
    1542     int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request,
    1543     u32 reply_mask, u32 reply, int timeout_base_ms);
    1544    
    1545     diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    1546     index de8ca5f1dd2e..4cc9ce4b5b16 100644
    1547     --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    1548     +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    1549     @@ -722,7 +722,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb)
    1550    
    1551     err = radix_tree_insert(handles_vma, handle, vma);
    1552     if (unlikely(err)) {
    1553     - kfree(lut);
    1554     + kmem_cache_free(eb->i915->luts, lut);
    1555     goto err_obj;
    1556     }
    1557    
    1558     diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
    1559     index 27743be5b768..9240fa79de7c 100644
    1560     --- a/drivers/gpu/drm/i915/intel_audio.c
    1561     +++ b/drivers/gpu/drm/i915/intel_audio.c
    1562     @@ -704,7 +704,7 @@ static void i915_audio_component_codec_wake_override(struct device *kdev,
    1563     struct drm_i915_private *dev_priv = kdev_to_i915(kdev);
    1564     u32 tmp;
    1565    
    1566     - if (!IS_GEN9_BC(dev_priv))
    1567     + if (!IS_GEN9(dev_priv))
    1568     return;
    1569    
    1570     i915_audio_component_get_power(kdev);
    1571     diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
    1572     index 26a8dcd2c549..47ad24229c78 100644
    1573     --- a/drivers/gpu/drm/i915/intel_cdclk.c
    1574     +++ b/drivers/gpu/drm/i915/intel_cdclk.c
    1575     @@ -1289,10 +1289,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv,
    1576     break;
    1577     }
    1578    
    1579     - /* Inform power controller of upcoming frequency change */
    1580     mutex_lock(&dev_priv->rps.hw_lock);
    1581     - ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ,
    1582     - 0x80000000);
    1583     + /*
    1584     + * Inform power controller of upcoming frequency change. BSpec
    1585     + * requires us to wait up to 150usec, but that leads to timeouts;
    1586     + * the 2ms used here is based on experiment.
    1587     + */
    1588     + ret = sandybridge_pcode_write_timeout(dev_priv,
    1589     + HSW_PCODE_DE_WRITE_FREQ_REQ,
    1590     + 0x80000000, 2000);
    1591     mutex_unlock(&dev_priv->rps.hw_lock);
    1592    
    1593     if (ret) {
    1594     @@ -1323,8 +1328,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv,
    1595     I915_WRITE(CDCLK_CTL, val);
    1596    
    1597     mutex_lock(&dev_priv->rps.hw_lock);
    1598     - ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ,
    1599     - DIV_ROUND_UP(cdclk, 25000));
    1600     + /*
    1601     + * The timeout isn't specified, the 2ms used here is based on
    1602     + * experiment.
    1603     + * FIXME: Waiting for the request completion could be delayed until
    1604     + * the next PCODE request based on BSpec.
    1605     + */
    1606     + ret = sandybridge_pcode_write_timeout(dev_priv,
    1607     + HSW_PCODE_DE_WRITE_FREQ_REQ,
    1608     + DIV_ROUND_UP(cdclk, 25000), 2000);
    1609     mutex_unlock(&dev_priv->rps.hw_lock);
    1610    
    1611     if (ret) {
    1612     diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
    1613     index 014e5c08571a..87cccb5f8c5d 100644
    1614     --- a/drivers/gpu/drm/i915/intel_pm.c
    1615     +++ b/drivers/gpu/drm/i915/intel_pm.c
    1616     @@ -8941,8 +8941,8 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val
    1617     return 0;
    1618     }
    1619    
    1620     -int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
    1621     - u32 mbox, u32 val)
    1622     +int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv,
    1623     + u32 mbox, u32 val, int timeout_us)
    1624     {
    1625     int status;
    1626    
    1627     @@ -8965,7 +8965,7 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
    1628    
    1629     if (__intel_wait_for_register_fw(dev_priv,
    1630     GEN6_PCODE_MAILBOX, GEN6_PCODE_READY, 0,
    1631     - 500, 0, NULL)) {
    1632     + timeout_us, 0, NULL)) {
    1633     DRM_ERROR("timeout waiting for pcode write of 0x%08x to mbox %x to finish for %ps\n",
    1634     val, mbox, __builtin_return_address(0));
    1635     return -ETIMEDOUT;
    1636     diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
    1637     index 53d01fb00a8b..1dbe593e5960 100644
    1638     --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
    1639     +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h
    1640     @@ -47,8 +47,8 @@ static uint32_t gf100_pmu_data[] = {
    1641     0x00000000,
    1642     0x00000000,
    1643     0x584d454d,
    1644     - 0x00000756,
    1645     - 0x00000748,
    1646     + 0x00000754,
    1647     + 0x00000746,
    1648     0x00000000,
    1649     0x00000000,
    1650     0x00000000,
    1651     @@ -69,8 +69,8 @@ static uint32_t gf100_pmu_data[] = {
    1652     0x00000000,
    1653     0x00000000,
    1654     0x46524550,
    1655     - 0x0000075a,
    1656     0x00000758,
    1657     + 0x00000756,
    1658     0x00000000,
    1659     0x00000000,
    1660     0x00000000,
    1661     @@ -91,8 +91,8 @@ static uint32_t gf100_pmu_data[] = {
    1662     0x00000000,
    1663     0x00000000,
    1664     0x5f433249,
    1665     - 0x00000b8a,
    1666     - 0x00000a2d,
    1667     + 0x00000b88,
    1668     + 0x00000a2b,
    1669     0x00000000,
    1670     0x00000000,
    1671     0x00000000,
    1672     @@ -113,8 +113,8 @@ static uint32_t gf100_pmu_data[] = {
    1673     0x00000000,
    1674     0x00000000,
    1675     0x54534554,
    1676     - 0x00000bb3,
    1677     - 0x00000b8c,
    1678     + 0x00000bb1,
    1679     + 0x00000b8a,
    1680     0x00000000,
    1681     0x00000000,
    1682     0x00000000,
    1683     @@ -135,8 +135,8 @@ static uint32_t gf100_pmu_data[] = {
    1684     0x00000000,
    1685     0x00000000,
    1686     0x454c4449,
    1687     - 0x00000bbf,
    1688     0x00000bbd,
    1689     + 0x00000bbb,
    1690     0x00000000,
    1691     0x00000000,
    1692     0x00000000,
    1693     @@ -237,19 +237,19 @@ static uint32_t gf100_pmu_data[] = {
    1694     0x000005d3,
    1695     0x00000003,
    1696     0x00000002,
    1697     - 0x0000069d,
    1698     + 0x0000069b,
    1699     0x00040004,
    1700     0x00000000,
    1701     - 0x000006b9,
    1702     + 0x000006b7,
    1703     0x00010005,
    1704     0x00000000,
    1705     - 0x000006d6,
    1706     + 0x000006d4,
    1707     0x00010006,
    1708     0x00000000,
    1709     0x0000065b,
    1710     0x00000007,
    1711     0x00000000,
    1712     - 0x000006e1,
    1713     + 0x000006df,
    1714     /* 0x03c4: memx_func_tail */
    1715     /* 0x03c4: memx_ts_start */
    1716     0x00000000,
    1717     @@ -1373,432 +1373,432 @@ static uint32_t gf100_pmu_code[] = {
    1718     /* 0x065b: memx_func_wait_vblank */
    1719     0x9800f840,
    1720     0x66b00016,
    1721     - 0x130bf400,
    1722     + 0x120bf400,
    1723     0xf40166b0,
    1724     0x0ef4060b,
    1725     /* 0x066d: memx_func_wait_vblank_head1 */
    1726     - 0x2077f12e,
    1727     - 0x070ef400,
    1728     -/* 0x0674: memx_func_wait_vblank_head0 */
    1729     - 0x000877f1,
    1730     -/* 0x0678: memx_func_wait_vblank_0 */
    1731     - 0x07c467f1,
    1732     - 0xcf0664b6,
    1733     - 0x67fd0066,
    1734     - 0xf31bf404,
    1735     -/* 0x0688: memx_func_wait_vblank_1 */
    1736     - 0x07c467f1,
    1737     - 0xcf0664b6,
    1738     - 0x67fd0066,
    1739     - 0xf30bf404,
    1740     -/* 0x0698: memx_func_wait_vblank_fini */
    1741     - 0xf80410b6,
    1742     -/* 0x069d: memx_func_wr32 */
    1743     - 0x00169800,
    1744     - 0xb6011598,
    1745     - 0x60f90810,
    1746     - 0xd0fc50f9,
    1747     - 0x21f4e0fc,
    1748     - 0x0242b640,
    1749     - 0xf8e91bf4,
    1750     -/* 0x06b9: memx_func_wait */
    1751     - 0x2c87f000,
    1752     - 0xcf0684b6,
    1753     - 0x1e980088,
    1754     - 0x011d9800,
    1755     - 0x98021c98,
    1756     - 0x10b6031b,
    1757     - 0xa321f410,
    1758     -/* 0x06d6: memx_func_delay */
    1759     - 0x1e9800f8,
    1760     - 0x0410b600,
    1761     - 0xf87e21f4,
    1762     -/* 0x06e1: memx_func_train */
    1763     -/* 0x06e3: memx_exec */
    1764     - 0xf900f800,
    1765     - 0xb9d0f9e0,
    1766     - 0xb2b902c1,
    1767     -/* 0x06ed: memx_exec_next */
    1768     - 0x00139802,
    1769     - 0xe70410b6,
    1770     - 0xe701f034,
    1771     - 0xb601e033,
    1772     - 0x30f00132,
    1773     - 0xde35980c,
    1774     - 0x12b855f9,
    1775     - 0xe41ef406,
    1776     - 0x98f10b98,
    1777     - 0xcbbbf20c,
    1778     - 0xc4b7f102,
    1779     - 0x06b4b607,
    1780     - 0xfc00bbcf,
    1781     - 0xf5e0fcd0,
    1782     - 0xf8033621,
    1783     -/* 0x0729: memx_info */
    1784     - 0x01c67000,
    1785     -/* 0x072f: memx_info_data */
    1786     - 0xf10e0bf4,
    1787     - 0xf103ccc7,
    1788     - 0xf40800b7,
    1789     -/* 0x073a: memx_info_train */
    1790     - 0xc7f10b0e,
    1791     - 0xb7f10bcc,
    1792     -/* 0x0742: memx_info_send */
    1793     - 0x21f50100,
    1794     - 0x00f80336,
    1795     -/* 0x0748: memx_recv */
    1796     - 0xf401d6b0,
    1797     - 0xd6b0980b,
    1798     - 0xd80bf400,
    1799     -/* 0x0756: memx_init */
    1800     - 0x00f800f8,
    1801     -/* 0x0758: perf_recv */
    1802     -/* 0x075a: perf_init */
    1803     + 0x2077f02c,
    1804     +/* 0x0673: memx_func_wait_vblank_head0 */
    1805     + 0xf0060ef4,
    1806     +/* 0x0676: memx_func_wait_vblank_0 */
    1807     + 0x67f10877,
    1808     + 0x64b607c4,
    1809     + 0x0066cf06,
    1810     + 0xf40467fd,
    1811     +/* 0x0686: memx_func_wait_vblank_1 */
    1812     + 0x67f1f31b,
    1813     + 0x64b607c4,
    1814     + 0x0066cf06,
    1815     + 0xf40467fd,
    1816     +/* 0x0696: memx_func_wait_vblank_fini */
    1817     + 0x10b6f30b,
    1818     +/* 0x069b: memx_func_wr32 */
    1819     + 0x9800f804,
    1820     + 0x15980016,
    1821     + 0x0810b601,
    1822     + 0x50f960f9,
    1823     + 0xe0fcd0fc,
    1824     + 0xb64021f4,
    1825     + 0x1bf40242,
    1826     +/* 0x06b7: memx_func_wait */
    1827     + 0xf000f8e9,
    1828     + 0x84b62c87,
    1829     + 0x0088cf06,
    1830     + 0x98001e98,
    1831     + 0x1c98011d,
    1832     + 0x031b9802,
    1833     + 0xf41010b6,
    1834     + 0x00f8a321,
    1835     +/* 0x06d4: memx_func_delay */
    1836     + 0xb6001e98,
    1837     + 0x21f40410,
    1838     +/* 0x06df: memx_func_train */
    1839     + 0xf800f87e,
    1840     +/* 0x06e1: memx_exec */
    1841     + 0xf9e0f900,
    1842     + 0x02c1b9d0,
    1843     +/* 0x06eb: memx_exec_next */
    1844     + 0x9802b2b9,
    1845     + 0x10b60013,
    1846     + 0xf034e704,
    1847     + 0xe033e701,
    1848     + 0x0132b601,
    1849     + 0x980c30f0,
    1850     + 0x55f9de35,
    1851     + 0xf40612b8,
    1852     + 0x0b98e41e,
    1853     + 0xf20c98f1,
    1854     + 0xf102cbbb,
    1855     + 0xb607c4b7,
    1856     + 0xbbcf06b4,
    1857     + 0xfcd0fc00,
    1858     + 0x3621f5e0,
    1859     +/* 0x0727: memx_info */
    1860     + 0x7000f803,
    1861     + 0x0bf401c6,
    1862     +/* 0x072d: memx_info_data */
    1863     + 0xccc7f10e,
    1864     + 0x00b7f103,
    1865     + 0x0b0ef408,
    1866     +/* 0x0738: memx_info_train */
    1867     + 0x0bccc7f1,
    1868     + 0x0100b7f1,
    1869     +/* 0x0740: memx_info_send */
    1870     + 0x033621f5,
    1871     +/* 0x0746: memx_recv */
    1872     + 0xd6b000f8,
    1873     + 0x980bf401,
    1874     + 0xf400d6b0,
    1875     + 0x00f8d80b,
    1876     +/* 0x0754: memx_init */
    1877     +/* 0x0756: perf_recv */
    1878     0x00f800f8,
    1879     -/* 0x075c: i2c_drive_scl */
    1880     - 0xf40036b0,
    1881     - 0x07f1110b,
    1882     - 0x04b607e0,
    1883     - 0x0001d006,
    1884     - 0x00f804bd,
    1885     -/* 0x0770: i2c_drive_scl_lo */
    1886     - 0x07e407f1,
    1887     - 0xd00604b6,
    1888     - 0x04bd0001,
    1889     -/* 0x077e: i2c_drive_sda */
    1890     +/* 0x0758: perf_init */
    1891     +/* 0x075a: i2c_drive_scl */
    1892     0x36b000f8,
    1893     0x110bf400,
    1894     0x07e007f1,
    1895     0xd00604b6,
    1896     - 0x04bd0002,
    1897     -/* 0x0792: i2c_drive_sda_lo */
    1898     + 0x04bd0001,
    1899     +/* 0x076e: i2c_drive_scl_lo */
    1900     0x07f100f8,
    1901     0x04b607e4,
    1902     + 0x0001d006,
    1903     + 0x00f804bd,
    1904     +/* 0x077c: i2c_drive_sda */
    1905     + 0xf40036b0,
    1906     + 0x07f1110b,
    1907     + 0x04b607e0,
    1908     0x0002d006,
    1909     0x00f804bd,
    1910     -/* 0x07a0: i2c_sense_scl */
    1911     - 0xf10132f4,
    1912     - 0xb607c437,
    1913     - 0x33cf0634,
    1914     - 0x0431fd00,
    1915     - 0xf4060bf4,
    1916     -/* 0x07b6: i2c_sense_scl_done */
    1917     - 0x00f80131,
    1918     -/* 0x07b8: i2c_sense_sda */
    1919     - 0xf10132f4,
    1920     - 0xb607c437,
    1921     - 0x33cf0634,
    1922     - 0x0432fd00,
    1923     - 0xf4060bf4,
    1924     -/* 0x07ce: i2c_sense_sda_done */
    1925     - 0x00f80131,
    1926     -/* 0x07d0: i2c_raise_scl */
    1927     - 0x47f140f9,
    1928     - 0x37f00898,
    1929     - 0x5c21f501,
    1930     -/* 0x07dd: i2c_raise_scl_wait */
    1931     - 0xe8e7f107,
    1932     - 0x7e21f403,
    1933     - 0x07a021f5,
    1934     - 0xb60901f4,
    1935     - 0x1bf40142,
    1936     -/* 0x07f1: i2c_raise_scl_done */
    1937     - 0xf840fcef,
    1938     -/* 0x07f5: i2c_start */
    1939     - 0xa021f500,
    1940     - 0x0d11f407,
    1941     - 0x07b821f5,
    1942     - 0xf40611f4,
    1943     -/* 0x0806: i2c_start_rep */
    1944     - 0x37f0300e,
    1945     - 0x5c21f500,
    1946     - 0x0137f007,
    1947     - 0x077e21f5,
    1948     - 0xb60076bb,
    1949     - 0x50f90465,
    1950     - 0xbb046594,
    1951     - 0x50bd0256,
    1952     - 0xfc0475fd,
    1953     - 0xd021f550,
    1954     - 0x0464b607,
    1955     -/* 0x0833: i2c_start_send */
    1956     - 0xf01f11f4,
    1957     +/* 0x0790: i2c_drive_sda_lo */
    1958     + 0x07e407f1,
    1959     + 0xd00604b6,
    1960     + 0x04bd0002,
    1961     +/* 0x079e: i2c_sense_scl */
    1962     + 0x32f400f8,
    1963     + 0xc437f101,
    1964     + 0x0634b607,
    1965     + 0xfd0033cf,
    1966     + 0x0bf40431,
    1967     + 0x0131f406,
    1968     +/* 0x07b4: i2c_sense_scl_done */
    1969     +/* 0x07b6: i2c_sense_sda */
    1970     + 0x32f400f8,
    1971     + 0xc437f101,
    1972     + 0x0634b607,
    1973     + 0xfd0033cf,
    1974     + 0x0bf40432,
    1975     + 0x0131f406,
    1976     +/* 0x07cc: i2c_sense_sda_done */
    1977     +/* 0x07ce: i2c_raise_scl */
    1978     + 0x40f900f8,
    1979     + 0x089847f1,
    1980     + 0xf50137f0,
    1981     +/* 0x07db: i2c_raise_scl_wait */
    1982     + 0xf1075a21,
    1983     + 0xf403e8e7,
    1984     + 0x21f57e21,
    1985     + 0x01f4079e,
    1986     + 0x0142b609,
    1987     +/* 0x07ef: i2c_raise_scl_done */
    1988     + 0xfcef1bf4,
    1989     +/* 0x07f3: i2c_start */
    1990     + 0xf500f840,
    1991     + 0xf4079e21,
    1992     + 0x21f50d11,
    1993     + 0x11f407b6,
    1994     + 0x300ef406,
    1995     +/* 0x0804: i2c_start_rep */
    1996     + 0xf50037f0,
    1997     + 0xf0075a21,
    1998     + 0x21f50137,
    1999     + 0x76bb077c,
    2000     + 0x0465b600,
    2001     + 0x659450f9,
    2002     + 0x0256bb04,
    2003     + 0x75fd50bd,
    2004     + 0xf550fc04,
    2005     + 0xb607ce21,
    2006     + 0x11f40464,
    2007     +/* 0x0831: i2c_start_send */
    2008     + 0x0037f01f,
    2009     + 0x077c21f5,
    2010     + 0x1388e7f1,
    2011     + 0xf07e21f4,
    2012     0x21f50037,
    2013     - 0xe7f1077e,
    2014     + 0xe7f1075a,
    2015     0x21f41388,
    2016     - 0x0037f07e,
    2017     - 0x075c21f5,
    2018     - 0x1388e7f1,
    2019     -/* 0x084f: i2c_start_out */
    2020     - 0xf87e21f4,
    2021     -/* 0x0851: i2c_stop */
    2022     - 0x0037f000,
    2023     - 0x075c21f5,
    2024     - 0xf50037f0,
    2025     - 0xf1077e21,
    2026     - 0xf403e8e7,
    2027     - 0x37f07e21,
    2028     - 0x5c21f501,
    2029     - 0x88e7f107,
    2030     - 0x7e21f413,
    2031     +/* 0x084d: i2c_start_out */
    2032     +/* 0x084f: i2c_stop */
    2033     + 0xf000f87e,
    2034     + 0x21f50037,
    2035     + 0x37f0075a,
    2036     + 0x7c21f500,
    2037     + 0xe8e7f107,
    2038     + 0x7e21f403,
    2039     0xf50137f0,
    2040     - 0xf1077e21,
    2041     + 0xf1075a21,
    2042     0xf41388e7,
    2043     - 0x00f87e21,
    2044     -/* 0x0884: i2c_bitw */
    2045     - 0x077e21f5,
    2046     - 0x03e8e7f1,
    2047     - 0xbb7e21f4,
    2048     - 0x65b60076,
    2049     - 0x9450f904,
    2050     - 0x56bb0465,
    2051     - 0xfd50bd02,
    2052     - 0x50fc0475,
    2053     - 0x07d021f5,
    2054     - 0xf40464b6,
    2055     - 0xe7f11811,
    2056     - 0x21f41388,
    2057     - 0x0037f07e,
    2058     - 0x075c21f5,
    2059     - 0x1388e7f1,
    2060     -/* 0x08c3: i2c_bitw_out */
    2061     - 0xf87e21f4,
    2062     -/* 0x08c5: i2c_bitr */
    2063     - 0x0137f000,
    2064     - 0x077e21f5,
    2065     - 0x03e8e7f1,
    2066     - 0xbb7e21f4,
    2067     - 0x65b60076,
    2068     - 0x9450f904,
    2069     - 0x56bb0465,
    2070     - 0xfd50bd02,
    2071     - 0x50fc0475,
    2072     - 0x07d021f5,
    2073     - 0xf40464b6,
    2074     - 0x21f51b11,
    2075     - 0x37f007b8,
    2076     - 0x5c21f500,
    2077     + 0x37f07e21,
    2078     + 0x7c21f501,
    2079     0x88e7f107,
    2080     0x7e21f413,
    2081     - 0xf4013cf0,
    2082     -/* 0x090a: i2c_bitr_done */
    2083     - 0x00f80131,
    2084     -/* 0x090c: i2c_get_byte */
    2085     - 0xf00057f0,
    2086     -/* 0x0912: i2c_get_byte_next */
    2087     - 0x54b60847,
    2088     - 0x0076bb01,
    2089     +/* 0x0882: i2c_bitw */
    2090     + 0x21f500f8,
    2091     + 0xe7f1077c,
    2092     + 0x21f403e8,
    2093     + 0x0076bb7e,
    2094     0xf90465b6,
    2095     0x04659450,
    2096     0xbd0256bb,
    2097     0x0475fd50,
    2098     0x21f550fc,
    2099     - 0x64b608c5,
    2100     - 0x2b11f404,
    2101     - 0xb60553fd,
    2102     - 0x1bf40142,
    2103     - 0x0137f0d8,
    2104     - 0xb60076bb,
    2105     - 0x50f90465,
    2106     - 0xbb046594,
    2107     - 0x50bd0256,
    2108     - 0xfc0475fd,
    2109     - 0x8421f550,
    2110     - 0x0464b608,
    2111     -/* 0x095c: i2c_get_byte_done */
    2112     -/* 0x095e: i2c_put_byte */
    2113     - 0x47f000f8,
    2114     -/* 0x0961: i2c_put_byte_next */
    2115     - 0x0142b608,
    2116     - 0xbb3854ff,
    2117     + 0x64b607ce,
    2118     + 0x1811f404,
    2119     + 0x1388e7f1,
    2120     + 0xf07e21f4,
    2121     + 0x21f50037,
    2122     + 0xe7f1075a,
    2123     + 0x21f41388,
    2124     +/* 0x08c1: i2c_bitw_out */
    2125     +/* 0x08c3: i2c_bitr */
    2126     + 0xf000f87e,
    2127     + 0x21f50137,
    2128     + 0xe7f1077c,
    2129     + 0x21f403e8,
    2130     + 0x0076bb7e,
    2131     + 0xf90465b6,
    2132     + 0x04659450,
    2133     + 0xbd0256bb,
    2134     + 0x0475fd50,
    2135     + 0x21f550fc,
    2136     + 0x64b607ce,
    2137     + 0x1b11f404,
    2138     + 0x07b621f5,
    2139     + 0xf50037f0,
    2140     + 0xf1075a21,
    2141     + 0xf41388e7,
    2142     + 0x3cf07e21,
    2143     + 0x0131f401,
    2144     +/* 0x0908: i2c_bitr_done */
    2145     +/* 0x090a: i2c_get_byte */
    2146     + 0x57f000f8,
    2147     + 0x0847f000,
    2148     +/* 0x0910: i2c_get_byte_next */
    2149     + 0xbb0154b6,
    2150     0x65b60076,
    2151     0x9450f904,
    2152     0x56bb0465,
    2153     0xfd50bd02,
    2154     0x50fc0475,
    2155     - 0x088421f5,
    2156     + 0x08c321f5,
    2157     0xf40464b6,
    2158     - 0x46b03411,
    2159     - 0xd81bf400,
    2160     - 0xb60076bb,
    2161     - 0x50f90465,
    2162     - 0xbb046594,
    2163     - 0x50bd0256,
    2164     - 0xfc0475fd,
    2165     - 0xc521f550,
    2166     - 0x0464b608,
    2167     - 0xbb0f11f4,
    2168     - 0x36b00076,
    2169     - 0x061bf401,
    2170     -/* 0x09b7: i2c_put_byte_done */
    2171     - 0xf80132f4,
    2172     -/* 0x09b9: i2c_addr */
    2173     - 0x0076bb00,
    2174     + 0x53fd2b11,
    2175     + 0x0142b605,
    2176     + 0xf0d81bf4,
    2177     + 0x76bb0137,
    2178     + 0x0465b600,
    2179     + 0x659450f9,
    2180     + 0x0256bb04,
    2181     + 0x75fd50bd,
    2182     + 0xf550fc04,
    2183     + 0xb6088221,
    2184     +/* 0x095a: i2c_get_byte_done */
    2185     + 0x00f80464,
    2186     +/* 0x095c: i2c_put_byte */
    2187     +/* 0x095f: i2c_put_byte_next */
    2188     + 0xb60847f0,
    2189     + 0x54ff0142,
    2190     + 0x0076bb38,
    2191     0xf90465b6,
    2192     0x04659450,
    2193     0xbd0256bb,
    2194     0x0475fd50,
    2195     0x21f550fc,
    2196     - 0x64b607f5,
    2197     - 0x2911f404,
    2198     - 0x012ec3e7,
    2199     - 0xfd0134b6,
    2200     - 0x76bb0553,
    2201     + 0x64b60882,
    2202     + 0x3411f404,
    2203     + 0xf40046b0,
    2204     + 0x76bbd81b,
    2205     0x0465b600,
    2206     0x659450f9,
    2207     0x0256bb04,
    2208     0x75fd50bd,
    2209     0xf550fc04,
    2210     - 0xb6095e21,
    2211     -/* 0x09fe: i2c_addr_done */
    2212     - 0x00f80464,
    2213     -/* 0x0a00: i2c_acquire_addr */
    2214     - 0xb6f8cec7,
    2215     - 0xe0b702e4,
    2216     - 0xee980d1c,
    2217     -/* 0x0a0f: i2c_acquire */
    2218     - 0xf500f800,
    2219     - 0xf40a0021,
    2220     - 0xd9f00421,
    2221     - 0x4021f403,
    2222     -/* 0x0a1e: i2c_release */
    2223     - 0x21f500f8,
    2224     - 0x21f40a00,
    2225     - 0x03daf004,
    2226     - 0xf84021f4,
    2227     -/* 0x0a2d: i2c_recv */
    2228     - 0x0132f400,
    2229     - 0xb6f8c1c7,
    2230     - 0x16b00214,
    2231     - 0x3a1ff528,
    2232     - 0xf413a001,
    2233     - 0x0032980c,
    2234     - 0x0ccc13a0,
    2235     - 0xf4003198,
    2236     - 0xd0f90231,
    2237     - 0xd0f9e0f9,
    2238     - 0x000067f1,
    2239     - 0x100063f1,
    2240     - 0xbb016792,
    2241     + 0xb608c321,
    2242     + 0x11f40464,
    2243     + 0x0076bb0f,
    2244     + 0xf40136b0,
    2245     + 0x32f4061b,
    2246     +/* 0x09b5: i2c_put_byte_done */
    2247     +/* 0x09b7: i2c_addr */
    2248     + 0xbb00f801,
    2249     0x65b60076,
    2250     0x9450f904,
    2251     0x56bb0465,
    2252     0xfd50bd02,
    2253     0x50fc0475,
    2254     - 0x0a0f21f5,
    2255     - 0xfc0464b6,
    2256     - 0x00d6b0d0,
    2257     - 0x00b31bf5,
    2258     - 0xbb0057f0,
    2259     - 0x65b60076,
    2260     - 0x9450f904,
    2261     - 0x56bb0465,
    2262     - 0xfd50bd02,
    2263     - 0x50fc0475,
    2264     - 0x09b921f5,
    2265     - 0xf50464b6,
    2266     - 0xc700d011,
    2267     - 0x76bbe0c5,
    2268     - 0x0465b600,
    2269     - 0x659450f9,
    2270     - 0x0256bb04,
    2271     - 0x75fd50bd,
    2272     - 0xf550fc04,
    2273     - 0xb6095e21,
    2274     - 0x11f50464,
    2275     - 0x57f000ad,
    2276     + 0x07f321f5,
    2277     + 0xf40464b6,
    2278     + 0xc3e72911,
    2279     + 0x34b6012e,
    2280     + 0x0553fd01,
    2281     + 0xb60076bb,
    2282     + 0x50f90465,
    2283     + 0xbb046594,
    2284     + 0x50bd0256,
    2285     + 0xfc0475fd,
    2286     + 0x5c21f550,
    2287     + 0x0464b609,
    2288     +/* 0x09fc: i2c_addr_done */
    2289     +/* 0x09fe: i2c_acquire_addr */
    2290     + 0xcec700f8,
    2291     + 0x02e4b6f8,
    2292     + 0x0d1ce0b7,
    2293     + 0xf800ee98,
    2294     +/* 0x0a0d: i2c_acquire */
    2295     + 0xfe21f500,
    2296     + 0x0421f409,
    2297     + 0xf403d9f0,
    2298     + 0x00f84021,
    2299     +/* 0x0a1c: i2c_release */
    2300     + 0x09fe21f5,
    2301     + 0xf00421f4,
    2302     + 0x21f403da,
    2303     +/* 0x0a2b: i2c_recv */
    2304     + 0xf400f840,
    2305     + 0xc1c70132,
    2306     + 0x0214b6f8,
    2307     + 0xf52816b0,
    2308     + 0xa0013a1f,
    2309     + 0x980cf413,
    2310     + 0x13a00032,
    2311     + 0x31980ccc,
    2312     + 0x0231f400,
    2313     + 0xe0f9d0f9,
    2314     + 0x67f1d0f9,
    2315     + 0x63f10000,
    2316     + 0x67921000,
    2317     0x0076bb01,
    2318     0xf90465b6,
    2319     0x04659450,
    2320     0xbd0256bb,
    2321     0x0475fd50,
    2322     0x21f550fc,
    2323     - 0x64b609b9,
    2324     - 0x8a11f504,
    2325     + 0x64b60a0d,
    2326     + 0xb0d0fc04,
    2327     + 0x1bf500d6,
    2328     + 0x57f000b3,
    2329     0x0076bb00,
    2330     0xf90465b6,
    2331     0x04659450,
    2332     0xbd0256bb,
    2333     0x0475fd50,
    2334     0x21f550fc,
    2335     - 0x64b6090c,
    2336     - 0x6a11f404,
    2337     - 0xbbe05bcb,
    2338     + 0x64b609b7,
    2339     + 0xd011f504,
    2340     + 0xe0c5c700,
    2341     + 0xb60076bb,
    2342     + 0x50f90465,
    2343     + 0xbb046594,
    2344     + 0x50bd0256,
    2345     + 0xfc0475fd,
    2346     + 0x5c21f550,
    2347     + 0x0464b609,
    2348     + 0x00ad11f5,
    2349     + 0xbb0157f0,
    2350     0x65b60076,
    2351     0x9450f904,
    2352     0x56bb0465,
    2353     0xfd50bd02,
    2354     0x50fc0475,
    2355     - 0x085121f5,
    2356     - 0xb90464b6,
    2357     - 0x74bd025b,
    2358     -/* 0x0b33: i2c_recv_not_rd08 */
    2359     - 0xb0430ef4,
    2360     - 0x1bf401d6,
    2361     - 0x0057f03d,
    2362     - 0x09b921f5,
    2363     - 0xc73311f4,
    2364     - 0x21f5e0c5,
    2365     - 0x11f4095e,
    2366     - 0x0057f029,
    2367     - 0x09b921f5,
    2368     - 0xc71f11f4,
    2369     - 0x21f5e0b5,
    2370     - 0x11f4095e,
    2371     - 0x5121f515,
    2372     - 0xc774bd08,
    2373     - 0x1bf408c5,
    2374     - 0x0232f409,
    2375     -/* 0x0b73: i2c_recv_not_wr08 */
    2376     -/* 0x0b73: i2c_recv_done */
    2377     - 0xc7030ef4,
    2378     - 0x21f5f8ce,
    2379     - 0xe0fc0a1e,
    2380     - 0x12f4d0fc,
    2381     - 0x027cb90a,
    2382     - 0x033621f5,
    2383     -/* 0x0b88: i2c_recv_exit */
    2384     -/* 0x0b8a: i2c_init */
    2385     - 0x00f800f8,
    2386     -/* 0x0b8c: test_recv */
    2387     - 0x05d817f1,
    2388     + 0x09b721f5,
    2389     + 0xf50464b6,
    2390     + 0xbb008a11,
    2391     + 0x65b60076,
    2392     + 0x9450f904,
    2393     + 0x56bb0465,
    2394     + 0xfd50bd02,
    2395     + 0x50fc0475,
    2396     + 0x090a21f5,
    2397     + 0xf40464b6,
    2398     + 0x5bcb6a11,
    2399     + 0x0076bbe0,
    2400     + 0xf90465b6,
    2401     + 0x04659450,
    2402     + 0xbd0256bb,
    2403     + 0x0475fd50,
    2404     + 0x21f550fc,
    2405     + 0x64b6084f,
    2406     + 0x025bb904,
    2407     + 0x0ef474bd,
    2408     +/* 0x0b31: i2c_recv_not_rd08 */
    2409     + 0x01d6b043,
    2410     + 0xf03d1bf4,
    2411     + 0x21f50057,
    2412     + 0x11f409b7,
    2413     + 0xe0c5c733,
    2414     + 0x095c21f5,
    2415     + 0xf02911f4,
    2416     + 0x21f50057,
    2417     + 0x11f409b7,
    2418     + 0xe0b5c71f,
    2419     + 0x095c21f5,
    2420     + 0xf51511f4,
    2421     + 0xbd084f21,
    2422     + 0x08c5c774,
    2423     + 0xf4091bf4,
    2424     + 0x0ef40232,
    2425     +/* 0x0b71: i2c_recv_not_wr08 */
    2426     +/* 0x0b71: i2c_recv_done */
    2427     + 0xf8cec703,
    2428     + 0x0a1c21f5,
    2429     + 0xd0fce0fc,
    2430     + 0xb90a12f4,
    2431     + 0x21f5027c,
    2432     +/* 0x0b86: i2c_recv_exit */
    2433     + 0x00f80336,
    2434     +/* 0x0b88: i2c_init */
    2435     +/* 0x0b8a: test_recv */
    2436     + 0x17f100f8,
    2437     + 0x14b605d8,
    2438     + 0x0011cf06,
    2439     + 0xf10110b6,
    2440     + 0xb605d807,
    2441     + 0x01d00604,
    2442     + 0xf104bd00,
    2443     + 0xf1d900e7,
    2444     + 0xf5134fe3,
    2445     + 0xf8025621,
    2446     +/* 0x0bb1: test_init */
    2447     + 0x00e7f100,
    2448     + 0x5621f508,
    2449     +/* 0x0bbb: idle_recv */
    2450     + 0xf800f802,
    2451     +/* 0x0bbd: idle */
    2452     + 0x0031f400,
    2453     + 0x05d417f1,
    2454     0xcf0614b6,
    2455     0x10b60011,
    2456     - 0xd807f101,
    2457     + 0xd407f101,
    2458     0x0604b605,
    2459     0xbd0001d0,
    2460     - 0x00e7f104,
    2461     - 0x4fe3f1d9,
    2462     - 0x5621f513,
    2463     -/* 0x0bb3: test_init */
    2464     - 0xf100f802,
    2465     - 0xf50800e7,
    2466     - 0xf8025621,
    2467     -/* 0x0bbd: idle_recv */
    2468     -/* 0x0bbf: idle */
    2469     - 0xf400f800,
    2470     - 0x17f10031,
    2471     - 0x14b605d4,
    2472     - 0x0011cf06,
    2473     - 0xf10110b6,
    2474     - 0xb605d407,
    2475     - 0x01d00604,
    2476     -/* 0x0bdb: idle_loop */
    2477     - 0xf004bd00,
    2478     - 0x32f45817,
    2479     -/* 0x0be1: idle_proc */
    2480     -/* 0x0be1: idle_proc_exec */
    2481     - 0xb910f902,
    2482     - 0x21f5021e,
    2483     - 0x10fc033f,
    2484     - 0xf40911f4,
    2485     - 0x0ef40231,
    2486     -/* 0x0bf5: idle_proc_next */
    2487     - 0x5810b6ef,
    2488     - 0xf4061fb8,
    2489     - 0x02f4e61b,
    2490     - 0x0028f4dd,
    2491     - 0x00bb0ef4,
    2492     +/* 0x0bd9: idle_loop */
    2493     + 0x5817f004,
    2494     +/* 0x0bdf: idle_proc */
    2495     +/* 0x0bdf: idle_proc_exec */
    2496     + 0xf90232f4,
    2497     + 0x021eb910,
    2498     + 0x033f21f5,
    2499     + 0x11f410fc,
    2500     + 0x0231f409,
    2501     +/* 0x0bf3: idle_proc_next */
    2502     + 0xb6ef0ef4,
    2503     + 0x1fb85810,
    2504     + 0xe61bf406,
    2505     + 0xf4dd02f4,
    2506     + 0x0ef40028,
    2507     + 0x000000bb,
    2508     0x00000000,
    2509     0x00000000,
    2510     0x00000000,
    2511     diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
    2512     index c4edbc79e41a..e0222cb832fb 100644
    2513     --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
    2514     +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h
    2515     @@ -47,8 +47,8 @@ static uint32_t gk208_pmu_data[] = {
    2516     0x00000000,
    2517     0x00000000,
    2518     0x584d454d,
    2519     - 0x000005f3,
    2520     - 0x000005e5,
    2521     + 0x000005ee,
    2522     + 0x000005e0,
    2523     0x00000000,
    2524     0x00000000,
    2525     0x00000000,
    2526     @@ -69,8 +69,8 @@ static uint32_t gk208_pmu_data[] = {
    2527     0x00000000,
    2528     0x00000000,
    2529     0x46524550,
    2530     - 0x000005f7,
    2531     - 0x000005f5,
    2532     + 0x000005f2,
    2533     + 0x000005f0,
    2534     0x00000000,
    2535     0x00000000,
    2536     0x00000000,
    2537     @@ -91,8 +91,8 @@ static uint32_t gk208_pmu_data[] = {
    2538     0x00000000,
    2539     0x00000000,
    2540     0x5f433249,
    2541     - 0x000009f8,
    2542     - 0x000008a2,
    2543     + 0x000009f3,
    2544     + 0x0000089d,
    2545     0x00000000,
    2546     0x00000000,
    2547     0x00000000,
    2548     @@ -113,8 +113,8 @@ static uint32_t gk208_pmu_data[] = {
    2549     0x00000000,
    2550     0x00000000,
    2551     0x54534554,
    2552     - 0x00000a16,
    2553     - 0x000009fa,
    2554     + 0x00000a11,
    2555     + 0x000009f5,
    2556     0x00000000,
    2557     0x00000000,
    2558     0x00000000,
    2559     @@ -135,8 +135,8 @@ static uint32_t gk208_pmu_data[] = {
    2560     0x00000000,
    2561     0x00000000,
    2562     0x454c4449,
    2563     - 0x00000a21,
    2564     - 0x00000a1f,
    2565     + 0x00000a1c,
    2566     + 0x00000a1a,
    2567     0x00000000,
    2568     0x00000000,
    2569     0x00000000,
    2570     @@ -234,22 +234,22 @@ static uint32_t gk208_pmu_data[] = {
    2571     /* 0x037c: memx_func_next */
    2572     0x00000002,
    2573     0x00000000,
    2574     - 0x000004cf,
    2575     + 0x000004cc,
    2576     0x00000003,
    2577     0x00000002,
    2578     - 0x00000546,
    2579     + 0x00000541,
    2580     0x00040004,
    2581     0x00000000,
    2582     - 0x00000563,
    2583     + 0x0000055e,
    2584     0x00010005,
    2585     0x00000000,
    2586     - 0x0000057d,
    2587     + 0x00000578,
    2588     0x00010006,
    2589     0x00000000,
    2590     - 0x00000541,
    2591     + 0x0000053c,
    2592     0x00000007,
    2593     0x00000000,
    2594     - 0x00000589,
    2595     + 0x00000584,
    2596     /* 0x03c4: memx_func_tail */
    2597     /* 0x03c4: memx_ts_start */
    2598     0x00000000,
    2599     @@ -1239,454 +1239,454 @@ static uint32_t gk208_pmu_code[] = {
    2600     0x0001f604,
    2601     0x00f804bd,
    2602     /* 0x045c: memx_func_enter */
    2603     - 0x162067f1,
    2604     - 0xf55d77f1,
    2605     - 0x047e6eb2,
    2606     - 0xd8b20000,
    2607     - 0xf90487fd,
    2608     - 0xfc80f960,
    2609     - 0x7ee0fcd0,
    2610     - 0x0700002d,
    2611     - 0x7e6eb2fe,
    2612     + 0x47162046,
    2613     + 0x6eb2f55d,
    2614     + 0x0000047e,
    2615     + 0x87fdd8b2,
    2616     + 0xf960f904,
    2617     + 0xfcd0fc80,
    2618     + 0x002d7ee0,
    2619     + 0xb2fe0700,
    2620     + 0x00047e6e,
    2621     + 0xfdd8b200,
    2622     + 0x60f90487,
    2623     + 0xd0fc80f9,
    2624     + 0x2d7ee0fc,
    2625     + 0xf0460000,
    2626     + 0x7e6eb226,
    2627     0xb2000004,
    2628     0x0487fdd8,
    2629     0x80f960f9,
    2630     0xe0fcd0fc,
    2631     0x00002d7e,
    2632     - 0x26f067f1,
    2633     - 0x047e6eb2,
    2634     - 0xd8b20000,
    2635     - 0xf90487fd,
    2636     - 0xfc80f960,
    2637     - 0x7ee0fcd0,
    2638     - 0x0600002d,
    2639     - 0x07e04004,
    2640     - 0xbd0006f6,
    2641     -/* 0x04b9: memx_func_enter_wait */
    2642     - 0x07c04604,
    2643     - 0xf00066cf,
    2644     - 0x0bf40464,
    2645     - 0xcf2c06f7,
    2646     - 0x06b50066,
    2647     -/* 0x04cf: memx_func_leave */
    2648     - 0x0600f8f1,
    2649     - 0x0066cf2c,
    2650     - 0x06f206b5,
    2651     - 0x07e44004,
    2652     - 0xbd0006f6,
    2653     -/* 0x04e1: memx_func_leave_wait */
    2654     - 0x07c04604,
    2655     - 0xf00066cf,
    2656     - 0x1bf40464,
    2657     - 0xf067f1f7,
    2658     + 0xe0400406,
    2659     + 0x0006f607,
    2660     +/* 0x04b6: memx_func_enter_wait */
    2661     + 0xc04604bd,
    2662     + 0x0066cf07,
    2663     + 0xf40464f0,
    2664     + 0x2c06f70b,
    2665     + 0xb50066cf,
    2666     + 0x00f8f106,
    2667     +/* 0x04cc: memx_func_leave */
    2668     + 0x66cf2c06,
    2669     + 0xf206b500,
    2670     + 0xe4400406,
    2671     + 0x0006f607,
    2672     +/* 0x04de: memx_func_leave_wait */
    2673     + 0xc04604bd,
    2674     + 0x0066cf07,
    2675     + 0xf40464f0,
    2676     + 0xf046f71b,
    2677     0xb2010726,
    2678     0x00047e6e,
    2679     0xfdd8b200,
    2680     0x60f90587,
    2681     0xd0fc80f9,
    2682     0x2d7ee0fc,
    2683     - 0x67f10000,
    2684     - 0x6eb21620,
    2685     - 0x0000047e,
    2686     - 0x87fdd8b2,
    2687     - 0xf960f905,
    2688     - 0xfcd0fc80,
    2689     - 0x002d7ee0,
    2690     - 0x0aa24700,
    2691     - 0x047e6eb2,
    2692     - 0xd8b20000,
    2693     - 0xf90587fd,
    2694     - 0xfc80f960,
    2695     - 0x7ee0fcd0,
    2696     - 0xf800002d,
    2697     -/* 0x0541: memx_func_wait_vblank */
    2698     + 0x20460000,
    2699     + 0x7e6eb216,
    2700     + 0xb2000004,
    2701     + 0x0587fdd8,
    2702     + 0x80f960f9,
    2703     + 0xe0fcd0fc,
    2704     + 0x00002d7e,
    2705     + 0xb20aa247,
    2706     + 0x00047e6e,
    2707     + 0xfdd8b200,
    2708     + 0x60f90587,
    2709     + 0xd0fc80f9,
    2710     + 0x2d7ee0fc,
    2711     + 0x00f80000,
    2712     +/* 0x053c: memx_func_wait_vblank */
    2713     + 0xf80410b6,
    2714     +/* 0x0541: memx_func_wr32 */
    2715     + 0x00169800,
    2716     + 0xb6011598,
    2717     + 0x60f90810,
    2718     + 0xd0fc50f9,
    2719     + 0x2d7ee0fc,
    2720     + 0x42b60000,
    2721     + 0xe81bf402,
    2722     +/* 0x055e: memx_func_wait */
    2723     + 0x2c0800f8,
    2724     + 0x980088cf,
    2725     + 0x1d98001e,
    2726     + 0x021c9801,
    2727     + 0xb6031b98,
    2728     + 0x747e1010,
    2729     + 0x00f80000,
    2730     +/* 0x0578: memx_func_delay */
    2731     + 0xb6001e98,
    2732     + 0x587e0410,
    2733     + 0x00f80000,
    2734     +/* 0x0584: memx_func_train */
    2735     +/* 0x0586: memx_exec */
    2736     + 0xe0f900f8,
    2737     + 0xc1b2d0f9,
    2738     +/* 0x058e: memx_exec_next */
    2739     + 0x1398b2b2,
    2740     0x0410b600,
    2741     -/* 0x0546: memx_func_wr32 */
    2742     - 0x169800f8,
    2743     - 0x01159800,
    2744     - 0xf90810b6,
    2745     - 0xfc50f960,
    2746     + 0x01f034e7,
    2747     + 0x01e033e7,
    2748     + 0xf00132b6,
    2749     + 0x35980c30,
    2750     + 0xa655f9de,
    2751     + 0xe51ef412,
    2752     + 0x98f10b98,
    2753     + 0xcbbbf20c,
    2754     + 0x07c44b02,
    2755     + 0xfc00bbcf,
    2756     0x7ee0fcd0,
    2757     - 0xb600002d,
    2758     - 0x1bf40242,
    2759     -/* 0x0563: memx_func_wait */
    2760     - 0x0800f8e8,
    2761     - 0x0088cf2c,
    2762     - 0x98001e98,
    2763     - 0x1c98011d,
    2764     - 0x031b9802,
    2765     - 0x7e1010b6,
    2766     - 0xf8000074,
    2767     -/* 0x057d: memx_func_delay */
    2768     - 0x001e9800,
    2769     - 0x7e0410b6,
    2770     - 0xf8000058,
    2771     -/* 0x0589: memx_func_train */
    2772     -/* 0x058b: memx_exec */
    2773     - 0xf900f800,
    2774     - 0xb2d0f9e0,
    2775     -/* 0x0593: memx_exec_next */
    2776     - 0x98b2b2c1,
    2777     - 0x10b60013,
    2778     - 0xf034e704,
    2779     - 0xe033e701,
    2780     - 0x0132b601,
    2781     - 0x980c30f0,
    2782     - 0x55f9de35,
    2783     - 0x1ef412a6,
    2784     - 0xf10b98e5,
    2785     - 0xbbf20c98,
    2786     - 0xc44b02cb,
    2787     - 0x00bbcf07,
    2788     - 0xe0fcd0fc,
    2789     - 0x00029f7e,
    2790     -/* 0x05ca: memx_info */
    2791     - 0xc67000f8,
    2792     - 0x0c0bf401,
    2793     -/* 0x05d0: memx_info_data */
    2794     - 0x4b03cc4c,
    2795     - 0x0ef40800,
    2796     -/* 0x05d9: memx_info_train */
    2797     - 0x0bcc4c09,
    2798     -/* 0x05df: memx_info_send */
    2799     - 0x7e01004b,
    2800     0xf800029f,
    2801     -/* 0x05e5: memx_recv */
    2802     - 0x01d6b000,
    2803     - 0xb0a30bf4,
    2804     - 0x0bf400d6,
    2805     -/* 0x05f3: memx_init */
    2806     - 0xf800f8dc,
    2807     -/* 0x05f5: perf_recv */
    2808     -/* 0x05f7: perf_init */
    2809     - 0xf800f800,
    2810     -/* 0x05f9: i2c_drive_scl */
    2811     - 0x0036b000,
    2812     - 0x400d0bf4,
    2813     - 0x01f607e0,
    2814     - 0xf804bd00,
    2815     -/* 0x0609: i2c_drive_scl_lo */
    2816     - 0x07e44000,
    2817     - 0xbd0001f6,
    2818     -/* 0x0613: i2c_drive_sda */
    2819     - 0xb000f804,
    2820     - 0x0bf40036,
    2821     - 0x07e0400d,
    2822     - 0xbd0002f6,
    2823     -/* 0x0623: i2c_drive_sda_lo */
    2824     - 0x4000f804,
    2825     - 0x02f607e4,
    2826     - 0xf804bd00,
    2827     -/* 0x062d: i2c_sense_scl */
    2828     - 0x0132f400,
    2829     - 0xcf07c443,
    2830     - 0x31fd0033,
    2831     - 0x060bf404,
    2832     -/* 0x063f: i2c_sense_scl_done */
    2833     - 0xf80131f4,
    2834     -/* 0x0641: i2c_sense_sda */
    2835     - 0x0132f400,
    2836     - 0xcf07c443,
    2837     - 0x32fd0033,
    2838     - 0x060bf404,
    2839     -/* 0x0653: i2c_sense_sda_done */
    2840     - 0xf80131f4,
    2841     -/* 0x0655: i2c_raise_scl */
    2842     - 0x4440f900,
    2843     - 0x01030898,
    2844     - 0x0005f97e,
    2845     -/* 0x0660: i2c_raise_scl_wait */
    2846     - 0x7e03e84e,
    2847     - 0x7e000058,
    2848     - 0xf400062d,
    2849     - 0x42b60901,
    2850     - 0xef1bf401,
    2851     -/* 0x0674: i2c_raise_scl_done */
    2852     - 0x00f840fc,
    2853     -/* 0x0678: i2c_start */
    2854     - 0x00062d7e,
    2855     - 0x7e0d11f4,
    2856     - 0xf4000641,
    2857     - 0x0ef40611,
    2858     -/* 0x0689: i2c_start_rep */
    2859     - 0x7e00032e,
    2860     - 0x030005f9,
    2861     - 0x06137e01,
    2862     +/* 0x05c5: memx_info */
    2863     + 0x01c67000,
    2864     +/* 0x05cb: memx_info_data */
    2865     + 0x4c0c0bf4,
    2866     + 0x004b03cc,
    2867     + 0x090ef408,
    2868     +/* 0x05d4: memx_info_train */
    2869     + 0x4b0bcc4c,
    2870     +/* 0x05da: memx_info_send */
    2871     + 0x9f7e0100,
    2872     + 0x00f80002,
    2873     +/* 0x05e0: memx_recv */
    2874     + 0xf401d6b0,
    2875     + 0xd6b0a30b,
    2876     + 0xdc0bf400,
    2877     +/* 0x05ee: memx_init */
    2878     + 0x00f800f8,
    2879     +/* 0x05f0: perf_recv */
    2880     +/* 0x05f2: perf_init */
    2881     + 0x00f800f8,
    2882     +/* 0x05f4: i2c_drive_scl */
    2883     + 0xf40036b0,
    2884     + 0xe0400d0b,
    2885     + 0x0001f607,
    2886     + 0x00f804bd,
    2887     +/* 0x0604: i2c_drive_scl_lo */
    2888     + 0xf607e440,
    2889     + 0x04bd0001,
    2890     +/* 0x060e: i2c_drive_sda */
    2891     + 0x36b000f8,
    2892     + 0x0d0bf400,
    2893     + 0xf607e040,
    2894     + 0x04bd0002,
    2895     +/* 0x061e: i2c_drive_sda_lo */
    2896     + 0xe44000f8,
    2897     + 0x0002f607,
    2898     + 0x00f804bd,
    2899     +/* 0x0628: i2c_sense_scl */
    2900     + 0x430132f4,
    2901     + 0x33cf07c4,
    2902     + 0x0431fd00,
    2903     + 0xf4060bf4,
    2904     +/* 0x063a: i2c_sense_scl_done */
    2905     + 0x00f80131,
    2906     +/* 0x063c: i2c_sense_sda */
    2907     + 0x430132f4,
    2908     + 0x33cf07c4,
    2909     + 0x0432fd00,
    2910     + 0xf4060bf4,
    2911     +/* 0x064e: i2c_sense_sda_done */
    2912     + 0x00f80131,
    2913     +/* 0x0650: i2c_raise_scl */
    2914     + 0x984440f9,
    2915     + 0x7e010308,
    2916     +/* 0x065b: i2c_raise_scl_wait */
    2917     + 0x4e0005f4,
    2918     + 0x587e03e8,
    2919     + 0x287e0000,
    2920     + 0x01f40006,
    2921     + 0x0142b609,
    2922     +/* 0x066f: i2c_raise_scl_done */
    2923     + 0xfcef1bf4,
    2924     +/* 0x0673: i2c_start */
    2925     + 0x7e00f840,
    2926     + 0xf4000628,
    2927     + 0x3c7e0d11,
    2928     + 0x11f40006,
    2929     + 0x2e0ef406,
    2930     +/* 0x0684: i2c_start_rep */
    2931     + 0xf47e0003,
    2932     + 0x01030005,
    2933     + 0x00060e7e,
    2934     + 0xb60076bb,
    2935     + 0x50f90465,
    2936     + 0xbb046594,
    2937     + 0x50bd0256,
    2938     + 0xfc0475fd,
    2939     + 0x06507e50,
    2940     + 0x0464b600,
    2941     +/* 0x06af: i2c_start_send */
    2942     + 0x031d11f4,
    2943     + 0x060e7e00,
    2944     + 0x13884e00,
    2945     + 0x0000587e,
    2946     + 0xf47e0003,
    2947     + 0x884e0005,
    2948     + 0x00587e13,
    2949     +/* 0x06c9: i2c_start_out */
    2950     +/* 0x06cb: i2c_stop */
    2951     + 0x0300f800,
    2952     + 0x05f47e00,
    2953     + 0x7e000300,
    2954     + 0x4e00060e,
    2955     + 0x587e03e8,
    2956     + 0x01030000,
    2957     + 0x0005f47e,
    2958     + 0x7e13884e,
    2959     + 0x03000058,
    2960     + 0x060e7e01,
    2961     + 0x13884e00,
    2962     + 0x0000587e,
    2963     +/* 0x06fa: i2c_bitw */
    2964     + 0x0e7e00f8,
    2965     + 0xe84e0006,
    2966     + 0x00587e03,
    2967     0x0076bb00,
    2968     0xf90465b6,
    2969     0x04659450,
    2970     0xbd0256bb,
    2971     0x0475fd50,
    2972     - 0x557e50fc,
    2973     + 0x507e50fc,
    2974     0x64b60006,
    2975     - 0x1d11f404,
    2976     -/* 0x06b4: i2c_start_send */
    2977     - 0x137e0003,
    2978     - 0x884e0006,
    2979     - 0x00587e13,
    2980     - 0x7e000300,
    2981     - 0x4e0005f9,
    2982     - 0x587e1388,
    2983     -/* 0x06ce: i2c_start_out */
    2984     - 0x00f80000,
    2985     -/* 0x06d0: i2c_stop */
    2986     - 0xf97e0003,
    2987     - 0x00030005,
    2988     - 0x0006137e,
    2989     - 0x7e03e84e,
    2990     + 0x1711f404,
    2991     + 0x7e13884e,
    2992     0x03000058,
    2993     - 0x05f97e01,
    2994     + 0x05f47e00,
    2995     0x13884e00,
    2996     0x0000587e,
    2997     - 0x137e0103,
    2998     - 0x884e0006,
    2999     - 0x00587e13,
    3000     -/* 0x06ff: i2c_bitw */
    3001     - 0x7e00f800,
    3002     - 0x4e000613,
    3003     - 0x587e03e8,
    3004     - 0x76bb0000,
    3005     +/* 0x0738: i2c_bitw_out */
    3006     +/* 0x073a: i2c_bitr */
    3007     + 0x010300f8,
    3008     + 0x00060e7e,
    3009     + 0x7e03e84e,
    3010     + 0xbb000058,
    3011     + 0x65b60076,
    3012     + 0x9450f904,
    3013     + 0x56bb0465,
    3014     + 0xfd50bd02,
    3015     + 0x50fc0475,
    3016     + 0x0006507e,
    3017     + 0xf40464b6,
    3018     + 0x3c7e1a11,
    3019     + 0x00030006,
    3020     + 0x0005f47e,
    3021     + 0x7e13884e,
    3022     + 0xf0000058,
    3023     + 0x31f4013c,
    3024     +/* 0x077d: i2c_bitr_done */
    3025     +/* 0x077f: i2c_get_byte */
    3026     + 0x0500f801,
    3027     +/* 0x0783: i2c_get_byte_next */
    3028     + 0xb6080400,
    3029     + 0x76bb0154,
    3030     0x0465b600,
    3031     0x659450f9,
    3032     0x0256bb04,
    3033     0x75fd50bd,
    3034     0x7e50fc04,
    3035     - 0xb6000655,
    3036     + 0xb600073a,
    3037     0x11f40464,
    3038     - 0x13884e17,
    3039     - 0x0000587e,
    3040     - 0xf97e0003,
    3041     - 0x884e0005,
    3042     - 0x00587e13,
    3043     -/* 0x073d: i2c_bitw_out */
    3044     -/* 0x073f: i2c_bitr */
    3045     - 0x0300f800,
    3046     - 0x06137e01,
    3047     - 0x03e84e00,
    3048     - 0x0000587e,
    3049     + 0x0553fd2a,
    3050     + 0xf40142b6,
    3051     + 0x0103d81b,
    3052     0xb60076bb,
    3053     0x50f90465,
    3054     0xbb046594,
    3055     0x50bd0256,
    3056     0xfc0475fd,
    3057     - 0x06557e50,
    3058     + 0x06fa7e50,
    3059     0x0464b600,
    3060     - 0x7e1a11f4,
    3061     - 0x03000641,
    3062     - 0x05f97e00,
    3063     - 0x13884e00,
    3064     - 0x0000587e,
    3065     - 0xf4013cf0,
    3066     -/* 0x0782: i2c_bitr_done */
    3067     - 0x00f80131,
    3068     -/* 0x0784: i2c_get_byte */
    3069     - 0x08040005,
    3070     -/* 0x0788: i2c_get_byte_next */
    3071     - 0xbb0154b6,
    3072     - 0x65b60076,
    3073     - 0x9450f904,
    3074     - 0x56bb0465,
    3075     - 0xfd50bd02,
    3076     - 0x50fc0475,
    3077     - 0x00073f7e,
    3078     - 0xf40464b6,
    3079     - 0x53fd2a11,
    3080     - 0x0142b605,
    3081     - 0x03d81bf4,
    3082     - 0x0076bb01,
    3083     - 0xf90465b6,
    3084     - 0x04659450,
    3085     - 0xbd0256bb,
    3086     - 0x0475fd50,
    3087     - 0xff7e50fc,
    3088     - 0x64b60006,
    3089     -/* 0x07d1: i2c_get_byte_done */
    3090     -/* 0x07d3: i2c_put_byte */
    3091     - 0x0400f804,
    3092     -/* 0x07d5: i2c_put_byte_next */
    3093     - 0x0142b608,
    3094     - 0xbb3854ff,
    3095     +/* 0x07cc: i2c_get_byte_done */
    3096     +/* 0x07ce: i2c_put_byte */
    3097     + 0x080400f8,
    3098     +/* 0x07d0: i2c_put_byte_next */
    3099     + 0xff0142b6,
    3100     + 0x76bb3854,
    3101     + 0x0465b600,
    3102     + 0x659450f9,
    3103     + 0x0256bb04,
    3104     + 0x75fd50bd,
    3105     + 0x7e50fc04,
    3106     + 0xb60006fa,
    3107     + 0x11f40464,
    3108     + 0x0046b034,
    3109     + 0xbbd81bf4,
    3110     0x65b60076,
    3111     0x9450f904,
    3112     0x56bb0465,
    3113     0xfd50bd02,
    3114     0x50fc0475,
    3115     - 0x0006ff7e,
    3116     + 0x00073a7e,
    3117     0xf40464b6,
    3118     - 0x46b03411,
    3119     - 0xd81bf400,
    3120     + 0x76bb0f11,
    3121     + 0x0136b000,
    3122     + 0xf4061bf4,
    3123     +/* 0x0826: i2c_put_byte_done */
    3124     + 0x00f80132,
    3125     +/* 0x0828: i2c_addr */
    3126     0xb60076bb,
    3127     0x50f90465,
    3128     0xbb046594,
    3129     0x50bd0256,
    3130     0xfc0475fd,
    3131     - 0x073f7e50,
    3132     + 0x06737e50,
    3133     0x0464b600,
    3134     - 0xbb0f11f4,
    3135     - 0x36b00076,
    3136     - 0x061bf401,
    3137     -/* 0x082b: i2c_put_byte_done */
    3138     - 0xf80132f4,
    3139     -/* 0x082d: i2c_addr */
    3140     - 0x0076bb00,
    3141     + 0xe72911f4,
    3142     + 0xb6012ec3,
    3143     + 0x53fd0134,
    3144     + 0x0076bb05,
    3145     0xf90465b6,
    3146     0x04659450,
    3147     0xbd0256bb,
    3148     0x0475fd50,
    3149     - 0x787e50fc,
    3150     - 0x64b60006,
    3151     - 0x2911f404,
    3152     - 0x012ec3e7,
    3153     - 0xfd0134b6,
    3154     - 0x76bb0553,
    3155     - 0x0465b600,
    3156     - 0x659450f9,
    3157     - 0x0256bb04,
    3158     - 0x75fd50bd,
    3159     - 0x7e50fc04,
    3160     - 0xb60007d3,
    3161     -/* 0x0872: i2c_addr_done */
    3162     - 0x00f80464,
    3163     -/* 0x0874: i2c_acquire_addr */
    3164     - 0xb6f8cec7,
    3165     - 0xe0b705e4,
    3166     - 0x00f8d014,
    3167     -/* 0x0880: i2c_acquire */
    3168     - 0x0008747e,
    3169     + 0xce7e50fc,
    3170     + 0x64b60007,
    3171     +/* 0x086d: i2c_addr_done */
    3172     +/* 0x086f: i2c_acquire_addr */
    3173     + 0xc700f804,
    3174     + 0xe4b6f8ce,
    3175     + 0x14e0b705,
    3176     +/* 0x087b: i2c_acquire */
    3177     + 0x7e00f8d0,
    3178     + 0x7e00086f,
    3179     + 0xf0000004,
    3180     + 0x2d7e03d9,
    3181     + 0x00f80000,
    3182     +/* 0x088c: i2c_release */
    3183     + 0x00086f7e,
    3184     0x0000047e,
    3185     - 0x7e03d9f0,
    3186     + 0x7e03daf0,
    3187     0xf800002d,
    3188     -/* 0x0891: i2c_release */
    3189     - 0x08747e00,
    3190     - 0x00047e00,
    3191     - 0x03daf000,
    3192     - 0x00002d7e,
    3193     -/* 0x08a2: i2c_recv */
    3194     - 0x32f400f8,
    3195     - 0xf8c1c701,
    3196     - 0xb00214b6,
    3197     - 0x1ff52816,
    3198     - 0x13b80134,
    3199     - 0x98000cf4,
    3200     - 0x13b80032,
    3201     - 0x98000ccc,
    3202     - 0x31f40031,
    3203     - 0xf9d0f902,
    3204     - 0xd6d0f9e0,
    3205     - 0x10000000,
    3206     - 0xbb016792,
    3207     - 0x65b60076,
    3208     - 0x9450f904,
    3209     - 0x56bb0465,
    3210     - 0xfd50bd02,
    3211     - 0x50fc0475,
    3212     - 0x0008807e,
    3213     - 0xfc0464b6,
    3214     - 0x00d6b0d0,
    3215     - 0x00b01bf5,
    3216     - 0x76bb0005,
    3217     +/* 0x089d: i2c_recv */
    3218     + 0x0132f400,
    3219     + 0xb6f8c1c7,
    3220     + 0x16b00214,
    3221     + 0x341ff528,
    3222     + 0xf413b801,
    3223     + 0x3298000c,
    3224     + 0xcc13b800,
    3225     + 0x3198000c,
    3226     + 0x0231f400,
    3227     + 0xe0f9d0f9,
    3228     + 0x00d6d0f9,
    3229     + 0x92100000,
    3230     + 0x76bb0167,
    3231     0x0465b600,
    3232     0x659450f9,
    3233     0x0256bb04,
    3234     0x75fd50bd,
    3235     0x7e50fc04,
    3236     - 0xb600082d,
    3237     - 0x11f50464,
    3238     - 0xc5c700cc,
    3239     - 0x0076bbe0,
    3240     - 0xf90465b6,
    3241     - 0x04659450,
    3242     - 0xbd0256bb,
    3243     - 0x0475fd50,
    3244     - 0xd37e50fc,
    3245     - 0x64b60007,
    3246     - 0xa911f504,
    3247     - 0xbb010500,
    3248     - 0x65b60076,
    3249     - 0x9450f904,
    3250     - 0x56bb0465,
    3251     - 0xfd50bd02,
    3252     - 0x50fc0475,
    3253     - 0x00082d7e,
    3254     - 0xf50464b6,
    3255     - 0xbb008711,
    3256     - 0x65b60076,
    3257     - 0x9450f904,
    3258     - 0x56bb0465,
    3259     - 0xfd50bd02,
    3260     - 0x50fc0475,
    3261     - 0x0007847e,
    3262     - 0xf40464b6,
    3263     - 0x5bcb6711,
    3264     - 0x0076bbe0,
    3265     + 0xb600087b,
    3266     + 0xd0fc0464,
    3267     + 0xf500d6b0,
    3268     + 0x0500b01b,
    3269     + 0x0076bb00,
    3270     0xf90465b6,
    3271     0x04659450,
    3272     0xbd0256bb,
    3273     0x0475fd50,
    3274     - 0xd07e50fc,
    3275     - 0x64b60006,
    3276     - 0xbd5bb204,
    3277     - 0x410ef474,
    3278     -/* 0x09a4: i2c_recv_not_rd08 */
    3279     - 0xf401d6b0,
    3280     - 0x00053b1b,
    3281     - 0x00082d7e,
    3282     - 0xc73211f4,
    3283     - 0xd37ee0c5,
    3284     - 0x11f40007,
    3285     - 0x7e000528,
    3286     - 0xf400082d,
    3287     - 0xb5c71f11,
    3288     - 0x07d37ee0,
    3289     - 0x1511f400,
    3290     - 0x0006d07e,
    3291     - 0xc5c774bd,
    3292     - 0x091bf408,
    3293     - 0xf40232f4,
    3294     -/* 0x09e2: i2c_recv_not_wr08 */
    3295     -/* 0x09e2: i2c_recv_done */
    3296     - 0xcec7030e,
    3297     - 0x08917ef8,
    3298     - 0xfce0fc00,
    3299     - 0x0912f4d0,
    3300     - 0x9f7e7cb2,
    3301     -/* 0x09f6: i2c_recv_exit */
    3302     - 0x00f80002,
    3303     -/* 0x09f8: i2c_init */
    3304     -/* 0x09fa: test_recv */
    3305     - 0x584100f8,
    3306     - 0x0011cf04,
    3307     - 0x400110b6,
    3308     - 0x01f60458,
    3309     - 0xde04bd00,
    3310     - 0x134fd900,
    3311     - 0x0001de7e,
    3312     -/* 0x0a16: test_init */
    3313     - 0x004e00f8,
    3314     - 0x01de7e08,
    3315     -/* 0x0a1f: idle_recv */
    3316     + 0x287e50fc,
    3317     + 0x64b60008,
    3318     + 0xcc11f504,
    3319     + 0xe0c5c700,
    3320     + 0xb60076bb,
    3321     + 0x50f90465,
    3322     + 0xbb046594,
    3323     + 0x50bd0256,
    3324     + 0xfc0475fd,
    3325     + 0x07ce7e50,
    3326     + 0x0464b600,
    3327     + 0x00a911f5,
    3328     + 0x76bb0105,
    3329     + 0x0465b600,
    3330     + 0x659450f9,
    3331     + 0x0256bb04,
    3332     + 0x75fd50bd,
    3333     + 0x7e50fc04,
    3334     + 0xb6000828,
    3335     + 0x11f50464,
    3336     + 0x76bb0087,
    3337     + 0x0465b600,
    3338     + 0x659450f9,
    3339     + 0x0256bb04,
    3340     + 0x75fd50bd,
    3341     + 0x7e50fc04,
    3342     + 0xb600077f,
    3343     + 0x11f40464,
    3344     + 0xe05bcb67,
    3345     + 0xb60076bb,
    3346     + 0x50f90465,
    3347     + 0xbb046594,
    3348     + 0x50bd0256,
    3349     + 0xfc0475fd,
    3350     + 0x06cb7e50,
    3351     + 0x0464b600,
    3352     + 0x74bd5bb2,
    3353     +/* 0x099f: i2c_recv_not_rd08 */
    3354     + 0xb0410ef4,
    3355     + 0x1bf401d6,
    3356     + 0x7e00053b,
    3357     + 0xf4000828,
    3358     + 0xc5c73211,
    3359     + 0x07ce7ee0,
    3360     + 0x2811f400,
    3361     + 0x287e0005,
    3362     + 0x11f40008,
    3363     + 0xe0b5c71f,
    3364     + 0x0007ce7e,
    3365     + 0x7e1511f4,
    3366     + 0xbd0006cb,
    3367     + 0x08c5c774,
    3368     + 0xf4091bf4,
    3369     + 0x0ef40232,
    3370     +/* 0x09dd: i2c_recv_not_wr08 */
    3371     +/* 0x09dd: i2c_recv_done */
    3372     + 0xf8cec703,
    3373     + 0x00088c7e,
    3374     + 0xd0fce0fc,
    3375     + 0xb20912f4,
    3376     + 0x029f7e7c,
    3377     +/* 0x09f1: i2c_recv_exit */
    3378     +/* 0x09f3: i2c_init */
    3379     0xf800f800,
    3380     -/* 0x0a21: idle */
    3381     - 0x0031f400,
    3382     - 0xcf045441,
    3383     - 0x10b60011,
    3384     - 0x04544001,
    3385     - 0xbd0001f6,
    3386     -/* 0x0a35: idle_loop */
    3387     - 0xf4580104,
    3388     -/* 0x0a3a: idle_proc */
    3389     -/* 0x0a3a: idle_proc_exec */
    3390     - 0x10f90232,
    3391     - 0xa87e1eb2,
    3392     - 0x10fc0002,
    3393     - 0xf40911f4,
    3394     - 0x0ef40231,
    3395     -/* 0x0a4d: idle_proc_next */
    3396     - 0x5810b6f0,
    3397     - 0x1bf41fa6,
    3398     - 0xe002f4e8,
    3399     - 0xf40028f4,
    3400     - 0x0000c60e,
    3401     +/* 0x09f5: test_recv */
    3402     + 0x04584100,
    3403     + 0xb60011cf,
    3404     + 0x58400110,
    3405     + 0x0001f604,
    3406     + 0x00de04bd,
    3407     + 0x7e134fd9,
    3408     + 0xf80001de,
    3409     +/* 0x0a11: test_init */
    3410     + 0x08004e00,
    3411     + 0x0001de7e,
    3412     +/* 0x0a1a: idle_recv */
    3413     + 0x00f800f8,
    3414     +/* 0x0a1c: idle */
    3415     + 0x410031f4,
    3416     + 0x11cf0454,
    3417     + 0x0110b600,
    3418     + 0xf6045440,
    3419     + 0x04bd0001,
    3420     +/* 0x0a30: idle_loop */
    3421     + 0x32f45801,
    3422     +/* 0x0a35: idle_proc */
    3423     +/* 0x0a35: idle_proc_exec */
    3424     + 0xb210f902,
    3425     + 0x02a87e1e,
    3426     + 0xf410fc00,
    3427     + 0x31f40911,
    3428     + 0xf00ef402,
    3429     +/* 0x0a48: idle_proc_next */
    3430     + 0xa65810b6,
    3431     + 0xe81bf41f,
    3432     + 0xf4e002f4,
    3433     + 0x0ef40028,
    3434     + 0x000000c6,
    3435     + 0x00000000,
    3436     0x00000000,
    3437     0x00000000,
    3438     0x00000000,
    3439     diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
    3440     index 6a2572e8945a..defddf5957ee 100644
    3441     --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
    3442     +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h
    3443     @@ -47,8 +47,8 @@ static uint32_t gt215_pmu_data[] = {
    3444     0x00000000,
    3445     0x00000000,
    3446     0x584d454d,
    3447     - 0x0000083a,
    3448     - 0x0000082c,
    3449     + 0x00000833,
    3450     + 0x00000825,
    3451     0x00000000,
    3452     0x00000000,
    3453     0x00000000,
    3454     @@ -69,8 +69,8 @@ static uint32_t gt215_pmu_data[] = {
    3455     0x00000000,
    3456     0x00000000,
    3457     0x46524550,
    3458     - 0x0000083e,
    3459     - 0x0000083c,
    3460     + 0x00000837,
    3461     + 0x00000835,
    3462     0x00000000,
    3463     0x00000000,
    3464     0x00000000,
    3465     @@ -91,8 +91,8 @@ static uint32_t gt215_pmu_data[] = {
    3466     0x00000000,
    3467     0x00000000,
    3468     0x5f433249,
    3469     - 0x00000c6e,
    3470     - 0x00000b11,
    3471     + 0x00000c67,
    3472     + 0x00000b0a,
    3473     0x00000000,
    3474     0x00000000,
    3475     0x00000000,
    3476     @@ -113,8 +113,8 @@ static uint32_t gt215_pmu_data[] = {
    3477     0x00000000,
    3478     0x00000000,
    3479     0x54534554,
    3480     - 0x00000c97,
    3481     - 0x00000c70,
    3482     + 0x00000c90,
    3483     + 0x00000c69,
    3484     0x00000000,
    3485     0x00000000,
    3486     0x00000000,
    3487     @@ -135,8 +135,8 @@ static uint32_t gt215_pmu_data[] = {
    3488     0x00000000,
    3489     0x00000000,
    3490     0x454c4449,
    3491     - 0x00000ca3,
    3492     - 0x00000ca1,
    3493     + 0x00000c9c,
    3494     + 0x00000c9a,
    3495     0x00000000,
    3496     0x00000000,
    3497     0x00000000,
    3498     @@ -234,22 +234,22 @@ static uint32_t gt215_pmu_data[] = {
    3499     /* 0x037c: memx_func_next */
    3500     0x00000002,
    3501     0x00000000,
    3502     - 0x000005a0,
    3503     + 0x0000059f,
    3504     0x00000003,
    3505     0x00000002,
    3506     - 0x00000632,
    3507     + 0x0000062f,
    3508     0x00040004,
    3509     0x00000000,
    3510     - 0x0000064e,
    3511     + 0x0000064b,
    3512     0x00010005,
    3513     0x00000000,
    3514     - 0x0000066b,
    3515     + 0x00000668,
    3516     0x00010006,
    3517     0x00000000,
    3518     - 0x000005f0,
    3519     + 0x000005ef,
    3520     0x00000007,
    3521     0x00000000,
    3522     - 0x00000676,
    3523     + 0x00000673,
    3524     /* 0x03c4: memx_func_tail */
    3525     /* 0x03c4: memx_ts_start */
    3526     0x00000000,
    3527     @@ -1305,560 +1305,560 @@ static uint32_t gt215_pmu_code[] = {
    3528     0x67f102d7,
    3529     0x63f1fffc,
    3530     0x76fdffff,
    3531     - 0x0267f104,
    3532     - 0x0576fd00,
    3533     - 0x70f980f9,
    3534     - 0xe0fcd0fc,
    3535     - 0xf04021f4,
    3536     + 0x0267f004,
    3537     + 0xf90576fd,
    3538     + 0xfc70f980,
    3539     + 0xf4e0fcd0,
    3540     + 0x67f04021,
    3541     + 0xe007f104,
    3542     + 0x0604b607,
    3543     + 0xbd0006d0,
    3544     +/* 0x0581: memx_func_enter_wait */
    3545     + 0xc067f104,
    3546     + 0x0664b607,
    3547     + 0xf00066cf,
    3548     + 0x0bf40464,
    3549     + 0x2c67f0f3,
    3550     + 0xcf0664b6,
    3551     + 0x06800066,
    3552     +/* 0x059f: memx_func_leave */
    3553     + 0xf000f8f1,
    3554     + 0x64b62c67,
    3555     + 0x0066cf06,
    3556     + 0xf0f20680,
    3557     0x07f10467,
    3558     - 0x04b607e0,
    3559     + 0x04b607e4,
    3560     0x0006d006,
    3561     -/* 0x0582: memx_func_enter_wait */
    3562     +/* 0x05ba: memx_func_leave_wait */
    3563     0x67f104bd,
    3564     0x64b607c0,
    3565     0x0066cf06,
    3566     0xf40464f0,
    3567     - 0x67f0f30b,
    3568     - 0x0664b62c,
    3569     - 0x800066cf,
    3570     - 0x00f8f106,
    3571     -/* 0x05a0: memx_func_leave */
    3572     - 0xb62c67f0,
    3573     - 0x66cf0664,
    3574     - 0xf2068000,
    3575     - 0xf10467f0,
    3576     - 0xb607e407,
    3577     - 0x06d00604,
    3578     -/* 0x05bb: memx_func_leave_wait */
    3579     - 0xf104bd00,
    3580     - 0xb607c067,
    3581     - 0x66cf0664,
    3582     - 0x0464f000,
    3583     - 0xf1f31bf4,
    3584     - 0xb9161087,
    3585     - 0x21f4028e,
    3586     - 0x02d7b904,
    3587     - 0xffcc67f1,
    3588     - 0xffff63f1,
    3589     - 0xf90476fd,
    3590     - 0xfc70f980,
    3591     - 0xf4e0fcd0,
    3592     - 0x00f84021,
    3593     -/* 0x05f0: memx_func_wait_vblank */
    3594     - 0xb0001698,
    3595     - 0x0bf40066,
    3596     - 0x0166b013,
    3597     - 0xf4060bf4,
    3598     -/* 0x0602: memx_func_wait_vblank_head1 */
    3599     - 0x77f12e0e,
    3600     - 0x0ef40020,
    3601     -/* 0x0609: memx_func_wait_vblank_head0 */
    3602     - 0x0877f107,
    3603     -/* 0x060d: memx_func_wait_vblank_0 */
    3604     - 0xc467f100,
    3605     - 0x0664b607,
    3606     - 0xfd0066cf,
    3607     - 0x1bf40467,
    3608     -/* 0x061d: memx_func_wait_vblank_1 */
    3609     - 0xc467f1f3,
    3610     - 0x0664b607,
    3611     - 0xfd0066cf,
    3612     - 0x0bf40467,
    3613     -/* 0x062d: memx_func_wait_vblank_fini */
    3614     - 0x0410b6f3,
    3615     -/* 0x0632: memx_func_wr32 */
    3616     - 0x169800f8,
    3617     - 0x01159800,
    3618     - 0xf90810b6,
    3619     - 0xfc50f960,
    3620     - 0xf4e0fcd0,
    3621     - 0x42b64021,
    3622     - 0xe91bf402,
    3623     -/* 0x064e: memx_func_wait */
    3624     - 0x87f000f8,
    3625     - 0x0684b62c,
    3626     - 0x980088cf,
    3627     - 0x1d98001e,
    3628     - 0x021c9801,
    3629     - 0xb6031b98,
    3630     - 0x21f41010,
    3631     -/* 0x066b: memx_func_delay */
    3632     - 0x9800f8a3,
    3633     - 0x10b6001e,
    3634     - 0x7e21f404,
    3635     -/* 0x0676: memx_func_train */
    3636     - 0x57f100f8,
    3637     - 0x77f10003,
    3638     - 0x97f10000,
    3639     - 0x93f00000,
    3640     - 0x029eb970,
    3641     - 0xb90421f4,
    3642     - 0xe7f102d8,
    3643     - 0x21f42710,
    3644     -/* 0x0695: memx_func_train_loop_outer */
    3645     - 0x0158e07e,
    3646     - 0x0083f101,
    3647     - 0xe097f102,
    3648     - 0x1193f011,
    3649     - 0x80f990f9,
    3650     + 0x87f1f31b,
    3651     + 0x8eb91610,
    3652     + 0x0421f402,
    3653     + 0xf102d7b9,
    3654     + 0xf1ffcc67,
    3655     + 0xfdffff63,
    3656     + 0x80f90476,
    3657     + 0xd0fc70f9,
    3658     + 0x21f4e0fc,
    3659     +/* 0x05ef: memx_func_wait_vblank */
    3660     + 0x9800f840,
    3661     + 0x66b00016,
    3662     + 0x120bf400,
    3663     + 0xf40166b0,
    3664     + 0x0ef4060b,
    3665     +/* 0x0601: memx_func_wait_vblank_head1 */
    3666     + 0x2077f02c,
    3667     +/* 0x0607: memx_func_wait_vblank_head0 */
    3668     + 0xf0060ef4,
    3669     +/* 0x060a: memx_func_wait_vblank_0 */
    3670     + 0x67f10877,
    3671     + 0x64b607c4,
    3672     + 0x0066cf06,
    3673     + 0xf40467fd,
    3674     +/* 0x061a: memx_func_wait_vblank_1 */
    3675     + 0x67f1f31b,
    3676     + 0x64b607c4,
    3677     + 0x0066cf06,
    3678     + 0xf40467fd,
    3679     +/* 0x062a: memx_func_wait_vblank_fini */
    3680     + 0x10b6f30b,
    3681     +/* 0x062f: memx_func_wr32 */
    3682     + 0x9800f804,
    3683     + 0x15980016,
    3684     + 0x0810b601,
    3685     + 0x50f960f9,
    3686     0xe0fcd0fc,
    3687     - 0xf94021f4,
    3688     - 0x0067f150,
    3689     -/* 0x06b5: memx_func_train_loop_inner */
    3690     - 0x1187f100,
    3691     - 0x9068ff11,
    3692     - 0xfd109894,
    3693     - 0x97f10589,
    3694     - 0x93f00720,
    3695     - 0xf990f910,
    3696     - 0xfcd0fc80,
    3697     - 0x4021f4e0,
    3698     - 0x008097f1,
    3699     - 0xb91093f0,
    3700     - 0x21f4029e,
    3701     - 0x02d8b904,
    3702     - 0xf92088c5,
    3703     + 0xb64021f4,
    3704     + 0x1bf40242,
    3705     +/* 0x064b: memx_func_wait */
    3706     + 0xf000f8e9,
    3707     + 0x84b62c87,
    3708     + 0x0088cf06,
    3709     + 0x98001e98,
    3710     + 0x1c98011d,
    3711     + 0x031b9802,
    3712     + 0xf41010b6,
    3713     + 0x00f8a321,
    3714     +/* 0x0668: memx_func_delay */
    3715     + 0xb6001e98,
    3716     + 0x21f40410,
    3717     +/* 0x0673: memx_func_train */
    3718     + 0xf000f87e,
    3719     + 0x77f00357,
    3720     + 0x0097f100,
    3721     + 0x7093f000,
    3722     + 0xf4029eb9,
    3723     + 0xd8b90421,
    3724     + 0x10e7f102,
    3725     + 0x7e21f427,
    3726     +/* 0x0690: memx_func_train_loop_outer */
    3727     + 0x010158e0,
    3728     + 0x020083f1,
    3729     + 0x11e097f1,
    3730     + 0xf91193f0,
    3731     + 0xfc80f990,
    3732     + 0xf4e0fcd0,
    3733     + 0x50f94021,
    3734     +/* 0x06af: memx_func_train_loop_inner */
    3735     + 0xf10067f0,
    3736     + 0xff111187,
    3737     + 0x98949068,
    3738     + 0x0589fd10,
    3739     + 0x072097f1,
    3740     + 0xf91093f0,
    3741     0xfc80f990,
    3742     0xf4e0fcd0,
    3743     0x97f14021,
    3744     - 0x93f0053c,
    3745     - 0x0287f110,
    3746     - 0x0083f130,
    3747     - 0xf990f980,
    3748     + 0x93f00080,
    3749     + 0x029eb910,
    3750     + 0xb90421f4,
    3751     + 0x88c502d8,
    3752     + 0xf990f920,
    3753     0xfcd0fc80,
    3754     0x4021f4e0,
    3755     - 0x0560e7f1,
    3756     - 0xf110e3f0,
    3757     - 0xf10000d7,
    3758     - 0x908000d3,
    3759     - 0xb7f100dc,
    3760     - 0xb3f08480,
    3761     - 0xa321f41e,
    3762     - 0x000057f1,
    3763     - 0xffff97f1,
    3764     - 0x830093f1,
    3765     -/* 0x0734: memx_func_train_loop_4x */
    3766     - 0x0080a7f1,
    3767     - 0xb910a3f0,
    3768     - 0x21f402ae,
    3769     - 0x02d8b904,
    3770     - 0xffdfb7f1,
    3771     - 0xffffb3f1,
    3772     - 0xf9048bfd,
    3773     - 0xfc80f9a0,
    3774     + 0x053c97f1,
    3775     + 0xf11093f0,
    3776     + 0xf1300287,
    3777     + 0xf9800083,
    3778     + 0xfc80f990,
    3779     0xf4e0fcd0,
    3780     - 0xa7f14021,
    3781     - 0xa3f0053c,
    3782     - 0x0287f110,
    3783     - 0x0083f130,
    3784     - 0xf9a0f980,
    3785     - 0xfcd0fc80,
    3786     - 0x4021f4e0,
    3787     - 0x0560e7f1,
    3788     - 0xf110e3f0,
    3789     - 0xf10000d7,
    3790     - 0xb98000d3,
    3791     - 0xb7f102dc,
    3792     - 0xb3f02710,
    3793     - 0xa321f400,
    3794     - 0xf402eeb9,
    3795     - 0xddb90421,
    3796     - 0x949dff02,
    3797     + 0xe7f14021,
    3798     + 0xe3f00560,
    3799     + 0x00d7f110,
    3800     + 0x00d3f100,
    3801     + 0x00dc9080,
    3802     + 0x8480b7f1,
    3803     + 0xf41eb3f0,
    3804     + 0x57f0a321,
    3805     + 0xff97f100,
    3806     + 0x0093f1ff,
    3807     +/* 0x072d: memx_func_train_loop_4x */
    3808     + 0x80a7f183,
    3809     + 0x10a3f000,
    3810     + 0xf402aeb9,
    3811     + 0xd8b90421,
    3812     + 0xdfb7f102,
    3813     + 0xffb3f1ff,
    3814     + 0x048bfdff,
    3815     + 0x80f9a0f9,
    3816     + 0xe0fcd0fc,
    3817     + 0xf14021f4,
    3818     + 0xf0053ca7,
    3819     + 0x87f110a3,
    3820     + 0x83f13002,
    3821     + 0xa0f98000,
    3822     + 0xd0fc80f9,
    3823     + 0x21f4e0fc,
    3824     + 0x60e7f140,
    3825     + 0x10e3f005,
    3826     + 0x0000d7f1,
    3827     + 0x8000d3f1,
    3828     + 0xf102dcb9,
    3829     + 0xf02710b7,
    3830     + 0x21f400b3,
    3831     + 0x02eeb9a3,
    3832     + 0xb90421f4,
    3833     + 0x9dff02dd,
    3834     + 0x0150b694,
    3835     + 0xf4045670,
    3836     + 0x7aa0921e,
    3837     + 0xa9800bcc,
    3838     + 0x0160b600,
    3839     + 0x700470b6,
    3840     + 0x1ef51066,
    3841     + 0x50fcff01,
    3842     0x700150b6,
    3843     - 0x1ef40456,
    3844     - 0xcc7aa092,
    3845     - 0x00a9800b,
    3846     - 0xb60160b6,
    3847     - 0x66700470,
    3848     - 0x001ef510,
    3849     - 0xb650fcff,
    3850     - 0x56700150,
    3851     - 0xd41ef507,
    3852     -/* 0x07c7: memx_exec */
    3853     - 0xf900f8fe,
    3854     - 0xb9d0f9e0,
    3855     - 0xb2b902c1,
    3856     -/* 0x07d1: memx_exec_next */
    3857     - 0x00139802,
    3858     - 0xe70410b6,
    3859     - 0xe701f034,
    3860     - 0xb601e033,
    3861     - 0x30f00132,
    3862     - 0xde35980c,
    3863     - 0x12b855f9,
    3864     - 0xe41ef406,
    3865     - 0x98f10b98,
    3866     - 0xcbbbf20c,
    3867     - 0xc4b7f102,
    3868     - 0x06b4b607,
    3869     - 0xfc00bbcf,
    3870     - 0xf5e0fcd0,
    3871     + 0x1ef50756,
    3872     + 0x00f8fed6,
    3873     +/* 0x07c0: memx_exec */
    3874     + 0xd0f9e0f9,
    3875     + 0xb902c1b9,
    3876     +/* 0x07ca: memx_exec_next */
    3877     + 0x139802b2,
    3878     + 0x0410b600,
    3879     + 0x01f034e7,
    3880     + 0x01e033e7,
    3881     + 0xf00132b6,
    3882     + 0x35980c30,
    3883     + 0xb855f9de,
    3884     + 0x1ef40612,
    3885     + 0xf10b98e4,
    3886     + 0xbbf20c98,
    3887     + 0xb7f102cb,
    3888     + 0xb4b607c4,
    3889     + 0x00bbcf06,
    3890     + 0xe0fcd0fc,
    3891     + 0x033621f5,
    3892     +/* 0x0806: memx_info */
    3893     + 0xc67000f8,
    3894     + 0x0e0bf401,
    3895     +/* 0x080c: memx_info_data */
    3896     + 0x03ccc7f1,
    3897     + 0x0800b7f1,
    3898     +/* 0x0817: memx_info_train */
    3899     + 0xf10b0ef4,
    3900     + 0xf10bccc7,
    3901     +/* 0x081f: memx_info_send */
    3902     + 0xf50100b7,
    3903     0xf8033621,
    3904     -/* 0x080d: memx_info */
    3905     - 0x01c67000,
    3906     -/* 0x0813: memx_info_data */
    3907     - 0xf10e0bf4,
    3908     - 0xf103ccc7,
    3909     - 0xf40800b7,
    3910     -/* 0x081e: memx_info_train */
    3911     - 0xc7f10b0e,
    3912     - 0xb7f10bcc,
    3913     -/* 0x0826: memx_info_send */
    3914     - 0x21f50100,
    3915     - 0x00f80336,
    3916     -/* 0x082c: memx_recv */
    3917     - 0xf401d6b0,
    3918     - 0xd6b0980b,
    3919     - 0xd80bf400,
    3920     -/* 0x083a: memx_init */
    3921     - 0x00f800f8,
    3922     -/* 0x083c: perf_recv */
    3923     -/* 0x083e: perf_init */
    3924     - 0x00f800f8,
    3925     -/* 0x0840: i2c_drive_scl */
    3926     - 0xf40036b0,
    3927     - 0x07f1110b,
    3928     - 0x04b607e0,
    3929     - 0x0001d006,
    3930     - 0x00f804bd,
    3931     -/* 0x0854: i2c_drive_scl_lo */
    3932     - 0x07e407f1,
    3933     - 0xd00604b6,
    3934     - 0x04bd0001,
    3935     -/* 0x0862: i2c_drive_sda */
    3936     - 0x36b000f8,
    3937     - 0x110bf400,
    3938     - 0x07e007f1,
    3939     - 0xd00604b6,
    3940     - 0x04bd0002,
    3941     -/* 0x0876: i2c_drive_sda_lo */
    3942     - 0x07f100f8,
    3943     - 0x04b607e4,
    3944     - 0x0002d006,
    3945     - 0x00f804bd,
    3946     -/* 0x0884: i2c_sense_scl */
    3947     - 0xf10132f4,
    3948     - 0xb607c437,
    3949     - 0x33cf0634,
    3950     - 0x0431fd00,
    3951     - 0xf4060bf4,
    3952     -/* 0x089a: i2c_sense_scl_done */
    3953     - 0x00f80131,
    3954     -/* 0x089c: i2c_sense_sda */
    3955     - 0xf10132f4,
    3956     - 0xb607c437,
    3957     - 0x33cf0634,
    3958     - 0x0432fd00,
    3959     - 0xf4060bf4,
    3960     -/* 0x08b2: i2c_sense_sda_done */
    3961     - 0x00f80131,
    3962     -/* 0x08b4: i2c_raise_scl */
    3963     - 0x47f140f9,
    3964     - 0x37f00898,
    3965     - 0x4021f501,
    3966     -/* 0x08c1: i2c_raise_scl_wait */
    3967     +/* 0x0825: memx_recv */
    3968     + 0x01d6b000,
    3969     + 0xb0980bf4,
    3970     + 0x0bf400d6,
    3971     +/* 0x0833: memx_init */
    3972     + 0xf800f8d8,
    3973     +/* 0x0835: perf_recv */
    3974     +/* 0x0837: perf_init */
    3975     + 0xf800f800,
    3976     +/* 0x0839: i2c_drive_scl */
    3977     + 0x0036b000,
    3978     + 0xf1110bf4,
    3979     + 0xb607e007,
    3980     + 0x01d00604,
    3981     + 0xf804bd00,
    3982     +/* 0x084d: i2c_drive_scl_lo */
    3983     + 0xe407f100,
    3984     + 0x0604b607,
    3985     + 0xbd0001d0,
    3986     +/* 0x085b: i2c_drive_sda */
    3987     + 0xb000f804,
    3988     + 0x0bf40036,
    3989     + 0xe007f111,
    3990     + 0x0604b607,
    3991     + 0xbd0002d0,
    3992     +/* 0x086f: i2c_drive_sda_lo */
    3993     + 0xf100f804,
    3994     + 0xb607e407,
    3995     + 0x02d00604,
    3996     + 0xf804bd00,
    3997     +/* 0x087d: i2c_sense_scl */
    3998     + 0x0132f400,
    3999     + 0x07c437f1,
    4000     + 0xcf0634b6,
    4001     + 0x31fd0033,
    4002     + 0x060bf404,
    4003     +/* 0x0893: i2c_sense_scl_done */
    4004     + 0xf80131f4,
    4005     +/* 0x0895: i2c_sense_sda */
    4006     + 0x0132f400,
    4007     + 0x07c437f1,
    4008     + 0xcf0634b6,
    4009     + 0x32fd0033,
    4010     + 0x060bf404,
    4011     +/* 0x08ab: i2c_sense_sda_done */
    4012     + 0xf80131f4,
    4013     +/* 0x08ad: i2c_raise_scl */
    4014     + 0xf140f900,
    4015     + 0xf0089847,
    4016     + 0x21f50137,
    4017     +/* 0x08ba: i2c_raise_scl_wait */
    4018     + 0xe7f10839,
    4019     + 0x21f403e8,
    4020     + 0x7d21f57e,
    4021     + 0x0901f408,
    4022     + 0xf40142b6,
    4023     +/* 0x08ce: i2c_raise_scl_done */
    4024     + 0x40fcef1b,
    4025     +/* 0x08d2: i2c_start */
    4026     + 0x21f500f8,
    4027     + 0x11f4087d,
    4028     + 0x9521f50d,
    4029     + 0x0611f408,
    4030     +/* 0x08e3: i2c_start_rep */
    4031     + 0xf0300ef4,
    4032     + 0x21f50037,
    4033     + 0x37f00839,
    4034     + 0x5b21f501,
    4035     + 0x0076bb08,
    4036     + 0xf90465b6,
    4037     + 0x04659450,
    4038     + 0xbd0256bb,
    4039     + 0x0475fd50,
    4040     + 0x21f550fc,
    4041     + 0x64b608ad,
    4042     + 0x1f11f404,
    4043     +/* 0x0910: i2c_start_send */
    4044     + 0xf50037f0,
    4045     + 0xf1085b21,
    4046     + 0xf41388e7,
    4047     + 0x37f07e21,
    4048     + 0x3921f500,
    4049     + 0x88e7f108,
    4050     + 0x7e21f413,
    4051     +/* 0x092c: i2c_start_out */
    4052     +/* 0x092e: i2c_stop */
    4053     + 0x37f000f8,
    4054     + 0x3921f500,
    4055     + 0x0037f008,
    4056     + 0x085b21f5,
    4057     + 0x03e8e7f1,
    4058     + 0xf07e21f4,
    4059     + 0x21f50137,
    4060     + 0xe7f10839,
    4061     + 0x21f41388,
    4062     + 0x0137f07e,
    4063     + 0x085b21f5,
    4064     + 0x1388e7f1,
    4065     + 0xf87e21f4,
    4066     +/* 0x0961: i2c_bitw */
    4067     + 0x5b21f500,
    4068     0xe8e7f108,
    4069     0x7e21f403,
    4070     - 0x088421f5,
    4071     - 0xb60901f4,
    4072     - 0x1bf40142,
    4073     -/* 0x08d5: i2c_raise_scl_done */
    4074     - 0xf840fcef,
    4075     -/* 0x08d9: i2c_start */
    4076     - 0x8421f500,
    4077     - 0x0d11f408,
    4078     - 0x089c21f5,
    4079     - 0xf40611f4,
    4080     -/* 0x08ea: i2c_start_rep */
    4081     - 0x37f0300e,
    4082     - 0x4021f500,
    4083     - 0x0137f008,
    4084     - 0x086221f5,
    4085     0xb60076bb,
    4086     0x50f90465,
    4087     0xbb046594,
    4088     0x50bd0256,
    4089     0xfc0475fd,
    4090     - 0xb421f550,
    4091     + 0xad21f550,
    4092     0x0464b608,
    4093     -/* 0x0917: i2c_start_send */
    4094     - 0xf01f11f4,
    4095     - 0x21f50037,
    4096     - 0xe7f10862,
    4097     - 0x21f41388,
    4098     - 0x0037f07e,
    4099     - 0x084021f5,
    4100     - 0x1388e7f1,
    4101     -/* 0x0933: i2c_start_out */
    4102     - 0xf87e21f4,
    4103     -/* 0x0935: i2c_stop */
    4104     - 0x0037f000,
    4105     - 0x084021f5,
    4106     - 0xf50037f0,
    4107     - 0xf1086221,
    4108     - 0xf403e8e7,
    4109     + 0xf11811f4,
    4110     + 0xf41388e7,
    4111     0x37f07e21,
    4112     - 0x4021f501,
    4113     + 0x3921f500,
    4114     0x88e7f108,
    4115     0x7e21f413,
    4116     - 0xf50137f0,
    4117     - 0xf1086221,
    4118     - 0xf41388e7,
    4119     - 0x00f87e21,
    4120     -/* 0x0968: i2c_bitw */
    4121     - 0x086221f5,
    4122     - 0x03e8e7f1,
    4123     - 0xbb7e21f4,
    4124     - 0x65b60076,
    4125     - 0x9450f904,
    4126     - 0x56bb0465,
    4127     - 0xfd50bd02,
    4128     - 0x50fc0475,
    4129     - 0x08b421f5,
    4130     - 0xf40464b6,
    4131     - 0xe7f11811,
    4132     +/* 0x09a0: i2c_bitw_out */
    4133     +/* 0x09a2: i2c_bitr */
    4134     + 0x37f000f8,
    4135     + 0x5b21f501,
    4136     + 0xe8e7f108,
    4137     + 0x7e21f403,
    4138     + 0xb60076bb,
    4139     + 0x50f90465,
    4140     + 0xbb046594,
    4141     + 0x50bd0256,
    4142     + 0xfc0475fd,
    4143     + 0xad21f550,
    4144     + 0x0464b608,
    4145     + 0xf51b11f4,
    4146     + 0xf0089521,
    4147     + 0x21f50037,
    4148     + 0xe7f10839,
    4149     0x21f41388,
    4150     - 0x0037f07e,
    4151     - 0x084021f5,
    4152     - 0x1388e7f1,
    4153     -/* 0x09a7: i2c_bitw_out */
    4154     - 0xf87e21f4,
    4155     -/* 0x09a9: i2c_bitr */
    4156     - 0x0137f000,
    4157     - 0x086221f5,
    4158     - 0x03e8e7f1,
    4159     - 0xbb7e21f4,
    4160     - 0x65b60076,
    4161     - 0x9450f904,
    4162     - 0x56bb0465,
    4163     - 0xfd50bd02,
    4164     - 0x50fc0475,
    4165     - 0x08b421f5,
    4166     - 0xf40464b6,
    4167     - 0x21f51b11,
    4168     - 0x37f0089c,
    4169     - 0x4021f500,
    4170     - 0x88e7f108,
    4171     - 0x7e21f413,
    4172     - 0xf4013cf0,
    4173     -/* 0x09ee: i2c_bitr_done */
    4174     - 0x00f80131,
    4175     -/* 0x09f0: i2c_get_byte */
    4176     - 0xf00057f0,
    4177     -/* 0x09f6: i2c_get_byte_next */
    4178     - 0x54b60847,
    4179     + 0x013cf07e,
    4180     +/* 0x09e7: i2c_bitr_done */
    4181     + 0xf80131f4,
    4182     +/* 0x09e9: i2c_get_byte */
    4183     + 0x0057f000,
    4184     +/* 0x09ef: i2c_get_byte_next */
    4185     + 0xb60847f0,
    4186     + 0x76bb0154,
    4187     + 0x0465b600,
    4188     + 0x659450f9,
    4189     + 0x0256bb04,
    4190     + 0x75fd50bd,
    4191     + 0xf550fc04,
    4192     + 0xb609a221,
    4193     + 0x11f40464,
    4194     + 0x0553fd2b,
    4195     + 0xf40142b6,
    4196     + 0x37f0d81b,
    4197     0x0076bb01,
    4198     0xf90465b6,
    4199     0x04659450,
    4200     0xbd0256bb,
    4201     0x0475fd50,
    4202     0x21f550fc,
    4203     - 0x64b609a9,
    4204     - 0x2b11f404,
    4205     - 0xb60553fd,
    4206     - 0x1bf40142,
    4207     - 0x0137f0d8,
    4208     - 0xb60076bb,
    4209     - 0x50f90465,
    4210     - 0xbb046594,
    4211     - 0x50bd0256,
    4212     - 0xfc0475fd,
    4213     - 0x6821f550,
    4214     - 0x0464b609,
    4215     -/* 0x0a40: i2c_get_byte_done */
    4216     -/* 0x0a42: i2c_put_byte */
    4217     - 0x47f000f8,
    4218     -/* 0x0a45: i2c_put_byte_next */
    4219     - 0x0142b608,
    4220     - 0xbb3854ff,
    4221     - 0x65b60076,
    4222     - 0x9450f904,
    4223     - 0x56bb0465,
    4224     - 0xfd50bd02,
    4225     - 0x50fc0475,
    4226     - 0x096821f5,
    4227     - 0xf40464b6,
    4228     - 0x46b03411,
    4229     - 0xd81bf400,
    4230     + 0x64b60961,
    4231     +/* 0x0a39: i2c_get_byte_done */
    4232     +/* 0x0a3b: i2c_put_byte */
    4233     + 0xf000f804,
    4234     +/* 0x0a3e: i2c_put_byte_next */
    4235     + 0x42b60847,
    4236     + 0x3854ff01,
    4237     0xb60076bb,
    4238     0x50f90465,
    4239     0xbb046594,
    4240     0x50bd0256,
    4241     0xfc0475fd,
    4242     - 0xa921f550,
    4243     + 0x6121f550,
    4244     0x0464b609,
    4245     - 0xbb0f11f4,
    4246     - 0x36b00076,
    4247     - 0x061bf401,
    4248     -/* 0x0a9b: i2c_put_byte_done */
    4249     - 0xf80132f4,
    4250     -/* 0x0a9d: i2c_addr */
    4251     - 0x0076bb00,
    4252     + 0xb03411f4,
    4253     + 0x1bf40046,
    4254     + 0x0076bbd8,
    4255     0xf90465b6,
    4256     0x04659450,
    4257     0xbd0256bb,
    4258     0x0475fd50,
    4259     0x21f550fc,
    4260     - 0x64b608d9,
    4261     - 0x2911f404,
    4262     - 0x012ec3e7,
    4263     - 0xfd0134b6,
    4264     - 0x76bb0553,
    4265     + 0x64b609a2,
    4266     + 0x0f11f404,
    4267     + 0xb00076bb,
    4268     + 0x1bf40136,
    4269     + 0x0132f406,
    4270     +/* 0x0a94: i2c_put_byte_done */
    4271     +/* 0x0a96: i2c_addr */
    4272     + 0x76bb00f8,
    4273     0x0465b600,
    4274     0x659450f9,
    4275     0x0256bb04,
    4276     0x75fd50bd,
    4277     0xf550fc04,
    4278     - 0xb60a4221,
    4279     -/* 0x0ae2: i2c_addr_done */
    4280     - 0x00f80464,
    4281     -/* 0x0ae4: i2c_acquire_addr */
    4282     - 0xb6f8cec7,
    4283     - 0xe0b702e4,
    4284     - 0xee980d1c,
    4285     -/* 0x0af3: i2c_acquire */
    4286     - 0xf500f800,
    4287     - 0xf40ae421,
    4288     - 0xd9f00421,
    4289     - 0x4021f403,
    4290     -/* 0x0b02: i2c_release */
    4291     - 0x21f500f8,
    4292     - 0x21f40ae4,
    4293     - 0x03daf004,
    4294     - 0xf84021f4,
    4295     -/* 0x0b11: i2c_recv */
    4296     - 0x0132f400,
    4297     - 0xb6f8c1c7,
    4298     - 0x16b00214,
    4299     - 0x3a1ff528,
    4300     - 0xf413a001,
    4301     - 0x0032980c,
    4302     - 0x0ccc13a0,
    4303     - 0xf4003198,
    4304     - 0xd0f90231,
    4305     - 0xd0f9e0f9,
    4306     - 0x000067f1,
    4307     - 0x100063f1,
    4308     - 0xbb016792,
    4309     + 0xb608d221,
    4310     + 0x11f40464,
    4311     + 0x2ec3e729,
    4312     + 0x0134b601,
    4313     + 0xbb0553fd,
    4314     0x65b60076,
    4315     0x9450f904,
    4316     0x56bb0465,
    4317     0xfd50bd02,
    4318     0x50fc0475,
    4319     - 0x0af321f5,
    4320     - 0xfc0464b6,
    4321     - 0x00d6b0d0,
    4322     - 0x00b31bf5,
    4323     - 0xbb0057f0,
    4324     + 0x0a3b21f5,
    4325     +/* 0x0adb: i2c_addr_done */
    4326     + 0xf80464b6,
    4327     +/* 0x0add: i2c_acquire_addr */
    4328     + 0xf8cec700,
    4329     + 0xb702e4b6,
    4330     + 0x980d1ce0,
    4331     + 0x00f800ee,
    4332     +/* 0x0aec: i2c_acquire */
    4333     + 0x0add21f5,
    4334     + 0xf00421f4,
    4335     + 0x21f403d9,
    4336     +/* 0x0afb: i2c_release */
    4337     + 0xf500f840,
    4338     + 0xf40add21,
    4339     + 0xdaf00421,
    4340     + 0x4021f403,
    4341     +/* 0x0b0a: i2c_recv */
    4342     + 0x32f400f8,
    4343     + 0xf8c1c701,
    4344     + 0xb00214b6,
    4345     + 0x1ff52816,
    4346     + 0x13a0013a,
    4347     + 0x32980cf4,
    4348     + 0xcc13a000,
    4349     + 0x0031980c,
    4350     + 0xf90231f4,
    4351     + 0xf9e0f9d0,
    4352     + 0x0067f1d0,
    4353     + 0x0063f100,
    4354     + 0x01679210,
    4355     + 0xb60076bb,
    4356     + 0x50f90465,
    4357     + 0xbb046594,
    4358     + 0x50bd0256,
    4359     + 0xfc0475fd,
    4360     + 0xec21f550,
    4361     + 0x0464b60a,
    4362     + 0xd6b0d0fc,
    4363     + 0xb31bf500,
    4364     + 0x0057f000,
    4365     + 0xb60076bb,
    4366     + 0x50f90465,
    4367     + 0xbb046594,
    4368     + 0x50bd0256,
    4369     + 0xfc0475fd,
    4370     + 0x9621f550,
    4371     + 0x0464b60a,
    4372     + 0x00d011f5,
    4373     + 0xbbe0c5c7,
    4374     0x65b60076,
    4375     0x9450f904,
    4376     0x56bb0465,
    4377     0xfd50bd02,
    4378     0x50fc0475,
    4379     - 0x0a9d21f5,
    4380     + 0x0a3b21f5,
    4381     0xf50464b6,
    4382     - 0xc700d011,
    4383     - 0x76bbe0c5,
    4384     + 0xf000ad11,
    4385     + 0x76bb0157,
    4386     0x0465b600,
    4387     0x659450f9,
    4388     0x0256bb04,
    4389     0x75fd50bd,
    4390     0xf550fc04,
    4391     - 0xb60a4221,
    4392     + 0xb60a9621,
    4393     0x11f50464,
    4394     - 0x57f000ad,
    4395     - 0x0076bb01,
    4396     - 0xf90465b6,
    4397     - 0x04659450,
    4398     - 0xbd0256bb,
    4399     - 0x0475fd50,
    4400     - 0x21f550fc,
    4401     - 0x64b60a9d,
    4402     - 0x8a11f504,
    4403     - 0x0076bb00,
    4404     - 0xf90465b6,
    4405     - 0x04659450,
    4406     - 0xbd0256bb,
    4407     - 0x0475fd50,
    4408     - 0x21f550fc,
    4409     - 0x64b609f0,
    4410     - 0x6a11f404,
    4411     - 0xbbe05bcb,
    4412     - 0x65b60076,
    4413     - 0x9450f904,
    4414     - 0x56bb0465,
    4415     - 0xfd50bd02,
    4416     - 0x50fc0475,
    4417     - 0x093521f5,
    4418     - 0xb90464b6,
    4419     - 0x74bd025b,
    4420     -/* 0x0c17: i2c_recv_not_rd08 */
    4421     - 0xb0430ef4,
    4422     - 0x1bf401d6,
    4423     - 0x0057f03d,
    4424     - 0x0a9d21f5,
    4425     - 0xc73311f4,
    4426     - 0x21f5e0c5,
    4427     - 0x11f40a42,
    4428     - 0x0057f029,
    4429     - 0x0a9d21f5,
    4430     - 0xc71f11f4,
    4431     - 0x21f5e0b5,
    4432     - 0x11f40a42,
    4433     - 0x3521f515,
    4434     - 0xc774bd09,
    4435     - 0x1bf408c5,
    4436     - 0x0232f409,
    4437     -/* 0x0c57: i2c_recv_not_wr08 */
    4438     -/* 0x0c57: i2c_recv_done */
    4439     - 0xc7030ef4,
    4440     - 0x21f5f8ce,
    4441     - 0xe0fc0b02,
    4442     - 0x12f4d0fc,
    4443     - 0x027cb90a,
    4444     - 0x033621f5,
    4445     -/* 0x0c6c: i2c_recv_exit */
    4446     -/* 0x0c6e: i2c_init */
    4447     + 0x76bb008a,
    4448     + 0x0465b600,
    4449     + 0x659450f9,
    4450     + 0x0256bb04,
    4451     + 0x75fd50bd,
    4452     + 0xf550fc04,
    4453     + 0xb609e921,
    4454     + 0x11f40464,
    4455     + 0xe05bcb6a,
    4456     + 0xb60076bb,
    4457     + 0x50f90465,
    4458     + 0xbb046594,
    4459     + 0x50bd0256,
    4460     + 0xfc0475fd,
    4461     + 0x2e21f550,
    4462     + 0x0464b609,
    4463     + 0xbd025bb9,
    4464     + 0x430ef474,
    4465     +/* 0x0c10: i2c_recv_not_rd08 */
    4466     + 0xf401d6b0,
    4467     + 0x57f03d1b,
    4468     + 0x9621f500,
    4469     + 0x3311f40a,
    4470     + 0xf5e0c5c7,
    4471     + 0xf40a3b21,
    4472     + 0x57f02911,
    4473     + 0x9621f500,
    4474     + 0x1f11f40a,
    4475     + 0xf5e0b5c7,
    4476     + 0xf40a3b21,
    4477     + 0x21f51511,
    4478     + 0x74bd092e,
    4479     + 0xf408c5c7,
    4480     + 0x32f4091b,
    4481     + 0x030ef402,
    4482     +/* 0x0c50: i2c_recv_not_wr08 */
    4483     +/* 0x0c50: i2c_recv_done */
    4484     + 0xf5f8cec7,
    4485     + 0xfc0afb21,
    4486     + 0xf4d0fce0,
    4487     + 0x7cb90a12,
    4488     + 0x3621f502,
    4489     +/* 0x0c65: i2c_recv_exit */
    4490     +/* 0x0c67: i2c_init */
    4491     + 0xf800f803,
    4492     +/* 0x0c69: test_recv */
    4493     + 0xd817f100,
    4494     + 0x0614b605,
    4495     + 0xb60011cf,
    4496     + 0x07f10110,
    4497     + 0x04b605d8,
    4498     + 0x0001d006,
    4499     + 0xe7f104bd,
    4500     + 0xe3f1d900,
    4501     + 0x21f5134f,
    4502     + 0x00f80256,
    4503     +/* 0x0c90: test_init */
    4504     + 0x0800e7f1,
    4505     + 0x025621f5,
    4506     +/* 0x0c9a: idle_recv */
    4507     0x00f800f8,
    4508     -/* 0x0c70: test_recv */
    4509     - 0x05d817f1,
    4510     - 0xcf0614b6,
    4511     - 0x10b60011,
    4512     - 0xd807f101,
    4513     - 0x0604b605,
    4514     - 0xbd0001d0,
    4515     - 0x00e7f104,
    4516     - 0x4fe3f1d9,
    4517     - 0x5621f513,
    4518     -/* 0x0c97: test_init */
    4519     - 0xf100f802,
    4520     - 0xf50800e7,
    4521     - 0xf8025621,
    4522     -/* 0x0ca1: idle_recv */
    4523     -/* 0x0ca3: idle */
    4524     - 0xf400f800,
    4525     - 0x17f10031,
    4526     - 0x14b605d4,
    4527     - 0x0011cf06,
    4528     - 0xf10110b6,
    4529     - 0xb605d407,
    4530     - 0x01d00604,
    4531     -/* 0x0cbf: idle_loop */
    4532     - 0xf004bd00,
    4533     - 0x32f45817,
    4534     -/* 0x0cc5: idle_proc */
    4535     -/* 0x0cc5: idle_proc_exec */
    4536     - 0xb910f902,
    4537     - 0x21f5021e,
    4538     - 0x10fc033f,
    4539     - 0xf40911f4,
    4540     - 0x0ef40231,
    4541     -/* 0x0cd9: idle_proc_next */
    4542     - 0x5810b6ef,
    4543     - 0xf4061fb8,
    4544     - 0x02f4e61b,
    4545     - 0x0028f4dd,
    4546     - 0x00bb0ef4,
    4547     +/* 0x0c9c: idle */
    4548     + 0xf10031f4,
    4549     + 0xb605d417,
    4550     + 0x11cf0614,
    4551     + 0x0110b600,
    4552     + 0x05d407f1,
    4553     + 0xd00604b6,
    4554     + 0x04bd0001,
    4555     +/* 0x0cb8: idle_loop */
    4556     + 0xf45817f0,
    4557     +/* 0x0cbe: idle_proc */
    4558     +/* 0x0cbe: idle_proc_exec */
    4559     + 0x10f90232,
    4560     + 0xf5021eb9,
    4561     + 0xfc033f21,
    4562     + 0x0911f410,
    4563     + 0xf40231f4,
    4564     +/* 0x0cd2: idle_proc_next */
    4565     + 0x10b6ef0e,
    4566     + 0x061fb858,
    4567     + 0xf4e61bf4,
    4568     + 0x28f4dd02,
    4569     + 0xbb0ef400,
    4570     + 0x00000000,
    4571     + 0x00000000,
    4572     0x00000000,
    4573     0x00000000,
    4574     0x00000000,
    4575     diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
    4576     index ec03f9a4290b..1663bf943d77 100644
    4577     --- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
    4578     +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc
    4579     @@ -82,15 +82,15 @@ memx_train_tail:
    4580     // $r0 - zero
    4581     memx_func_enter:
    4582     #if NVKM_PPWR_CHIPSET == GT215
    4583     - movw $r8 0x1610
    4584     + mov $r8 0x1610
    4585     nv_rd32($r7, $r8)
    4586     imm32($r6, 0xfffffffc)
    4587     and $r7 $r6
    4588     - movw $r6 0x2
    4589     + mov $r6 0x2
    4590     or $r7 $r6
    4591     nv_wr32($r8, $r7)
    4592     #else
    4593     - movw $r6 0x001620
    4594     + mov $r6 0x001620
    4595     imm32($r7, ~0x00000aa2);
    4596     nv_rd32($r8, $r6)
    4597     and $r8 $r7
    4598     @@ -101,7 +101,7 @@ memx_func_enter:
    4599     and $r8 $r7
    4600     nv_wr32($r6, $r8)
    4601    
    4602     - movw $r6 0x0026f0
    4603     + mov $r6 0x0026f0
    4604     nv_rd32($r8, $r6)
    4605     and $r8 $r7
    4606     nv_wr32($r6, $r8)
    4607     @@ -136,19 +136,19 @@ memx_func_leave:
    4608     bra nz #memx_func_leave_wait
    4609    
    4610     #if NVKM_PPWR_CHIPSET == GT215
    4611     - movw $r8 0x1610
    4612     + mov $r8 0x1610
    4613     nv_rd32($r7, $r8)
    4614     imm32($r6, 0xffffffcc)
    4615     and $r7 $r6
    4616     nv_wr32($r8, $r7)
    4617     #else
    4618     - movw $r6 0x0026f0
    4619     + mov $r6 0x0026f0
    4620     imm32($r7, 0x00000001)
    4621     nv_rd32($r8, $r6)
    4622     or $r8 $r7
    4623     nv_wr32($r6, $r8)
    4624    
    4625     - movw $r6 0x001620
    4626     + mov $r6 0x001620
    4627     nv_rd32($r8, $r6)
    4628     or $r8 $r7
    4629     nv_wr32($r6, $r8)
    4630     @@ -177,11 +177,11 @@ memx_func_wait_vblank:
    4631     bra #memx_func_wait_vblank_fini
    4632    
    4633     memx_func_wait_vblank_head1:
    4634     - movw $r7 0x20
    4635     + mov $r7 0x20
    4636     bra #memx_func_wait_vblank_0
    4637    
    4638     memx_func_wait_vblank_head0:
    4639     - movw $r7 0x8
    4640     + mov $r7 0x8
    4641    
    4642     memx_func_wait_vblank_0:
    4643     nv_iord($r6, NV_PPWR_INPUT)
    4644     @@ -273,13 +273,13 @@ memx_func_train:
    4645     // $r5 - outer loop counter
    4646     // $r6 - inner loop counter
    4647     // $r7 - entry counter (#memx_train_head + $r7)
    4648     - movw $r5 0x3
    4649     - movw $r7 0x0
    4650     + mov $r5 0x3
    4651     + mov $r7 0x0
    4652    
    4653     // Read random memory to wake up... things
    4654     imm32($r9, 0x700000)
    4655     nv_rd32($r8,$r9)
    4656     - movw $r14 0x2710
    4657     + mov $r14 0x2710
    4658     call(nsec)
    4659    
    4660     memx_func_train_loop_outer:
    4661     @@ -289,9 +289,9 @@ memx_func_train:
    4662     nv_wr32($r9, $r8)
    4663     push $r5
    4664    
    4665     - movw $r6 0x0
    4666     + mov $r6 0x0
    4667     memx_func_train_loop_inner:
    4668     - movw $r8 0x1111
    4669     + mov $r8 0x1111
    4670     mulu $r9 $r6 $r8
    4671     shl b32 $r8 $r9 0x10
    4672     or $r8 $r9
    4673     @@ -315,7 +315,7 @@ memx_func_train:
    4674    
    4675     // $r5 - inner inner loop counter
    4676     // $r9 - result
    4677     - movw $r5 0
    4678     + mov $r5 0
    4679     imm32($r9, 0x8300ffff)
    4680     memx_func_train_loop_4x:
    4681     imm32($r10, 0x100080)
    4682     diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
    4683     index 3afdbf4bc10b..eff0a8ece8bc 100644
    4684     --- a/drivers/gpu/drm/vc4/vc4_bo.c
    4685     +++ b/drivers/gpu/drm/vc4/vc4_bo.c
    4686     @@ -173,6 +173,7 @@ static void vc4_bo_destroy(struct vc4_bo *bo)
    4687     vc4_bo_set_label(obj, -1);
    4688    
    4689     if (bo->validated_shader) {
    4690     + kfree(bo->validated_shader->uniform_addr_offsets);
    4691     kfree(bo->validated_shader->texture_samples);
    4692     kfree(bo->validated_shader);
    4693     bo->validated_shader = NULL;
    4694     @@ -432,6 +433,7 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
    4695     }
    4696    
    4697     if (bo->validated_shader) {
    4698     + kfree(bo->validated_shader->uniform_addr_offsets);
    4699     kfree(bo->validated_shader->texture_samples);
    4700     kfree(bo->validated_shader);
    4701     bo->validated_shader = NULL;
    4702     diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
    4703     index d3f15bf60900..7cf82b071de2 100644
    4704     --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
    4705     +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
    4706     @@ -942,6 +942,7 @@ vc4_validate_shader(struct drm_gem_cma_object *shader_obj)
    4707     fail:
    4708     kfree(validation_state.branch_targets);
    4709     if (validated_shader) {
    4710     + kfree(validated_shader->uniform_addr_offsets);
    4711     kfree(validated_shader->texture_samples);
    4712     kfree(validated_shader);
    4713     }
    4714     diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
    4715     index 43617fb28b87..317c9c2c0a7c 100644
    4716     --- a/drivers/hid/hid-roccat-kovaplus.c
    4717     +++ b/drivers/hid/hid-roccat-kovaplus.c
    4718     @@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(uint value)
    4719     static void kovaplus_profile_activated(struct kovaplus_device *kovaplus,
    4720     uint new_profile_index)
    4721     {
    4722     + if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings))
    4723     + return;
    4724     kovaplus->actual_profile = new_profile_index;
    4725     kovaplus->actual_cpi = kovaplus->profile_settings[new_profile_index].cpi_startup_level;
    4726     kovaplus->actual_x_sensitivity = kovaplus->profile_settings[new_profile_index].sensitivity_x;
    4727     diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    4728     index 25de7cc9f49f..6c725c435f5d 100644
    4729     --- a/drivers/infiniband/core/cma.c
    4730     +++ b/drivers/infiniband/core/cma.c
    4731     @@ -624,11 +624,13 @@ static inline int cma_validate_port(struct ib_device *device, u8 port,
    4732     if ((dev_type != ARPHRD_INFINIBAND) && rdma_protocol_ib(device, port))
    4733     return ret;
    4734    
    4735     - if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port))
    4736     + if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) {
    4737     ndev = dev_get_by_index(&init_net, bound_if_index);
    4738     - else
    4739     + if (!ndev)
    4740     + return ret;
    4741     + } else {
    4742     gid_type = IB_GID_TYPE_IB;
    4743     -
    4744     + }
    4745    
    4746     ret = ib_find_cached_gid_by_port(device, gid, gid_type, port,
    4747     ndev, NULL);
    4748     diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
    4749     index f2ae75fa3128..757d308bebe8 100644
    4750     --- a/drivers/infiniband/core/cq.c
    4751     +++ b/drivers/infiniband/core/cq.c
    4752     @@ -17,6 +17,7 @@
    4753    
    4754     /* # of WCs to poll for with a single call to ib_poll_cq */
    4755     #define IB_POLL_BATCH 16
    4756     +#define IB_POLL_BATCH_DIRECT 8
    4757    
    4758     /* # of WCs to iterate over before yielding */
    4759     #define IB_POLL_BUDGET_IRQ 256
    4760     @@ -25,7 +26,8 @@
    4761     #define IB_POLL_FLAGS \
    4762     (IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS)
    4763    
    4764     -static int __ib_process_cq(struct ib_cq *cq, int budget)
    4765     +static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs,
    4766     + int batch)
    4767     {
    4768     int i, n, completed = 0;
    4769    
    4770     @@ -34,10 +36,10 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
    4771     * want to bound this call, thus we need unsigned
    4772     * minimum here.
    4773     */
    4774     - while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH,
    4775     - budget - completed), cq->wc)) > 0) {
    4776     + while ((n = ib_poll_cq(cq, min_t(u32, batch,
    4777     + budget - completed), wcs)) > 0) {
    4778     for (i = 0; i < n; i++) {
    4779     - struct ib_wc *wc = &cq->wc[i];
    4780     + struct ib_wc *wc = &wcs[i];
    4781    
    4782     if (wc->wr_cqe)
    4783     wc->wr_cqe->done(cq, wc);
    4784     @@ -47,8 +49,7 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
    4785    
    4786     completed += n;
    4787    
    4788     - if (n != IB_POLL_BATCH ||
    4789     - (budget != -1 && completed >= budget))
    4790     + if (n != batch || (budget != -1 && completed >= budget))
    4791     break;
    4792     }
    4793    
    4794     @@ -60,18 +61,20 @@ static int __ib_process_cq(struct ib_cq *cq, int budget)
    4795     * @cq: CQ to process
    4796     * @budget: number of CQEs to poll for
    4797     *
    4798     - * This function is used to process all outstanding CQ entries on a
    4799     - * %IB_POLL_DIRECT CQ. It does not offload CQ processing to a different
    4800     - * context and does not ask for completion interrupts from the HCA.
    4801     + * This function is used to process all outstanding CQ entries.
    4802     + * It does not offload CQ processing to a different context and does
    4803     + * not ask for completion interrupts from the HCA.
    4804     + * Using direct processing on CQ with non IB_POLL_DIRECT type may trigger
    4805     + * concurrent processing.
    4806     *
    4807     * Note: do not pass -1 as %budget unless it is guaranteed that the number
    4808     * of completions that will be processed is small.
    4809     */
    4810     int ib_process_cq_direct(struct ib_cq *cq, int budget)
    4811     {
    4812     - WARN_ON_ONCE(cq->poll_ctx != IB_POLL_DIRECT);
    4813     + struct ib_wc wcs[IB_POLL_BATCH_DIRECT];
    4814    
    4815     - return __ib_process_cq(cq, budget);
    4816     + return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT);
    4817     }
    4818     EXPORT_SYMBOL(ib_process_cq_direct);
    4819    
    4820     @@ -85,7 +88,7 @@ static int ib_poll_handler(struct irq_poll *iop, int budget)
    4821     struct ib_cq *cq = container_of(iop, struct ib_cq, iop);
    4822     int completed;
    4823    
    4824     - completed = __ib_process_cq(cq, budget);
    4825     + completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH);
    4826     if (completed < budget) {
    4827     irq_poll_complete(&cq->iop);
    4828     if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
    4829     @@ -105,7 +108,8 @@ static void ib_cq_poll_work(struct work_struct *work)
    4830     struct ib_cq *cq = container_of(work, struct ib_cq, work);
    4831     int completed;
    4832    
    4833     - completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE);
    4834     + completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc,
    4835     + IB_POLL_BATCH);
    4836     if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
    4837     ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
    4838     queue_work(ib_comp_wq, &cq->work);
    4839     diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
    4840     index 5286ad57d903..8f2dc79ad4ec 100644
    4841     --- a/drivers/infiniband/core/uverbs_ioctl.c
    4842     +++ b/drivers/infiniband/core/uverbs_ioctl.c
    4843     @@ -245,16 +245,13 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev,
    4844     uintptr_t data[UVERBS_OPTIMIZE_USING_STACK_SZ / sizeof(uintptr_t)];
    4845     #endif
    4846    
    4847     - if (hdr->reserved)
    4848     - return -EINVAL;
    4849     -
    4850     object_spec = uverbs_get_object(ib_dev, hdr->object_id);
    4851     if (!object_spec)
    4852     - return -EOPNOTSUPP;
    4853     + return -EPROTONOSUPPORT;
    4854    
    4855     method_spec = uverbs_get_method(object_spec, hdr->method_id);
    4856     if (!method_spec)
    4857     - return -EOPNOTSUPP;
    4858     + return -EPROTONOSUPPORT;
    4859    
    4860     if ((method_spec->flags & UVERBS_ACTION_FLAG_CREATE_ROOT) ^ !file->ucontext)
    4861     return -EINVAL;
    4862     @@ -310,6 +307,16 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev,
    4863    
    4864     err = uverbs_handle_method(buf, ctx->uattrs, hdr->num_attrs, ib_dev,
    4865     file, method_spec, ctx->uverbs_attr_bundle);
    4866     +
    4867     + /*
    4868     + * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
    4869     + * not invoke the method because the request is not supported. No
    4870     + * other cases should return this code.
    4871     + */
    4872     + if (unlikely(err == -EPROTONOSUPPORT)) {
    4873     + WARN_ON_ONCE(err == -EPROTONOSUPPORT);
    4874     + err = -EINVAL;
    4875     + }
    4876     out:
    4877     #ifdef UVERBS_OPTIMIZE_USING_STACK_SZ
    4878     if (ctx_size > UVERBS_OPTIMIZE_USING_STACK_SZ)
    4879     @@ -348,7 +355,7 @@ long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
    4880     }
    4881    
    4882     if (hdr.reserved) {
    4883     - err = -EOPNOTSUPP;
    4884     + err = -EPROTONOSUPPORT;
    4885     goto out;
    4886     }
    4887    
    4888     diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
    4889     index 0e17d03ef1cb..82114ba86041 100644
    4890     --- a/drivers/infiniband/hw/hfi1/chip.c
    4891     +++ b/drivers/infiniband/hw/hfi1/chip.c
    4892     @@ -8294,8 +8294,8 @@ static irqreturn_t sdma_interrupt(int irq, void *data)
    4893     /* handle the interrupt(s) */
    4894     sdma_engine_interrupt(sde, status);
    4895     } else {
    4896     - dd_dev_err_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n",
    4897     - sde->this_idx);
    4898     + dd_dev_info_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n",
    4899     + sde->this_idx);
    4900     }
    4901     return IRQ_HANDLED;
    4902     }
    4903     @@ -12967,7 +12967,14 @@ static void disable_intx(struct pci_dev *pdev)
    4904     pci_intx(pdev, 0);
    4905     }
    4906    
    4907     -static void clean_up_interrupts(struct hfi1_devdata *dd)
    4908     +/**
    4909     + * hfi1_clean_up_interrupts() - Free all IRQ resources
    4910     + * @dd: valid device data data structure
    4911     + *
    4912     + * Free the MSI or INTx IRQs and assoicated PCI resources,
    4913     + * if they have been allocated.
    4914     + */
    4915     +void hfi1_clean_up_interrupts(struct hfi1_devdata *dd)
    4916     {
    4917     int i;
    4918    
    4919     @@ -13344,7 +13351,7 @@ static int set_up_interrupts(struct hfi1_devdata *dd)
    4920     return 0;
    4921    
    4922     fail:
    4923     - clean_up_interrupts(dd);
    4924     + hfi1_clean_up_interrupts(dd);
    4925     return ret;
    4926     }
    4927    
    4928     @@ -14770,7 +14777,6 @@ void hfi1_start_cleanup(struct hfi1_devdata *dd)
    4929     aspm_exit(dd);
    4930     free_cntrs(dd);
    4931     free_rcverr(dd);
    4932     - clean_up_interrupts(dd);
    4933     finish_chip_resources(dd);
    4934     }
    4935    
    4936     @@ -15229,7 +15235,7 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev,
    4937     bail_free_cntrs:
    4938     free_cntrs(dd);
    4939     bail_clear_intr:
    4940     - clean_up_interrupts(dd);
    4941     + hfi1_clean_up_interrupts(dd);
    4942     bail_cleanup:
    4943     hfi1_pcie_ddcleanup(dd);
    4944     bail_free:
    4945     diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
    4946     index fd28f09b4445..ee2253d06984 100644
    4947     --- a/drivers/infiniband/hw/hfi1/file_ops.c
    4948     +++ b/drivers/infiniband/hw/hfi1/file_ops.c
    4949     @@ -191,9 +191,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
    4950     if (!atomic_inc_not_zero(&dd->user_refcount))
    4951     return -ENXIO;
    4952    
    4953     - /* Just take a ref now. Not all opens result in a context assign */
    4954     - kobject_get(&dd->kobj);
    4955     -
    4956     /* The real work is performed later in assign_ctxt() */
    4957    
    4958     fd = kzalloc(sizeof(*fd), GFP_KERNEL);
    4959     @@ -203,6 +200,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
    4960     fd->mm = current->mm;
    4961     mmgrab(fd->mm);
    4962     fd->dd = dd;
    4963     + kobject_get(&fd->dd->kobj);
    4964     fp->private_data = fd;
    4965     } else {
    4966     fp->private_data = NULL;
    4967     diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
    4968     index 3409eee16092..dc9c951ef946 100644
    4969     --- a/drivers/infiniband/hw/hfi1/hfi.h
    4970     +++ b/drivers/infiniband/hw/hfi1/hfi.h
    4971     @@ -1954,6 +1954,7 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd);
    4972     int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len);
    4973    
    4974     int hfi1_pcie_init(struct pci_dev *pdev, const struct pci_device_id *ent);
    4975     +void hfi1_clean_up_interrupts(struct hfi1_devdata *dd);
    4976     void hfi1_pcie_cleanup(struct pci_dev *pdev);
    4977     int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev);
    4978     void hfi1_pcie_ddcleanup(struct hfi1_devdata *);
    4979     diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
    4980     index fba77001c3a7..d4fc8795cdf6 100644
    4981     --- a/drivers/infiniband/hw/hfi1/init.c
    4982     +++ b/drivers/infiniband/hw/hfi1/init.c
    4983     @@ -1039,8 +1039,9 @@ static void shutdown_device(struct hfi1_devdata *dd)
    4984     }
    4985     dd->flags &= ~HFI1_INITTED;
    4986    
    4987     - /* mask interrupts, but not errors */
    4988     + /* mask and clean up interrupts, but not errors */
    4989     set_intr_state(dd, 0);
    4990     + hfi1_clean_up_interrupts(dd);
    4991    
    4992     for (pidx = 0; pidx < dd->num_pports; ++pidx) {
    4993     ppd = dd->pport + pidx;
    4994     @@ -1696,6 +1697,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
    4995     dd_dev_err(dd, "Failed to create /dev devices: %d\n", -j);
    4996    
    4997     if (initfail || ret) {
    4998     + hfi1_clean_up_interrupts(dd);
    4999     stop_timers(dd);
    5000     flush_workqueue(ib_wq);
    5001     for (pidx = 0; pidx < dd->num_pports; ++pidx) {
    5002     diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
    5003     index 14d38d733cb4..27a2d782f6d9 100644
    5004     --- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
    5005     +++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
    5006     @@ -48,7 +48,6 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid);
    5007     static void i40iw_ilq_putback_rcvbuf(struct i40iw_sc_qp *qp, u32 wqe_idx);
    5008     static enum i40iw_status_code i40iw_puda_replenish_rq(struct i40iw_puda_rsrc
    5009     *rsrc, bool initial);
    5010     -static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp);
    5011     /**
    5012     * i40iw_puda_get_listbuf - get buffer from puda list
    5013     * @list: list to use for buffers (ILQ or IEQ)
    5014     @@ -1480,7 +1479,7 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid)
    5015     * @ieq: ieq resource
    5016     * @qp: all pending fpdu buffers
    5017     */
    5018     -static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp)
    5019     +void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp)
    5020     {
    5021     struct i40iw_puda_buf *buf;
    5022     struct i40iw_pfpdu *pfpdu = &qp->pfpdu;
    5023     diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.h b/drivers/infiniband/hw/i40iw/i40iw_puda.h
    5024     index dba05ce7d392..ebe37f157d90 100644
    5025     --- a/drivers/infiniband/hw/i40iw/i40iw_puda.h
    5026     +++ b/drivers/infiniband/hw/i40iw/i40iw_puda.h
    5027     @@ -186,4 +186,5 @@ enum i40iw_status_code i40iw_cqp_qp_create_cmd(struct i40iw_sc_dev *dev, struct
    5028     enum i40iw_status_code i40iw_cqp_cq_create_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq);
    5029     void i40iw_cqp_qp_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp);
    5030     void i40iw_cqp_cq_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq);
    5031     +void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp);
    5032     #endif
    5033     diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
    5034     index 62be0a41ad0b..b7961f21b555 100644
    5035     --- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
    5036     +++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
    5037     @@ -428,6 +428,7 @@ void i40iw_free_qp_resources(struct i40iw_device *iwdev,
    5038     {
    5039     struct i40iw_pbl *iwpbl = &iwqp->iwpbl;
    5040    
    5041     + i40iw_ieq_cleanup_qp(iwdev->vsi.ieq, &iwqp->sc_qp);
    5042     i40iw_dealloc_push_page(iwdev, &iwqp->sc_qp);
    5043     if (qp_num)
    5044     i40iw_free_resource(iwdev, iwdev->allocated_qps, qp_num);
    5045     @@ -1655,6 +1656,7 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd,
    5046     err_code = -EOVERFLOW;
    5047     goto err;
    5048     }
    5049     + stag &= ~I40IW_CQPSQ_STAG_KEY_MASK;
    5050     iwmr->stag = stag;
    5051     iwmr->ibmr.rkey = stag;
    5052     iwmr->ibmr.lkey = stag;
    5053     diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
    5054     index c4d8cc1c2b1d..464c78f8cec9 100644
    5055     --- a/drivers/infiniband/hw/mlx5/qp.c
    5056     +++ b/drivers/infiniband/hw/mlx5/qp.c
    5057     @@ -2923,7 +2923,8 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp,
    5058     * If we moved a kernel QP to RESET, clean up all old CQ
    5059     * entries and reinitialize the QP.
    5060     */
    5061     - if (new_state == IB_QPS_RESET && !ibqp->uobject) {
    5062     + if (new_state == IB_QPS_RESET &&
    5063     + !ibqp->uobject && ibqp->qp_type != IB_QPT_XRC_TGT) {
    5064     mlx5_ib_cq_clean(recv_cq, base->mqp.qpn,
    5065     ibqp->srq ? to_msrq(ibqp->srq) : NULL);
    5066     if (send_cq != recv_cq)
    5067     @@ -4636,13 +4637,10 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd)
    5068     int err;
    5069    
    5070     err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn);
    5071     - if (err) {
    5072     + if (err)
    5073     mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn);
    5074     - return err;
    5075     - }
    5076    
    5077     kfree(xrcd);
    5078     -
    5079     return 0;
    5080     }
    5081    
    5082     diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    5083     index a009e943362a..6bc9a768f721 100644
    5084     --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
    5085     +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
    5086     @@ -2273,6 +2273,9 @@ static struct net_device *ipoib_add_port(const char *format,
    5087     priv->ca, ipoib_event);
    5088     ib_register_event_handler(&priv->event_handler);
    5089    
    5090     + /* call event handler to ensure pkey in sync */
    5091     + queue_work(ipoib_workqueue, &priv->flush_heavy);
    5092     +
    5093     result = register_netdev(priv->dev);
    5094     if (result) {
    5095     printk(KERN_WARNING "%s: couldn't register ipoib port %d; error %d\n",
    5096     diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
    5097     index 6a5649e52eed..8ac9e03c05b4 100644
    5098     --- a/drivers/input/mouse/psmouse-base.c
    5099     +++ b/drivers/input/mouse/psmouse-base.c
    5100     @@ -975,6 +975,21 @@ static void psmouse_apply_defaults(struct psmouse *psmouse)
    5101     psmouse->pt_deactivate = NULL;
    5102     }
    5103    
    5104     +static bool psmouse_do_detect(int (*detect)(struct psmouse *, bool),
    5105     + struct psmouse *psmouse, bool allow_passthrough,
    5106     + bool set_properties)
    5107     +{
    5108     + if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU &&
    5109     + !allow_passthrough) {
    5110     + return false;
    5111     + }
    5112     +
    5113     + if (set_properties)
    5114     + psmouse_apply_defaults(psmouse);
    5115     +
    5116     + return detect(psmouse, set_properties) == 0;
    5117     +}
    5118     +
    5119     static bool psmouse_try_protocol(struct psmouse *psmouse,
    5120     enum psmouse_type type,
    5121     unsigned int *max_proto,
    5122     @@ -986,15 +1001,8 @@ static bool psmouse_try_protocol(struct psmouse *psmouse,
    5123     if (!proto)
    5124     return false;
    5125    
    5126     - if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU &&
    5127     - !proto->try_passthru) {
    5128     - return false;
    5129     - }
    5130     -
    5131     - if (set_properties)
    5132     - psmouse_apply_defaults(psmouse);
    5133     -
    5134     - if (proto->detect(psmouse, set_properties) != 0)
    5135     + if (!psmouse_do_detect(proto->detect, psmouse, proto->try_passthru,
    5136     + set_properties))
    5137     return false;
    5138    
    5139     if (set_properties && proto->init && init_allowed) {
    5140     @@ -1027,8 +1035,8 @@ static int psmouse_extensions(struct psmouse *psmouse,
    5141     * Always check for focaltech, this is safe as it uses pnp-id
    5142     * matching.
    5143     */
    5144     - if (psmouse_try_protocol(psmouse, PSMOUSE_FOCALTECH,
    5145     - &max_proto, set_properties, false)) {
    5146     + if (psmouse_do_detect(focaltech_detect,
    5147     + psmouse, false, set_properties)) {
    5148     if (max_proto > PSMOUSE_IMEX &&
    5149     IS_ENABLED(CONFIG_MOUSE_PS2_FOCALTECH) &&
    5150     (!set_properties || focaltech_init(psmouse) == 0)) {
    5151     @@ -1074,8 +1082,8 @@ static int psmouse_extensions(struct psmouse *psmouse,
    5152     * probing for IntelliMouse.
    5153     */
    5154     if (max_proto > PSMOUSE_PS2 &&
    5155     - psmouse_try_protocol(psmouse, PSMOUSE_SYNAPTICS, &max_proto,
    5156     - set_properties, false)) {
    5157     + psmouse_do_detect(synaptics_detect,
    5158     + psmouse, false, set_properties)) {
    5159     synaptics_hardware = true;
    5160    
    5161     if (max_proto > PSMOUSE_IMEX) {
    5162     diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
    5163     index ee5466a374bf..a246fc686bb7 100644
    5164     --- a/drivers/input/mouse/synaptics.c
    5165     +++ b/drivers/input/mouse/synaptics.c
    5166     @@ -1280,6 +1280,16 @@ static void set_input_params(struct psmouse *psmouse,
    5167     INPUT_MT_POINTER |
    5168     (cr48_profile_sensor ?
    5169     INPUT_MT_TRACK : INPUT_MT_SEMI_MT));
    5170     +
    5171     + /*
    5172     + * For semi-mt devices we send ABS_X/Y ourselves instead of
    5173     + * input_mt_report_pointer_emulation. But
    5174     + * input_mt_init_slots() resets the fuzz to 0, leading to a
    5175     + * filtered ABS_MT_POSITION_X but an unfiltered ABS_X
    5176     + * position. Let's re-initialize ABS_X/Y here.
    5177     + */
    5178     + if (!cr48_profile_sensor)
    5179     + set_abs_position_params(dev, &priv->info, ABS_X, ABS_Y);
    5180     }
    5181    
    5182     if (SYN_CAP_PALMDETECT(info->capabilities))
    5183     diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
    5184     index 8c6c6178ec12..025bae3853cc 100644
    5185     --- a/drivers/input/touchscreen/stmfts.c
    5186     +++ b/drivers/input/touchscreen/stmfts.c
    5187     @@ -687,6 +687,14 @@ static int stmfts_probe(struct i2c_client *client,
    5188    
    5189     input_set_drvdata(sdata->input, sdata);
    5190    
    5191     + /*
    5192     + * stmfts_power_on expects interrupt to be disabled, but
    5193     + * at this point the device is still off and I do not trust
    5194     + * the status of the irq line that can generate some spurious
    5195     + * interrupts. To be on the safe side it's better to not enable
    5196     + * the interrupts during their request.
    5197     + */
    5198     + irq_set_status_flags(client->irq, IRQ_NOAUTOEN);
    5199     err = devm_request_threaded_irq(&client->dev, client->irq,
    5200     NULL, stmfts_irq_handler,
    5201     IRQF_ONESHOT,
    5202     @@ -694,9 +702,6 @@ static int stmfts_probe(struct i2c_client *client,
    5203     if (err)
    5204     return err;
    5205    
    5206     - /* stmfts_power_on expects interrupt to be disabled */
    5207     - disable_irq(client->irq);
    5208     -
    5209     dev_dbg(&client->dev, "initializing ST-Microelectronics FTS...\n");
    5210    
    5211     err = stmfts_power_on(sdata);
    5212     diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
    5213     index 25c2c75f5332..13485a40dd46 100644
    5214     --- a/drivers/iommu/exynos-iommu.c
    5215     +++ b/drivers/iommu/exynos-iommu.c
    5216     @@ -1344,8 +1344,15 @@ static const struct iommu_ops exynos_iommu_ops = {
    5217    
    5218     static int __init exynos_iommu_init(void)
    5219     {
    5220     + struct device_node *np;
    5221     int ret;
    5222    
    5223     + np = of_find_matching_node(NULL, sysmmu_of_match);
    5224     + if (!np)
    5225     + return 0;
    5226     +
    5227     + of_node_put(np);
    5228     +
    5229     lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table",
    5230     LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL);
    5231     if (!lv2table_kmem_cache) {
    5232     diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    5233     index 83f3d4831f94..e8414bcf8390 100644
    5234     --- a/drivers/iommu/intel-iommu.c
    5235     +++ b/drivers/iommu/intel-iommu.c
    5236     @@ -1603,8 +1603,7 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu,
    5237     * flush. However, device IOTLB doesn't need to be flushed in this case.
    5238     */
    5239     if (!cap_caching_mode(iommu->cap) || !map)
    5240     - iommu_flush_dev_iotlb(get_iommu_domain(iommu, did),
    5241     - addr, mask);
    5242     + iommu_flush_dev_iotlb(domain, addr, mask);
    5243     }
    5244    
    5245     static void iommu_flush_iova(struct iova_domain *iovad)
    5246     diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
    5247     index 14a8c0a7e095..25a98de5cfb2 100644
    5248     --- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
    5249     +++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
    5250     @@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void)
    5251    
    5252     for (np = of_find_matching_node(NULL, its_device_id); np;
    5253     np = of_find_matching_node(np, its_device_id)) {
    5254     + if (!of_device_is_available(np))
    5255     + continue;
    5256     if (!of_property_read_bool(np, "msi-controller"))
    5257     continue;
    5258    
    5259     diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
    5260     index 833a90fe33ae..8881a053c173 100644
    5261     --- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
    5262     +++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
    5263     @@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void)
    5264    
    5265     for (np = of_find_matching_node(NULL, its_device_id); np;
    5266     np = of_find_matching_node(np, its_device_id)) {
    5267     + if (!of_device_is_available(np))
    5268     + continue;
    5269     if (!of_property_read_bool(np, "msi-controller"))
    5270     continue;
    5271    
    5272     diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
    5273     index af57f8473a88..13f195c9743e 100644
    5274     --- a/drivers/irqchip/irq-gic-v3-its.c
    5275     +++ b/drivers/irqchip/irq-gic-v3-its.c
    5276     @@ -3083,6 +3083,8 @@ static int __init its_of_probe(struct device_node *node)
    5277    
    5278     for (np = of_find_matching_node(node, its_device_id); np;
    5279     np = of_find_matching_node(np, its_device_id)) {
    5280     + if (!of_device_is_available(np))
    5281     + continue;
    5282     if (!of_property_read_bool(np, "msi-controller")) {
    5283     pr_warn("%pOF: no msi-controller property, ITS ignored\n",
    5284     np);
    5285     diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
    5286     index 848fcdf6a112..3d7374655587 100644
    5287     --- a/drivers/irqchip/irq-gic-v3.c
    5288     +++ b/drivers/irqchip/irq-gic-v3.c
    5289     @@ -645,7 +645,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
    5290     MPIDR_TO_SGI_AFFINITY(cluster_id, 1) |
    5291     tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
    5292    
    5293     - pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
    5294     + pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
    5295     gic_write_sgi1r(val);
    5296     }
    5297    
    5298     diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
    5299     index f0dc8e2aee65..8c13a9036d07 100644
    5300     --- a/drivers/md/bcache/alloc.c
    5301     +++ b/drivers/md/bcache/alloc.c
    5302     @@ -287,8 +287,10 @@ do { \
    5303     break; \
    5304     \
    5305     mutex_unlock(&(ca)->set->bucket_lock); \
    5306     - if (kthread_should_stop()) \
    5307     + if (kthread_should_stop()) { \
    5308     + set_current_state(TASK_RUNNING); \
    5309     return 0; \
    5310     + } \
    5311     \
    5312     schedule(); \
    5313     mutex_lock(&(ca)->set->bucket_lock); \
    5314     diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
    5315     index abd31e847f96..e4a3f692057b 100644
    5316     --- a/drivers/md/bcache/bcache.h
    5317     +++ b/drivers/md/bcache/bcache.h
    5318     @@ -906,7 +906,7 @@ void bcache_write_super(struct cache_set *);
    5319    
    5320     int bch_flash_dev_create(struct cache_set *c, uint64_t size);
    5321    
    5322     -int bch_cached_dev_attach(struct cached_dev *, struct cache_set *);
    5323     +int bch_cached_dev_attach(struct cached_dev *, struct cache_set *, uint8_t *);
    5324     void bch_cached_dev_detach(struct cached_dev *);
    5325     void bch_cached_dev_run(struct cached_dev *);
    5326     void bcache_device_stop(struct bcache_device *);
    5327     diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
    5328     index 1598d1e04989..89d088cf95d9 100644
    5329     --- a/drivers/md/bcache/btree.c
    5330     +++ b/drivers/md/bcache/btree.c
    5331     @@ -1868,14 +1868,17 @@ void bch_initial_gc_finish(struct cache_set *c)
    5332     */
    5333     for_each_cache(ca, c, i) {
    5334     for_each_bucket(b, ca) {
    5335     - if (fifo_full(&ca->free[RESERVE_PRIO]))
    5336     + if (fifo_full(&ca->free[RESERVE_PRIO]) &&
    5337     + fifo_full(&ca->free[RESERVE_BTREE]))
    5338     break;
    5339    
    5340     if (bch_can_invalidate_bucket(ca, b) &&
    5341     !GC_MARK(b)) {
    5342     __bch_invalidate_one_bucket(ca, b);
    5343     - fifo_push(&ca->free[RESERVE_PRIO],
    5344     - b - ca->buckets);
    5345     + if (!fifo_push(&ca->free[RESERVE_PRIO],
    5346     + b - ca->buckets))
    5347     + fifo_push(&ca->free[RESERVE_BTREE],
    5348     + b - ca->buckets);
    5349     }
    5350     }
    5351     }
    5352     diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
    5353     index 5d0430777dda..fe6e4c319b7c 100644
    5354     --- a/drivers/md/bcache/super.c
    5355     +++ b/drivers/md/bcache/super.c
    5356     @@ -939,7 +939,8 @@ void bch_cached_dev_detach(struct cached_dev *dc)
    5357     cached_dev_put(dc);
    5358     }
    5359    
    5360     -int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
    5361     +int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
    5362     + uint8_t *set_uuid)
    5363     {
    5364     uint32_t rtime = cpu_to_le32(get_seconds());
    5365     struct uuid_entry *u;
    5366     @@ -948,7 +949,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c)
    5367    
    5368     bdevname(dc->bdev, buf);
    5369    
    5370     - if (memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16))
    5371     + if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
    5372     + (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
    5373     return -ENOENT;
    5374    
    5375     if (dc->disk.c) {
    5376     @@ -1190,7 +1192,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
    5377    
    5378     list_add(&dc->list, &uncached_devices);
    5379     list_for_each_entry(c, &bch_cache_sets, list)
    5380     - bch_cached_dev_attach(dc, c);
    5381     + bch_cached_dev_attach(dc, c, NULL);
    5382    
    5383     if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE ||
    5384     BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
    5385     @@ -1712,7 +1714,7 @@ static void run_cache_set(struct cache_set *c)
    5386     bcache_write_super(c);
    5387    
    5388     list_for_each_entry_safe(dc, t, &uncached_devices, list)
    5389     - bch_cached_dev_attach(dc, c);
    5390     + bch_cached_dev_attach(dc, c, NULL);
    5391    
    5392     flash_devs_run(c);
    5393    
    5394     @@ -1829,6 +1831,7 @@ void bch_cache_release(struct kobject *kobj)
    5395     static int cache_alloc(struct cache *ca)
    5396     {
    5397     size_t free;
    5398     + size_t btree_buckets;
    5399     struct bucket *b;
    5400    
    5401     __module_get(THIS_MODULE);
    5402     @@ -1836,9 +1839,19 @@ static int cache_alloc(struct cache *ca)
    5403    
    5404     bio_init(&ca->journal.bio, ca->journal.bio.bi_inline_vecs, 8);
    5405    
    5406     + /*
    5407     + * when ca->sb.njournal_buckets is not zero, journal exists,
    5408     + * and in bch_journal_replay(), tree node may split,
    5409     + * so bucket of RESERVE_BTREE type is needed,
    5410     + * the worst situation is all journal buckets are valid journal,
    5411     + * and all the keys need to replay,
    5412     + * so the number of RESERVE_BTREE type buckets should be as much
    5413     + * as journal buckets
    5414     + */
    5415     + btree_buckets = ca->sb.njournal_buckets ?: 8;
    5416     free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
    5417    
    5418     - if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
    5419     + if (!init_fifo(&ca->free[RESERVE_BTREE], btree_buckets, GFP_KERNEL) ||
    5420     !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
    5421     !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
    5422     !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
    5423     diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
    5424     index 234b2f5b286d..5d81cd06af00 100644
    5425     --- a/drivers/md/bcache/sysfs.c
    5426     +++ b/drivers/md/bcache/sysfs.c
    5427     @@ -193,7 +193,7 @@ STORE(__cached_dev)
    5428     {
    5429     struct cached_dev *dc = container_of(kobj, struct cached_dev,
    5430     disk.kobj);
    5431     - ssize_t v = size;
    5432     + ssize_t v;
    5433     struct cache_set *c;
    5434     struct kobj_uevent_env *env;
    5435    
    5436     @@ -265,17 +265,20 @@ STORE(__cached_dev)
    5437     }
    5438    
    5439     if (attr == &sysfs_attach) {
    5440     - if (bch_parse_uuid(buf, dc->sb.set_uuid) < 16)
    5441     + uint8_t set_uuid[16];
    5442     +
    5443     + if (bch_parse_uuid(buf, set_uuid) < 16)
    5444     return -EINVAL;
    5445    
    5446     + v = -ENOENT;
    5447     list_for_each_entry(c, &bch_cache_sets, list) {
    5448     - v = bch_cached_dev_attach(dc, c);
    5449     + v = bch_cached_dev_attach(dc, c, set_uuid);
    5450     if (!v)
    5451     return size;
    5452     }
    5453    
    5454     pr_err("Can't attach %s: cache set not found", buf);
    5455     - size = v;
    5456     + return v;
    5457     }
    5458    
    5459     if (attr == &sysfs_detach && dc->disk.c)
    5460     diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
    5461     index 70454f2ad2fa..f046dedc59ab 100644
    5462     --- a/drivers/md/bcache/writeback.c
    5463     +++ b/drivers/md/bcache/writeback.c
    5464     @@ -420,18 +420,21 @@ static int bch_writeback_thread(void *arg)
    5465    
    5466     while (!kthread_should_stop()) {
    5467     down_write(&dc->writeback_lock);
    5468     + set_current_state(TASK_INTERRUPTIBLE);
    5469     if (!atomic_read(&dc->has_dirty) ||
    5470     (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) &&
    5471     !dc->writeback_running)) {
    5472     up_write(&dc->writeback_lock);
    5473     - set_current_state(TASK_INTERRUPTIBLE);
    5474    
    5475     - if (kthread_should_stop())
    5476     + if (kthread_should_stop()) {
    5477     + set_current_state(TASK_RUNNING);
    5478     return 0;
    5479     + }
    5480    
    5481     schedule();
    5482     continue;
    5483     }
    5484     + set_current_state(TASK_RUNNING);
    5485    
    5486     searched_full_index = refill_dirty(dc);
    5487    
    5488     diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
    5489     index 2704a55f8b6e..8b7328666eaa 100644
    5490     --- a/drivers/md/dm-mpath.c
    5491     +++ b/drivers/md/dm-mpath.c
    5492     @@ -502,8 +502,20 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
    5493     if (queue_dying) {
    5494     atomic_inc(&m->pg_init_in_progress);
    5495     activate_or_offline_path(pgpath);
    5496     + return DM_MAPIO_DELAY_REQUEUE;
    5497     }
    5498     - return DM_MAPIO_DELAY_REQUEUE;
    5499     +
    5500     + /*
    5501     + * blk-mq's SCHED_RESTART can cover this requeue, so we
    5502     + * needn't deal with it by DELAY_REQUEUE. More importantly,
    5503     + * we have to return DM_MAPIO_REQUEUE so that blk-mq can
    5504     + * get the queue busy feedback (via BLK_STS_RESOURCE),
    5505     + * otherwise I/O merging can suffer.
    5506     + */
    5507     + if (q->mq_ops)
    5508     + return DM_MAPIO_REQUEUE;
    5509     + else
    5510     + return DM_MAPIO_DELAY_REQUEUE;
    5511     }
    5512     clone->bio = clone->biotail = NULL;
    5513     clone->rq_disk = bdev->bd_disk;
    5514     diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
    5515     index 7f837006bb6a..3bdeb295514b 100644
    5516     --- a/drivers/net/ethernet/freescale/gianfar.c
    5517     +++ b/drivers/net/ethernet/freescale/gianfar.c
    5518     @@ -2932,7 +2932,7 @@ static irqreturn_t gfar_transmit(int irq, void *grp_id)
    5519     static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
    5520     struct sk_buff *skb, bool first)
    5521     {
    5522     - unsigned int size = lstatus & BD_LENGTH_MASK;
    5523     + int size = lstatus & BD_LENGTH_MASK;
    5524     struct page *page = rxb->page;
    5525     bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
    5526    
    5527     @@ -2947,11 +2947,16 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
    5528     if (last)
    5529     size -= skb->len;
    5530    
    5531     - /* in case the last fragment consisted only of the FCS */
    5532     + /* Add the last fragment if it contains something other than
    5533     + * the FCS, otherwise drop it and trim off any part of the FCS
    5534     + * that was already received.
    5535     + */
    5536     if (size > 0)
    5537     skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
    5538     rxb->page_offset + RXBUF_ALIGNMENT,
    5539     size, GFAR_RXB_TRUESIZE);
    5540     + else if (size < 0)
    5541     + pskb_trim(skb, skb->len + size);
    5542     }
    5543    
    5544     /* try reuse page */
    5545     diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
    5546     index e69d49d91d67..914258310ddd 100644
    5547     --- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
    5548     +++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c
    5549     @@ -815,8 +815,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set)
    5550     if (vid >= VLAN_N_VID)
    5551     return -EINVAL;
    5552    
    5553     - /* Verify we have permission to add VLANs */
    5554     - if (hw->mac.vlan_override)
    5555     + /* Verify that we have permission to add VLANs. If this is a request
    5556     + * to remove a VLAN, we still want to allow the user to remove the
    5557     + * VLAN device. In that case, we need to clear the bit in the
    5558     + * active_vlans bitmask.
    5559     + */
    5560     + if (set && hw->mac.vlan_override)
    5561     return -EACCES;
    5562    
    5563     /* update active_vlans bitmask */
    5564     @@ -835,6 +839,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set)
    5565     rx_ring->vid &= ~FM10K_VLAN_CLEAR;
    5566     }
    5567    
    5568     + /* If our VLAN has been overridden, there is no reason to send VLAN
    5569     + * removal requests as they will be silently ignored.
    5570     + */
    5571     + if (hw->mac.vlan_override)
    5572     + return 0;
    5573     +
    5574     /* Do not remove default VLAN ID related entries from VLAN and MAC
    5575     * tables
    5576     */
    5577     diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
    5578     index 05e89864f781..ef22793d6a03 100644
    5579     --- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
    5580     +++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
    5581     @@ -2588,16 +2588,16 @@ static int i40e_get_ethtool_fdir_entry(struct i40e_pf *pf,
    5582    
    5583     no_input_set:
    5584     if (input_set & I40E_L3_SRC_MASK)
    5585     - fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFF);
    5586     + fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFFFFFF);
    5587    
    5588     if (input_set & I40E_L3_DST_MASK)
    5589     - fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFF);
    5590     + fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFFFFFF);
    5591    
    5592     if (input_set & I40E_L4_SRC_MASK)
    5593     - fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFFFFFF);
    5594     + fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFF);
    5595    
    5596     if (input_set & I40E_L4_DST_MASK)
    5597     - fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFFFFFF);
    5598     + fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFF);
    5599    
    5600     if (rule->dest_ctl == I40E_FILTER_PROGRAM_DESC_DEST_DROP_PACKET)
    5601     fsp->ring_cookie = RX_CLS_FLOW_DISC;
    5602     @@ -3648,6 +3648,16 @@ static int i40e_check_fdir_input_set(struct i40e_vsi *vsi,
    5603    
    5604     i40e_write_fd_input_set(pf, index, new_mask);
    5605    
    5606     + /* IP_USER_FLOW filters match both IPv4/Other and IPv4/Fragmented
    5607     + * frames. If we're programming the input set for IPv4/Other, we also
    5608     + * need to program the IPv4/Fragmented input set. Since we don't have
    5609     + * separate support, we'll always assume and enforce that the two flow
    5610     + * types must have matching input sets.
    5611     + */
    5612     + if (index == I40E_FILTER_PCTYPE_NONF_IPV4_OTHER)
    5613     + i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4,
    5614     + new_mask);
    5615     +
    5616     /* Add the new offset and update table, if necessary */
    5617     if (new_flex_offset) {
    5618     err = i40e_add_flex_offset(&pf->l4_flex_pit_list, src_offset,
    5619     diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
    5620     index b1cde1b051a4..d36b799116e4 100644
    5621     --- a/drivers/net/ethernet/intel/i40e/i40e_main.c
    5622     +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
    5623     @@ -5828,6 +5828,9 @@ static void i40e_fdir_filter_exit(struct i40e_pf *pf)
    5624     /* Reprogram the default input set for Other/IPv4 */
    5625     i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_NONF_IPV4_OTHER,
    5626     I40E_L3_SRC_MASK | I40E_L3_DST_MASK);
    5627     +
    5628     + i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4,
    5629     + I40E_L3_SRC_MASK | I40E_L3_DST_MASK);
    5630     }
    5631    
    5632     /**
    5633     diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h
    5634     index 82f69031e5cd..2ef32ab1dfae 100644
    5635     --- a/drivers/net/ethernet/intel/i40evf/i40evf.h
    5636     +++ b/drivers/net/ethernet/intel/i40evf/i40evf.h
    5637     @@ -186,6 +186,7 @@ enum i40evf_state_t {
    5638     enum i40evf_critical_section_t {
    5639     __I40EVF_IN_CRITICAL_TASK, /* cannot be interrupted */
    5640     __I40EVF_IN_CLIENT_TASK,
    5641     + __I40EVF_IN_REMOVE_TASK, /* device being removed */
    5642     };
    5643    
    5644     /* board specific private data structure */
    5645     diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
    5646     index 4eb6ff60e8fc..1b5d204c57c1 100644
    5647     --- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c
    5648     +++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c
    5649     @@ -1839,6 +1839,12 @@ static void i40evf_reset_task(struct work_struct *work)
    5650     int i = 0, err;
    5651     bool running;
    5652    
    5653     + /* When device is being removed it doesn't make sense to run the reset
    5654     + * task, just return in such a case.
    5655     + */
    5656     + if (test_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section))
    5657     + return;
    5658     +
    5659     while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK,
    5660     &adapter->crit_section))
    5661     usleep_range(500, 1000);
    5662     @@ -3022,7 +3028,8 @@ static void i40evf_remove(struct pci_dev *pdev)
    5663     struct i40evf_mac_filter *f, *ftmp;
    5664     struct i40e_hw *hw = &adapter->hw;
    5665     int err;
    5666     -
    5667     + /* Indicate we are in remove and not to run reset_task */
    5668     + set_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section);
    5669     cancel_delayed_work_sync(&adapter->init_task);
    5670     cancel_work_sync(&adapter->reset_task);
    5671     cancel_delayed_work_sync(&adapter->client_task);
    5672     diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
    5673     index 85876f4fb1fb..46bf11afba08 100644
    5674     --- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
    5675     +++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
    5676     @@ -937,23 +937,34 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter,
    5677     if (v_opcode == VIRTCHNL_OP_EVENT) {
    5678     struct virtchnl_pf_event *vpe =
    5679     (struct virtchnl_pf_event *)msg;
    5680     + bool link_up = vpe->event_data.link_event.link_status;
    5681     switch (vpe->event) {
    5682     case VIRTCHNL_EVENT_LINK_CHANGE:
    5683     adapter->link_speed =
    5684     vpe->event_data.link_event.link_speed;
    5685     - if (adapter->link_up !=
    5686     - vpe->event_data.link_event.link_status) {
    5687     - adapter->link_up =
    5688     - vpe->event_data.link_event.link_status;
    5689     - if (adapter->link_up) {
    5690     - netif_tx_start_all_queues(netdev);
    5691     - netif_carrier_on(netdev);
    5692     - } else {
    5693     - netif_tx_stop_all_queues(netdev);
    5694     - netif_carrier_off(netdev);
    5695     - }
    5696     - i40evf_print_link_message(adapter);
    5697     +
    5698     + /* we've already got the right link status, bail */
    5699     + if (adapter->link_up == link_up)
    5700     + break;
    5701     +
    5702     + /* If we get link up message and start queues before
    5703     + * our queues are configured it will trigger a TX hang.
    5704     + * In that case, just ignore the link status message,
    5705     + * we'll get another one after we enable queues and
    5706     + * actually prepared to send traffic.
    5707     + */
    5708     + if (link_up && adapter->state != __I40EVF_RUNNING)
    5709     + break;
    5710     +
    5711     + adapter->link_up = link_up;
    5712     + if (link_up) {
    5713     + netif_tx_start_all_queues(netdev);
    5714     + netif_carrier_on(netdev);
    5715     + } else {
    5716     + netif_tx_stop_all_queues(netdev);
    5717     + netif_carrier_off(netdev);
    5718     }
    5719     + i40evf_print_link_message(adapter);
    5720     break;
    5721     case VIRTCHNL_EVENT_RESET_IMPENDING:
    5722     dev_info(&adapter->pdev->dev, "PF reset warning received\n");
    5723     diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
    5724     index d1a44a84c97e..6ca580cdfd84 100644
    5725     --- a/drivers/net/ethernet/intel/igb/igb_main.c
    5726     +++ b/drivers/net/ethernet/intel/igb/igb_main.c
    5727     @@ -8373,7 +8373,8 @@ static void igb_rar_set_index(struct igb_adapter *adapter, u32 index)
    5728    
    5729     /* Indicate to hardware the Address is Valid. */
    5730     if (adapter->mac_table[index].state & IGB_MAC_STATE_IN_USE) {
    5731     - rar_high |= E1000_RAH_AV;
    5732     + if (is_valid_ether_addr(addr))
    5733     + rar_high |= E1000_RAH_AV;
    5734    
    5735     if (hw->mac.type == e1000_82575)
    5736     rar_high |= E1000_RAH_POOL_1 *
    5737     @@ -8411,17 +8412,36 @@ static int igb_set_vf_mac(struct igb_adapter *adapter,
    5738     static int igb_ndo_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
    5739     {
    5740     struct igb_adapter *adapter = netdev_priv(netdev);
    5741     - if (!is_valid_ether_addr(mac) || (vf >= adapter->vfs_allocated_count))
    5742     +
    5743     + if (vf >= adapter->vfs_allocated_count)
    5744     + return -EINVAL;
    5745     +
    5746     + /* Setting the VF MAC to 0 reverts the IGB_VF_FLAG_PF_SET_MAC
    5747     + * flag and allows to overwrite the MAC via VF netdev. This
    5748     + * is necessary to allow libvirt a way to restore the original
    5749     + * MAC after unbinding vfio-pci and reloading igbvf after shutting
    5750     + * down a VM.
    5751     + */
    5752     + if (is_zero_ether_addr(mac)) {
    5753     + adapter->vf_data[vf].flags &= ~IGB_VF_FLAG_PF_SET_MAC;
    5754     + dev_info(&adapter->pdev->dev,
    5755     + "remove administratively set MAC on VF %d\n",
    5756     + vf);
    5757     + } else if (is_valid_ether_addr(mac)) {
    5758     + adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC;
    5759     + dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n",
    5760     + mac, vf);
    5761     + dev_info(&adapter->pdev->dev,
    5762     + "Reload the VF driver to make this change effective.");
    5763     + /* Generate additional warning if PF is down */
    5764     + if (test_bit(__IGB_DOWN, &adapter->state)) {
    5765     + dev_warn(&adapter->pdev->dev,
    5766     + "The VF MAC address has been set, but the PF device is not up.\n");
    5767     + dev_warn(&adapter->pdev->dev,
    5768     + "Bring the PF device up before attempting to use the VF device.\n");
    5769     + }
    5770     + } else {
    5771     return -EINVAL;
    5772     - adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC;
    5773     - dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", mac, vf);
    5774     - dev_info(&adapter->pdev->dev,
    5775     - "Reload the VF driver to make this change effective.");
    5776     - if (test_bit(__IGB_DOWN, &adapter->state)) {
    5777     - dev_warn(&adapter->pdev->dev,
    5778     - "The VF MAC address has been set, but the PF device is not up.\n");
    5779     - dev_warn(&adapter->pdev->dev,
    5780     - "Bring the PF device up before attempting to use the VF device.\n");
    5781     }
    5782     return igb_set_vf_mac(adapter, vf, mac);
    5783     }
    5784     diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
    5785     index 841c2a083349..0746b19ec6d3 100644
    5786     --- a/drivers/net/ethernet/intel/igb/igb_ptp.c
    5787     +++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
    5788     @@ -643,6 +643,10 @@ static void igb_ptp_tx_work(struct work_struct *work)
    5789     adapter->ptp_tx_skb = NULL;
    5790     clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state);
    5791     adapter->tx_hwtstamp_timeouts++;
    5792     + /* Clear the tx valid bit in TSYNCTXCTL register to enable
    5793     + * interrupt
    5794     + */
    5795     + rd32(E1000_TXSTMPH);
    5796     dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n");
    5797     return;
    5798     }
    5799     @@ -717,6 +721,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter)
    5800     */
    5801     void igb_ptp_tx_hang(struct igb_adapter *adapter)
    5802     {
    5803     + struct e1000_hw *hw = &adapter->hw;
    5804     bool timeout = time_is_before_jiffies(adapter->ptp_tx_start +
    5805     IGB_PTP_TX_TIMEOUT);
    5806    
    5807     @@ -736,6 +741,10 @@ void igb_ptp_tx_hang(struct igb_adapter *adapter)
    5808     adapter->ptp_tx_skb = NULL;
    5809     clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state);
    5810     adapter->tx_hwtstamp_timeouts++;
    5811     + /* Clear the tx valid bit in TSYNCTXCTL register to enable
    5812     + * interrupt
    5813     + */
    5814     + rd32(E1000_TXSTMPH);
    5815     dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n");
    5816     }
    5817     }
    5818     diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
    5819     index 29f600fd6977..9e30cfeac04b 100644
    5820     --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
    5821     +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
    5822     @@ -3987,11 +3987,15 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter,
    5823     rxdctl &= ~0x3FFFFF;
    5824     rxdctl |= 0x080420;
    5825     #if (PAGE_SIZE < 8192)
    5826     - } else {
    5827     + /* RXDCTL.RLPML does not work on 82599 */
    5828     + } else if (hw->mac.type != ixgbe_mac_82599EB) {
    5829     rxdctl &= ~(IXGBE_RXDCTL_RLPMLMASK |
    5830     IXGBE_RXDCTL_RLPML_EN);
    5831    
    5832     - /* Limit the maximum frame size so we don't overrun the skb */
    5833     + /* Limit the maximum frame size so we don't overrun the skb.
    5834     + * This can happen in SRIOV mode when the MTU of the VF is
    5835     + * higher than the MTU of the PF.
    5836     + */
    5837     if (ring_uses_build_skb(ring) &&
    5838     !test_bit(__IXGBE_RX_3K_BUFFER, &ring->state))
    5839     rxdctl |= IXGBE_MAX_2K_FRAME_BUILD_SKB |
    5840     diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c
    5841     index f8fa63b66739..a1a15e0c2245 100644
    5842     --- a/drivers/net/ethernet/netronome/nfp/nfp_main.c
    5843     +++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c
    5844     @@ -492,6 +492,7 @@ static int nfp_pci_probe(struct pci_dev *pdev,
    5845     dev_err(&pdev->dev,
    5846     "Error: %d VFs already enabled, but loaded FW can only support %d\n",
    5847     pf->num_vfs, pf->limit_vfs);
    5848     + err = -EINVAL;
    5849     goto err_fw_unload;
    5850     }
    5851    
    5852     diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
    5853     index 4404650b32c5..8be4b32544ef 100644
    5854     --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
    5855     +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
    5856     @@ -116,7 +116,7 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac)
    5857     snprintf(clk_name, sizeof(clk_name), "%s#m250_sel", dev_name(dev));
    5858     init.name = clk_name;
    5859     init.ops = &clk_mux_ops;
    5860     - init.flags = 0;
    5861     + init.flags = CLK_SET_RATE_PARENT;
    5862     init.parent_names = mux_parent_names;
    5863     init.num_parents = MUX_CLK_NUM_PARENTS;
    5864    
    5865     @@ -144,7 +144,9 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac)
    5866     dwmac->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT;
    5867     dwmac->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH;
    5868     dwmac->m250_div.hw.init = &init;
    5869     - dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO;
    5870     + dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED |
    5871     + CLK_DIVIDER_ALLOW_ZERO |
    5872     + CLK_DIVIDER_ROUND_CLOSEST;
    5873    
    5874     dwmac->m250_div_clk = devm_clk_register(dev, &dwmac->m250_div.hw);
    5875     if (WARN_ON(IS_ERR(dwmac->m250_div_clk)))
    5876     diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
    5877     index 2f7d7ec59962..e1d03489ae63 100644
    5878     --- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
    5879     +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
    5880     @@ -562,10 +562,12 @@ static int dwmac4_irq_status(struct mac_device_info *hw,
    5881     struct stmmac_extra_stats *x)
    5882     {
    5883     void __iomem *ioaddr = hw->pcsr;
    5884     - u32 intr_status;
    5885     + u32 intr_status = readl(ioaddr + GMAC_INT_STATUS);
    5886     + u32 intr_enable = readl(ioaddr + GMAC_INT_EN);
    5887     int ret = 0;
    5888    
    5889     - intr_status = readl(ioaddr + GMAC_INT_STATUS);
    5890     + /* Discard disabled bits */
    5891     + intr_status &= intr_enable;
    5892    
    5893     /* Not used events (e.g. MMC interrupts) are not handled. */
    5894     if ((intr_status & mmc_tx_irq))
    5895     diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    5896     index d148dbf3beeb..d686ba10fecc 100644
    5897     --- a/drivers/net/wireless/mac80211_hwsim.c
    5898     +++ b/drivers/net/wireless/mac80211_hwsim.c
    5899     @@ -3153,8 +3153,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
    5900     if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
    5901     u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
    5902    
    5903     - if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
    5904     + if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) {
    5905     + kfree(hwname);
    5906     return -EINVAL;
    5907     + }
    5908     param.regd = hwsim_world_regdom_custom[idx];
    5909     }
    5910    
    5911     @@ -3425,8 +3427,11 @@ static void __net_exit hwsim_exit_net(struct net *net)
    5912     continue;
    5913    
    5914     list_del(&data->list);
    5915     - INIT_WORK(&data->destroy_work, destroy_radio);
    5916     - schedule_work(&data->destroy_work);
    5917     + spin_unlock_bh(&hwsim_radio_lock);
    5918     + mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy),
    5919     + NULL);
    5920     + spin_lock_bh(&hwsim_radio_lock);
    5921     +
    5922     }
    5923     spin_unlock_bh(&hwsim_radio_lock);
    5924     }
    5925     diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
    5926     index a9ba9fe263ca..f07b9c9bb5ba 100644
    5927     --- a/drivers/net/xen-netfront.c
    5928     +++ b/drivers/net/xen-netfront.c
    5929     @@ -351,6 +351,9 @@ static int xennet_open(struct net_device *dev)
    5930     unsigned int i = 0;
    5931     struct netfront_queue *queue = NULL;
    5932    
    5933     + if (!np->queues)
    5934     + return -ENODEV;
    5935     +
    5936     for (i = 0; i < num_queues; ++i) {
    5937     queue = &np->queues[i];
    5938     napi_enable(&queue->napi);
    5939     @@ -1358,18 +1361,8 @@ static int netfront_probe(struct xenbus_device *dev,
    5940     #ifdef CONFIG_SYSFS
    5941     info->netdev->sysfs_groups[0] = &xennet_dev_group;
    5942     #endif
    5943     - err = register_netdev(info->netdev);
    5944     - if (err) {
    5945     - pr_warn("%s: register_netdev err=%d\n", __func__, err);
    5946     - goto fail;
    5947     - }
    5948    
    5949     return 0;
    5950     -
    5951     - fail:
    5952     - xennet_free_netdev(netdev);
    5953     - dev_set_drvdata(&dev->dev, NULL);
    5954     - return err;
    5955     }
    5956    
    5957     static void xennet_end_access(int ref, void *page)
    5958     @@ -1738,8 +1731,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
    5959     {
    5960     unsigned int i;
    5961    
    5962     - rtnl_lock();
    5963     -
    5964     for (i = 0; i < info->netdev->real_num_tx_queues; i++) {
    5965     struct netfront_queue *queue = &info->queues[i];
    5966    
    5967     @@ -1748,8 +1739,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
    5968     netif_napi_del(&queue->napi);
    5969     }
    5970    
    5971     - rtnl_unlock();
    5972     -
    5973     kfree(info->queues);
    5974     info->queues = NULL;
    5975     }
    5976     @@ -1765,8 +1754,6 @@ static int xennet_create_queues(struct netfront_info *info,
    5977     if (!info->queues)
    5978     return -ENOMEM;
    5979    
    5980     - rtnl_lock();
    5981     -
    5982     for (i = 0; i < *num_queues; i++) {
    5983     struct netfront_queue *queue = &info->queues[i];
    5984    
    5985     @@ -1775,7 +1762,7 @@ static int xennet_create_queues(struct netfront_info *info,
    5986    
    5987     ret = xennet_init_queue(queue);
    5988     if (ret < 0) {
    5989     - dev_warn(&info->netdev->dev,
    5990     + dev_warn(&info->xbdev->dev,
    5991     "only created %d queues\n", i);
    5992     *num_queues = i;
    5993     break;
    5994     @@ -1789,10 +1776,8 @@ static int xennet_create_queues(struct netfront_info *info,
    5995    
    5996     netif_set_real_num_tx_queues(info->netdev, *num_queues);
    5997    
    5998     - rtnl_unlock();
    5999     -
    6000     if (*num_queues == 0) {
    6001     - dev_err(&info->netdev->dev, "no queues\n");
    6002     + dev_err(&info->xbdev->dev, "no queues\n");
    6003     return -EINVAL;
    6004     }
    6005     return 0;
    6006     @@ -1829,6 +1814,7 @@ static int talk_to_netback(struct xenbus_device *dev,
    6007     goto out;
    6008     }
    6009    
    6010     + rtnl_lock();
    6011     if (info->queues)
    6012     xennet_destroy_queues(info);
    6013    
    6014     @@ -1839,6 +1825,7 @@ static int talk_to_netback(struct xenbus_device *dev,
    6015     info->queues = NULL;
    6016     goto out;
    6017     }
    6018     + rtnl_unlock();
    6019    
    6020     /* Create shared ring, alloc event channel -- for each queue */
    6021     for (i = 0; i < num_queues; ++i) {
    6022     @@ -1935,8 +1922,10 @@ static int talk_to_netback(struct xenbus_device *dev,
    6023     xenbus_transaction_end(xbt, 1);
    6024     destroy_ring:
    6025     xennet_disconnect_backend(info);
    6026     + rtnl_lock();
    6027     xennet_destroy_queues(info);
    6028     out:
    6029     + rtnl_unlock();
    6030     device_unregister(&dev->dev);
    6031     return err;
    6032     }
    6033     @@ -1966,6 +1955,15 @@ static int xennet_connect(struct net_device *dev)
    6034     netdev_update_features(dev);
    6035     rtnl_unlock();
    6036    
    6037     + if (dev->reg_state == NETREG_UNINITIALIZED) {
    6038     + err = register_netdev(dev);
    6039     + if (err) {
    6040     + pr_warn("%s: register_netdev err=%d\n", __func__, err);
    6041     + device_unregister(&np->xbdev->dev);
    6042     + return err;
    6043     + }
    6044     + }
    6045     +
    6046     /*
    6047     * All public and private state should now be sane. Get
    6048     * ready to start sending and receiving packets and give the driver
    6049     @@ -2156,10 +2154,14 @@ static int xennet_remove(struct xenbus_device *dev)
    6050    
    6051     xennet_disconnect_backend(info);
    6052    
    6053     - unregister_netdev(info->netdev);
    6054     + if (info->netdev->reg_state == NETREG_REGISTERED)
    6055     + unregister_netdev(info->netdev);
    6056    
    6057     - if (info->queues)
    6058     + if (info->queues) {
    6059     + rtnl_lock();
    6060     xennet_destroy_queues(info);
    6061     + rtnl_unlock();
    6062     + }
    6063     xennet_free_netdev(info->netdev);
    6064    
    6065     return 0;
    6066     diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
    6067     index f58d8e305323..18339b7e88a4 100644
    6068     --- a/drivers/ntb/ntb_transport.c
    6069     +++ b/drivers/ntb/ntb_transport.c
    6070     @@ -998,6 +998,9 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
    6071     mw_base = nt->mw_vec[mw_num].phys_addr;
    6072     mw_size = nt->mw_vec[mw_num].phys_size;
    6073    
    6074     + if (max_mw_size && mw_size > max_mw_size)
    6075     + mw_size = max_mw_size;
    6076     +
    6077     tx_size = (unsigned int)mw_size / num_qps_mw;
    6078     qp_offset = tx_size * (qp_num / mw_count);
    6079    
    6080     diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    6081     index 5c5a8af66829..116127a0accb 100644
    6082     --- a/drivers/pci/quirks.c
    6083     +++ b/drivers/pci/quirks.c
    6084     @@ -3879,6 +3879,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120,
    6085     quirk_dma_func1_alias);
    6086     DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123,
    6087     quirk_dma_func1_alias);
    6088     +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128,
    6089     + quirk_dma_func1_alias);
    6090     /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
    6091     DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
    6092     quirk_dma_func1_alias);
    6093     diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
    6094     index 7424e53157b0..dd5043a6a114 100644
    6095     --- a/drivers/platform/x86/dell-laptop.c
    6096     +++ b/drivers/platform/x86/dell-laptop.c
    6097     @@ -1177,6 +1177,7 @@ static u8 kbd_previous_mode_bit;
    6098    
    6099     static bool kbd_led_present;
    6100     static DEFINE_MUTEX(kbd_led_mutex);
    6101     +static enum led_brightness kbd_led_level;
    6102    
    6103     /*
    6104     * NOTE: there are three ways to set the keyboard backlight level.
    6105     @@ -2020,6 +2021,7 @@ static enum led_brightness kbd_led_level_get(struct led_classdev *led_cdev)
    6106     static int kbd_led_level_set(struct led_classdev *led_cdev,
    6107     enum led_brightness value)
    6108     {
    6109     + enum led_brightness new_value = value;
    6110     struct kbd_state state;
    6111     struct kbd_state new_state;
    6112     u16 num;
    6113     @@ -2049,6 +2051,9 @@ static int kbd_led_level_set(struct led_classdev *led_cdev,
    6114     }
    6115    
    6116     out:
    6117     + if (ret == 0)
    6118     + kbd_led_level = new_value;
    6119     +
    6120     mutex_unlock(&kbd_led_mutex);
    6121     return ret;
    6122     }
    6123     @@ -2076,6 +2081,9 @@ static int __init kbd_led_init(struct device *dev)
    6124     if (kbd_led.max_brightness)
    6125     kbd_led.max_brightness--;
    6126     }
    6127     +
    6128     + kbd_led_level = kbd_led_level_get(NULL);
    6129     +
    6130     ret = led_classdev_register(dev, &kbd_led);
    6131     if (ret)
    6132     kbd_led_present = false;
    6133     @@ -2100,13 +2108,25 @@ static void kbd_led_exit(void)
    6134     static int dell_laptop_notifier_call(struct notifier_block *nb,
    6135     unsigned long action, void *data)
    6136     {
    6137     + bool changed = false;
    6138     + enum led_brightness new_kbd_led_level;
    6139     +
    6140     switch (action) {
    6141     case DELL_LAPTOP_KBD_BACKLIGHT_BRIGHTNESS_CHANGED:
    6142     if (!kbd_led_present)
    6143     break;
    6144    
    6145     - led_classdev_notify_brightness_hw_changed(&kbd_led,
    6146     - kbd_led_level_get(&kbd_led));
    6147     + mutex_lock(&kbd_led_mutex);
    6148     + new_kbd_led_level = kbd_led_level_get(&kbd_led);
    6149     + if (kbd_led_level != new_kbd_led_level) {
    6150     + kbd_led_level = new_kbd_led_level;
    6151     + changed = true;
    6152     + }
    6153     + mutex_unlock(&kbd_led_mutex);
    6154     +
    6155     + if (changed)
    6156     + led_classdev_notify_brightness_hw_changed(&kbd_led,
    6157     + kbd_led_level);
    6158     break;
    6159     }
    6160    
    6161     diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
    6162     index 2242d6035d9e..c407d52ef7cf 100644
    6163     --- a/drivers/platform/x86/thinkpad_acpi.c
    6164     +++ b/drivers/platform/x86/thinkpad_acpi.c
    6165     @@ -214,6 +214,10 @@ enum tpacpi_hkey_event_t {
    6166     /* AC-related events */
    6167     TP_HKEY_EV_AC_CHANGED = 0x6040, /* AC status changed */
    6168    
    6169     + /* Further user-interface events */
    6170     + TP_HKEY_EV_PALM_DETECTED = 0x60b0, /* palm hoveres keyboard */
    6171     + TP_HKEY_EV_PALM_UNDETECTED = 0x60b1, /* palm removed */
    6172     +
    6173     /* Misc */
    6174     TP_HKEY_EV_RFKILL_CHANGED = 0x7000, /* rfkill switch changed */
    6175     };
    6176     @@ -3973,6 +3977,12 @@ static bool hotkey_notify_6xxx(const u32 hkey,
    6177     *send_acpi_ev = false;
    6178     break;
    6179    
    6180     + case TP_HKEY_EV_PALM_DETECTED:
    6181     + case TP_HKEY_EV_PALM_UNDETECTED:
    6182     + /* palm detected hovering the keyboard, forward to user-space
    6183     + * via netlink for consumption */
    6184     + return true;
    6185     +
    6186     default:
    6187     pr_warn("unknown possible thermal alarm or keyboard event received\n");
    6188     known = false;
    6189     diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
    6190     index 24388795ee9a..936e8c735656 100644
    6191     --- a/drivers/scsi/arm/fas216.c
    6192     +++ b/drivers/scsi/arm/fas216.c
    6193     @@ -2011,7 +2011,7 @@ static void fas216_rq_sns_done(FAS216_Info *info, struct scsi_cmnd *SCpnt,
    6194     * have valid data in the sense buffer that could
    6195     * confuse the higher levels.
    6196     */
    6197     - memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer));
    6198     + memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
    6199     //printk("scsi%d.%c: sense buffer: ", info->host->host_no, '0' + SCpnt->device->id);
    6200     //{ int i; for (i = 0; i < 32; i++) printk("%02x ", SCpnt->sense_buffer[i]); printk("\n"); }
    6201     /*
    6202     diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
    6203     index 2300c02ab5e6..e24f57946a17 100644
    6204     --- a/drivers/scsi/qla2xxx/qla_init.c
    6205     +++ b/drivers/scsi/qla2xxx/qla_init.c
    6206     @@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data)
    6207    
    6208     switch (sp->type) {
    6209     case SRB_LOGIN_CMD:
    6210     + if (!fcport)
    6211     + break;
    6212     /* Retry as needed. */
    6213     lio->u.logio.data[0] = MBS_COMMAND_ERROR;
    6214     lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ?
    6215     @@ -128,6 +130,8 @@ qla2x00_async_iocb_timeout(void *data)
    6216     qla24xx_handle_plogi_done_event(fcport->vha, &ea);
    6217     break;
    6218     case SRB_LOGOUT_CMD:
    6219     + if (!fcport)
    6220     + break;
    6221     qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT);
    6222     break;
    6223     case SRB_CT_PTHRU_CMD:
    6224     diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
    6225     index cfc095f45e26..ea947a7c2596 100644
    6226     --- a/drivers/scsi/scsi_devinfo.c
    6227     +++ b/drivers/scsi/scsi_devinfo.c
    6228     @@ -109,8 +109,8 @@ static struct {
    6229     * seagate controller, which causes SCSI code to reset bus.
    6230     */
    6231     {"HP", "C1750A", "3226", BLIST_NOLUN}, /* scanjet iic */
    6232     - {"HP", "C1790A", "", BLIST_NOLUN}, /* scanjet iip */
    6233     - {"HP", "C2500A", "", BLIST_NOLUN}, /* scanjet iicx */
    6234     + {"HP", "C1790A", NULL, BLIST_NOLUN}, /* scanjet iip */
    6235     + {"HP", "C2500A", NULL, BLIST_NOLUN}, /* scanjet iicx */
    6236     {"MEDIAVIS", "CDR-H93MV", "1.31", BLIST_NOLUN}, /* locks up */
    6237     {"MICROTEK", "ScanMaker II", "5.61", BLIST_NOLUN}, /* responds to all lun */
    6238     {"MITSUMI", "CD-R CR-2201CS", "6119", BLIST_NOLUN}, /* locks up */
    6239     @@ -120,7 +120,7 @@ static struct {
    6240     {"QUANTUM", "FIREBALL ST4.3S", "0F0C", BLIST_NOLUN}, /* locks up */
    6241     {"RELISYS", "Scorpio", NULL, BLIST_NOLUN}, /* responds to all lun */
    6242     {"SANKYO", "CP525", "6.64", BLIST_NOLUN}, /* causes failed REQ SENSE, extra reset */
    6243     - {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN},
    6244     + {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN | BLIST_BORKEN},
    6245     {"transtec", "T5008", "0001", BLIST_NOREPORTLUN },
    6246     {"YAMAHA", "CDR100", "1.00", BLIST_NOLUN}, /* locks up */
    6247     {"YAMAHA", "CDR102", "1.00", BLIST_NOLUN}, /* locks up */
    6248     @@ -255,7 +255,6 @@ static struct {
    6249     {"ST650211", "CF", NULL, BLIST_RETRY_HWERROR},
    6250     {"SUN", "T300", "*", BLIST_SPARSELUN},
    6251     {"SUN", "T4", "*", BLIST_SPARSELUN},
    6252     - {"TEXEL", "CD-ROM", "1.06", BLIST_BORKEN},
    6253     {"Tornado-", "F4", "*", BLIST_NOREPORTLUN},
    6254     {"TOSHIBA", "CDROM", NULL, BLIST_ISROM},
    6255     {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM},
    6256     diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
    6257     index fe3fa1e8517a..4903f15177cf 100644
    6258     --- a/drivers/spi/spi-armada-3700.c
    6259     +++ b/drivers/spi/spi-armada-3700.c
    6260     @@ -624,6 +624,11 @@ static int a3700_spi_transfer_one(struct spi_master *master,
    6261     a3700_spi_header_set(a3700_spi);
    6262    
    6263     if (xfer->rx_buf) {
    6264     + /* Clear WFIFO, since it's last 2 bytes are shifted out during
    6265     + * a read operation
    6266     + */
    6267     + spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, 0);
    6268     +
    6269     /* Set read data length */
    6270     spireg_write(a3700_spi, A3700_SPI_IF_DIN_CNT_REG,
    6271     a3700_spi->buf_len);
    6272     diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
    6273     index 123e4af58408..50260cb5056d 100644
    6274     --- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
    6275     +++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
    6276     @@ -75,6 +75,8 @@ int __init its_fsl_mc_msi_init(void)
    6277    
    6278     for (np = of_find_matching_node(NULL, its_device_id); np;
    6279     np = of_find_matching_node(np, its_device_id)) {
    6280     + if (!of_device_is_available(np))
    6281     + continue;
    6282     if (!of_property_read_bool(np, "msi-controller"))
    6283     continue;
    6284    
    6285     diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
    6286     index c55624703fdf..e0aa5f03004c 100644
    6287     --- a/drivers/tty/serial/8250/8250_exar.c
    6288     +++ b/drivers/tty/serial/8250/8250_exar.c
    6289     @@ -37,6 +37,7 @@
    6290     #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358
    6291     #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358
    6292    
    6293     +#define UART_EXAR_INT0 0x80
    6294     #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */
    6295    
    6296     #define UART_EXAR_FCTR 0x08 /* Feature Control Register */
    6297     @@ -124,6 +125,7 @@ struct exar8250_board {
    6298     struct exar8250 {
    6299     unsigned int nr;
    6300     struct exar8250_board *board;
    6301     + void __iomem *virt;
    6302     int line[0];
    6303     };
    6304    
    6305     @@ -134,12 +136,9 @@ static int default_setup(struct exar8250 *priv, struct pci_dev *pcidev,
    6306     const struct exar8250_board *board = priv->board;
    6307     unsigned int bar = 0;
    6308    
    6309     - if (!pcim_iomap_table(pcidev)[bar] && !pcim_iomap(pcidev, bar, 0))
    6310     - return -ENOMEM;
    6311     -
    6312     port->port.iotype = UPIO_MEM;
    6313     port->port.mapbase = pci_resource_start(pcidev, bar) + offset;
    6314     - port->port.membase = pcim_iomap_table(pcidev)[bar] + offset;
    6315     + port->port.membase = priv->virt + offset;
    6316     port->port.regshift = board->reg_shift;
    6317    
    6318     return 0;
    6319     @@ -423,6 +422,25 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev)
    6320     port->port.private_data = NULL;
    6321     }
    6322    
    6323     +/*
    6324     + * These Exar UARTs have an extra interrupt indicator that could fire for a
    6325     + * few interrupts that are not presented/cleared through IIR. One of which is
    6326     + * a wakeup interrupt when coming out of sleep. These interrupts are only
    6327     + * cleared by reading global INT0 or INT1 registers as interrupts are
    6328     + * associated with channel 0. The INT[3:0] registers _are_ accessible from each
    6329     + * channel's address space, but for the sake of bus efficiency we register a
    6330     + * dedicated handler at the PCI device level to handle them.
    6331     + */
    6332     +static irqreturn_t exar_misc_handler(int irq, void *data)
    6333     +{
    6334     + struct exar8250 *priv = data;
    6335     +
    6336     + /* Clear all PCI interrupts by reading INT0. No effect on IIR */
    6337     + ioread8(priv->virt + UART_EXAR_INT0);
    6338     +
    6339     + return IRQ_HANDLED;
    6340     +}
    6341     +
    6342     static int
    6343     exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
    6344     {
    6345     @@ -451,6 +469,9 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
    6346     return -ENOMEM;
    6347    
    6348     priv->board = board;
    6349     + priv->virt = pcim_iomap(pcidev, bar, 0);
    6350     + if (!priv->virt)
    6351     + return -ENOMEM;
    6352    
    6353     pci_set_master(pcidev);
    6354    
    6355     @@ -464,6 +485,11 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
    6356     uart.port.irq = pci_irq_vector(pcidev, 0);
    6357     uart.port.dev = &pcidev->dev;
    6358    
    6359     + rc = devm_request_irq(&pcidev->dev, uart.port.irq, exar_misc_handler,
    6360     + IRQF_SHARED, "exar_uart", priv);
    6361     + if (rc)
    6362     + return rc;
    6363     +
    6364     for (i = 0; i < nr_ports && i < maxnr; i++) {
    6365     rc = board->setup(priv, pcidev, &uart, i);
    6366     if (rc) {
    6367     diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
    6368     index fde34c84e707..e32c51d549c3 100644
    6369     --- a/drivers/tty/serial/8250/8250_port.c
    6370     +++ b/drivers/tty/serial/8250/8250_port.c
    6371     @@ -458,7 +458,6 @@ static void io_serial_out(struct uart_port *p, int offset, int value)
    6372     }
    6373    
    6374     static int serial8250_default_handle_irq(struct uart_port *port);
    6375     -static int exar_handle_irq(struct uart_port *port);
    6376    
    6377     static void set_io_from_upio(struct uart_port *p)
    6378     {
    6379     @@ -1903,26 +1902,6 @@ static int serial8250_default_handle_irq(struct uart_port *port)
    6380     return ret;
    6381     }
    6382    
    6383     -/*
    6384     - * These Exar UARTs have an extra interrupt indicator that could
    6385     - * fire for a few unimplemented interrupts. One of which is a
    6386     - * wakeup event when coming out of sleep. Put this here just
    6387     - * to be on the safe side that these interrupts don't go unhandled.
    6388     - */
    6389     -static int exar_handle_irq(struct uart_port *port)
    6390     -{
    6391     - unsigned int iir = serial_port_in(port, UART_IIR);
    6392     - int ret = 0;
    6393     -
    6394     - if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) &&
    6395     - serial_port_in(port, UART_EXAR_INT0) != 0)
    6396     - ret = 1;
    6397     -
    6398     - ret |= serial8250_handle_irq(port, iir);
    6399     -
    6400     - return ret;
    6401     -}
    6402     -
    6403     /*
    6404     * Newer 16550 compatible parts such as the SC16C650 & Altera 16550 Soft IP
    6405     * have a programmable TX threshold that triggers the THRE interrupt in
    6406     @@ -3107,11 +3086,6 @@ static void serial8250_config_port(struct uart_port *port, int flags)
    6407     if (port->type == PORT_UNKNOWN)
    6408     serial8250_release_std_resource(up);
    6409    
    6410     - /* Fixme: probably not the best place for this */
    6411     - if ((port->type == PORT_XR17V35X) ||
    6412     - (port->type == PORT_XR17D15X))
    6413     - port->handle_irq = exar_handle_irq;
    6414     -
    6415     register_dev_spec_attr_grp(up);
    6416     up->fcr = uart_config[up->port.type].fcr;
    6417     }
    6418     diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    6419     index ff5a1a8989d5..ff17e94ef465 100644
    6420     --- a/drivers/usb/musb/musb_core.c
    6421     +++ b/drivers/usb/musb/musb_core.c
    6422     @@ -1780,6 +1780,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
    6423     int vbus;
    6424     u8 devctl;
    6425    
    6426     + pm_runtime_get_sync(dev);
    6427     spin_lock_irqsave(&musb->lock, flags);
    6428     val = musb->a_wait_bcon;
    6429     vbus = musb_platform_get_vbus_status(musb);
    6430     @@ -1793,6 +1794,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf)
    6431     vbus = 0;
    6432     }
    6433     spin_unlock_irqrestore(&musb->lock, flags);
    6434     + pm_runtime_put_sync(dev);
    6435    
    6436     return sprintf(buf, "Vbus %s, timeout %lu msec\n",
    6437     vbus ? "on" : "off", val);
    6438     @@ -2496,11 +2498,11 @@ static int musb_remove(struct platform_device *pdev)
    6439     musb_disable_interrupts(musb);
    6440     musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
    6441     spin_unlock_irqrestore(&musb->lock, flags);
    6442     + musb_platform_exit(musb);
    6443    
    6444     pm_runtime_dont_use_autosuspend(musb->controller);
    6445     pm_runtime_put_sync(musb->controller);
    6446     pm_runtime_disable(musb->controller);
    6447     - musb_platform_exit(musb);
    6448     musb_phy_callback = NULL;
    6449     if (musb->dma_controller)
    6450     musb_dma_controller_destroy(musb->dma_controller);
    6451     @@ -2733,7 +2735,8 @@ static int musb_resume(struct device *dev)
    6452     if ((devctl & mask) != (musb->context.devctl & mask))
    6453     musb->port1_status = 0;
    6454    
    6455     - musb_start(musb);
    6456     + musb_enable_interrupts(musb);
    6457     + musb_platform_enable(musb);
    6458    
    6459     spin_lock_irqsave(&musb->lock, flags);
    6460     error = musb_run_resume_work(musb);
    6461     diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
    6462     index 1af4dee71337..0e242d1110ce 100644
    6463     --- a/drivers/watchdog/sp5100_tco.h
    6464     +++ b/drivers/watchdog/sp5100_tco.h
    6465     @@ -55,7 +55,7 @@
    6466     #define SB800_PM_WATCHDOG_CONFIG 0x4C
    6467    
    6468     #define SB800_PCI_WATCHDOG_DECODE_EN (1 << 0)
    6469     -#define SB800_PM_WATCHDOG_DISABLE (1 << 2)
    6470     +#define SB800_PM_WATCHDOG_DISABLE (1 << 1)
    6471     #define SB800_PM_WATCHDOG_SECOND_RES (3 << 0)
    6472     #define SB800_ACPI_MMIO_DECODE_EN (1 << 0)
    6473     #define SB800_ACPI_MMIO_SEL (1 << 1)
    6474     diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
    6475     index 2c6a9114d332..1fb374466e84 100644
    6476     --- a/drivers/xen/grant-table.c
    6477     +++ b/drivers/xen/grant-table.c
    6478     @@ -328,7 +328,7 @@ static void gnttab_handle_deferred(unsigned long unused)
    6479     if (entry->page) {
    6480     pr_debug("freeing g.e. %#x (pfn %#lx)\n",
    6481     entry->ref, page_to_pfn(entry->page));
    6482     - __free_page(entry->page);
    6483     + put_page(entry->page);
    6484     } else
    6485     pr_info("freeing g.e. %#x\n", entry->ref);
    6486     kfree(entry);
    6487     @@ -384,7 +384,7 @@ void gnttab_end_foreign_access(grant_ref_t ref, int readonly,
    6488     if (gnttab_end_foreign_access_ref(ref, readonly)) {
    6489     put_free_entry(ref);
    6490     if (page != 0)
    6491     - free_page(page);
    6492     + put_page(virt_to_page(page));
    6493     } else
    6494     gnttab_add_deferred(ref, readonly,
    6495     page ? virt_to_page(page) : NULL);
    6496     diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
    6497     index e2bb2a065741..21cc27509993 100644
    6498     --- a/fs/btrfs/ctree.c
    6499     +++ b/fs/btrfs/ctree.c
    6500     @@ -2774,6 +2774,8 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
    6501     * contention with the cow code
    6502     */
    6503     if (cow) {
    6504     + bool last_level = (level == (BTRFS_MAX_LEVEL - 1));
    6505     +
    6506     /*
    6507     * if we don't really need to cow this block
    6508     * then we don't want to set the path blocking,
    6509     @@ -2798,9 +2800,13 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
    6510     }
    6511    
    6512     btrfs_set_path_blocking(p);
    6513     - err = btrfs_cow_block(trans, root, b,
    6514     - p->nodes[level + 1],
    6515     - p->slots[level + 1], &b);
    6516     + if (last_level)
    6517     + err = btrfs_cow_block(trans, root, b, NULL, 0,
    6518     + &b);
    6519     + else
    6520     + err = btrfs_cow_block(trans, root, b,
    6521     + p->nodes[level + 1],
    6522     + p->slots[level + 1], &b);
    6523     if (err) {
    6524     ret = err;
    6525     goto done;
    6526     diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
    6527     index 167ce43cabe8..79f0f282a0ef 100644
    6528     --- a/fs/btrfs/disk-io.c
    6529     +++ b/fs/btrfs/disk-io.c
    6530     @@ -4063,9 +4063,11 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info)
    6531     btrfs_err(fs_info, "no valid FS found");
    6532     ret = -EINVAL;
    6533     }
    6534     - if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP)
    6535     - btrfs_warn(fs_info, "unrecognized super flag: %llu",
    6536     + if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) {
    6537     + btrfs_err(fs_info, "unrecognized or unsupported super flag: %llu",
    6538     btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP);
    6539     + ret = -EINVAL;
    6540     + }
    6541     if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) {
    6542     btrfs_err(fs_info, "tree_root level too big: %d >= %d",
    6543     btrfs_super_root_level(sb), BTRFS_MAX_LEVEL);
    6544     diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
    6545     index d564a7049d7f..5690feded0de 100644
    6546     --- a/fs/btrfs/file.c
    6547     +++ b/fs/btrfs/file.c
    6548     @@ -2018,10 +2018,19 @@ int btrfs_release_file(struct inode *inode, struct file *filp)
    6549     static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end)
    6550     {
    6551     int ret;
    6552     + struct blk_plug plug;
    6553    
    6554     + /*
    6555     + * This is only called in fsync, which would do synchronous writes, so
    6556     + * a plug can merge adjacent IOs as much as possible. Esp. in case of
    6557     + * multiple disks using raid profile, a large IO can be split to
    6558     + * several segments of stripe length (currently 64K).
    6559     + */
    6560     + blk_start_plug(&plug);
    6561     atomic_inc(&BTRFS_I(inode)->sync_writers);
    6562     ret = btrfs_fdatawrite_range(inode, start, end);
    6563     atomic_dec(&BTRFS_I(inode)->sync_writers);
    6564     + blk_finish_plug(&plug);
    6565    
    6566     return ret;
    6567     }
    6568     diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
    6569     index dfa360d18ae2..9f21c29d0259 100644
    6570     --- a/fs/btrfs/inode.c
    6571     +++ b/fs/btrfs/inode.c
    6572     @@ -42,6 +42,7 @@
    6573     #include <linux/blkdev.h>
    6574     #include <linux/posix_acl_xattr.h>
    6575     #include <linux/uio.h>
    6576     +#include <asm/unaligned.h>
    6577     #include "ctree.h"
    6578     #include "disk-io.h"
    6579     #include "transaction.h"
    6580     @@ -5980,11 +5981,13 @@ static int btrfs_filldir(void *addr, int entries, struct dir_context *ctx)
    6581     struct dir_entry *entry = addr;
    6582     char *name = (char *)(entry + 1);
    6583    
    6584     - ctx->pos = entry->offset;
    6585     - if (!dir_emit(ctx, name, entry->name_len, entry->ino,
    6586     - entry->type))
    6587     + ctx->pos = get_unaligned(&entry->offset);
    6588     + if (!dir_emit(ctx, name, get_unaligned(&entry->name_len),
    6589     + get_unaligned(&entry->ino),
    6590     + get_unaligned(&entry->type)))
    6591     return 1;
    6592     - addr += sizeof(struct dir_entry) + entry->name_len;
    6593     + addr += sizeof(struct dir_entry) +
    6594     + get_unaligned(&entry->name_len);
    6595     ctx->pos++;
    6596     }
    6597     return 0;
    6598     @@ -6078,14 +6081,15 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx)
    6599     }
    6600    
    6601     entry = addr;
    6602     - entry->name_len = name_len;
    6603     + put_unaligned(name_len, &entry->name_len);
    6604     name_ptr = (char *)(entry + 1);
    6605     read_extent_buffer(leaf, name_ptr, (unsigned long)(di + 1),
    6606     name_len);
    6607     - entry->type = btrfs_filetype_table[btrfs_dir_type(leaf, di)];
    6608     + put_unaligned(btrfs_filetype_table[btrfs_dir_type(leaf, di)],
    6609     + &entry->type);
    6610     btrfs_dir_item_key_to_cpu(leaf, di, &location);
    6611     - entry->ino = location.objectid;
    6612     - entry->offset = found_key.offset;
    6613     + put_unaligned(location.objectid, &entry->ino);
    6614     + put_unaligned(found_key.offset, &entry->offset);
    6615     entries++;
    6616     addr += sizeof(struct dir_entry) + name_len;
    6617     total_len += sizeof(struct dir_entry) + name_len;
    6618     @@ -7261,19 +7265,12 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
    6619     * existing will always be non-NULL, since there must be
    6620     * extent causing the -EEXIST.
    6621     */
    6622     - if (existing->start == em->start &&
    6623     - extent_map_end(existing) >= extent_map_end(em) &&
    6624     - em->block_start == existing->block_start) {
    6625     - /*
    6626     - * The existing extent map already encompasses the
    6627     - * entire extent map we tried to add.
    6628     - */
    6629     + if (start >= existing->start &&
    6630     + start < extent_map_end(existing)) {
    6631     free_extent_map(em);
    6632     em = existing;
    6633     err = 0;
    6634     -
    6635     - } else if (start >= extent_map_end(existing) ||
    6636     - start <= existing->start) {
    6637     + } else {
    6638     /*
    6639     * The existing extent map is the one nearest to
    6640     * the [start, start + len) range which overlaps
    6641     @@ -7285,10 +7282,6 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode,
    6642     free_extent_map(em);
    6643     em = NULL;
    6644     }
    6645     - } else {
    6646     - free_extent_map(em);
    6647     - em = existing;
    6648     - err = 0;
    6649     }
    6650     }
    6651     write_unlock(&em_tree->lock);
    6652     diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
    6653     index 32b186c5694c..2e995e565633 100644
    6654     --- a/fs/btrfs/raid56.c
    6655     +++ b/fs/btrfs/raid56.c
    6656     @@ -858,10 +858,17 @@ static void __free_raid_bio(struct btrfs_raid_bio *rbio)
    6657     kfree(rbio);
    6658     }
    6659    
    6660     -static void free_raid_bio(struct btrfs_raid_bio *rbio)
    6661     +static void rbio_endio_bio_list(struct bio *cur, blk_status_t err)
    6662     {
    6663     - unlock_stripe(rbio);
    6664     - __free_raid_bio(rbio);
    6665     + struct bio *next;
    6666     +
    6667     + while (cur) {
    6668     + next = cur->bi_next;
    6669     + cur->bi_next = NULL;
    6670     + cur->bi_status = err;
    6671     + bio_endio(cur);
    6672     + cur = next;
    6673     + }
    6674     }
    6675    
    6676     /*
    6677     @@ -871,20 +878,26 @@ static void free_raid_bio(struct btrfs_raid_bio *rbio)
    6678     static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err)
    6679     {
    6680     struct bio *cur = bio_list_get(&rbio->bio_list);
    6681     - struct bio *next;
    6682     + struct bio *extra;
    6683    
    6684     if (rbio->generic_bio_cnt)
    6685     btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt);
    6686    
    6687     - free_raid_bio(rbio);
    6688     + /*
    6689     + * At this moment, rbio->bio_list is empty, however since rbio does not
    6690     + * always have RBIO_RMW_LOCKED_BIT set and rbio is still linked on the
    6691     + * hash list, rbio may be merged with others so that rbio->bio_list
    6692     + * becomes non-empty.
    6693     + * Once unlock_stripe() is done, rbio->bio_list will not be updated any
    6694     + * more and we can call bio_endio() on all queued bios.
    6695     + */
    6696     + unlock_stripe(rbio);
    6697     + extra = bio_list_get(&rbio->bio_list);
    6698     + __free_raid_bio(rbio);
    6699    
    6700     - while (cur) {
    6701     - next = cur->bi_next;
    6702     - cur->bi_next = NULL;
    6703     - cur->bi_status = err;
    6704     - bio_endio(cur);
    6705     - cur = next;
    6706     - }
    6707     + rbio_endio_bio_list(cur, err);
    6708     + if (extra)
    6709     + rbio_endio_bio_list(extra, err);
    6710     }
    6711    
    6712     /*
    6713     @@ -2159,11 +2172,21 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio,
    6714     }
    6715    
    6716     /*
    6717     - * reconstruct from the q stripe if they are
    6718     - * asking for mirror 3
    6719     + * Loop retry:
    6720     + * for 'mirror == 2', reconstruct from all other stripes.
    6721     + * for 'mirror_num > 2', select a stripe to fail on every retry.
    6722     */
    6723     - if (mirror_num == 3)
    6724     - rbio->failb = rbio->real_stripes - 2;
    6725     + if (mirror_num > 2) {
    6726     + /*
    6727     + * 'mirror == 3' is to fail the p stripe and
    6728     + * reconstruct from the q stripe. 'mirror > 3' is to
    6729     + * fail a data stripe and reconstruct from p+q stripe.
    6730     + */
    6731     + rbio->failb = rbio->real_stripes - (mirror_num - 1);
    6732     + ASSERT(rbio->failb > 0);
    6733     + if (rbio->failb <= rbio->faila)
    6734     + rbio->failb--;
    6735     + }
    6736    
    6737     ret = lock_stripe_add(rbio);
    6738    
    6739     diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
    6740     index 71b3cd634436..b983e7fb200b 100644
    6741     --- a/fs/btrfs/volumes.c
    6742     +++ b/fs/btrfs/volumes.c
    6743     @@ -5101,7 +5101,14 @@ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len)
    6744     else if (map->type & BTRFS_BLOCK_GROUP_RAID5)
    6745     ret = 2;
    6746     else if (map->type & BTRFS_BLOCK_GROUP_RAID6)
    6747     - ret = 3;
    6748     + /*
    6749     + * There could be two corrupted data stripes, we need
    6750     + * to loop retry in order to rebuild the correct data.
    6751     + *
    6752     + * Fail a stripe at a time on every retry except the
    6753     + * stripe under reconstruction.
    6754     + */
    6755     + ret = map->num_stripes;
    6756     else
    6757     ret = 1;
    6758     free_extent_map(em);
    6759     diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
    6760     index 35dc5bf01ee2..7fd39ea6e22e 100644
    6761     --- a/fs/cifs/cifssmb.c
    6762     +++ b/fs/cifs/cifssmb.c
    6763     @@ -6331,9 +6331,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
    6764     pSMB->InformationLevel =
    6765     cpu_to_le16(SMB_SET_FILE_EA);
    6766    
    6767     - parm_data =
    6768     - (struct fealist *) (((char *) &pSMB->hdr.Protocol) +
    6769     - offset);
    6770     + parm_data = (void *)pSMB + offsetof(struct smb_hdr, Protocol) + offset;
    6771     pSMB->ParameterOffset = cpu_to_le16(param_offset);
    6772     pSMB->DataOffset = cpu_to_le16(offset);
    6773     pSMB->SetupCount = 1;
    6774     diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
    6775     index 81ba6e0d88d8..925844343038 100644
    6776     --- a/fs/cifs/dir.c
    6777     +++ b/fs/cifs/dir.c
    6778     @@ -684,6 +684,9 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
    6779     goto mknod_out;
    6780     }
    6781    
    6782     + if (!S_ISCHR(mode) && !S_ISBLK(mode))
    6783     + goto mknod_out;
    6784     +
    6785     if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL))
    6786     goto mknod_out;
    6787    
    6788     @@ -692,10 +695,8 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
    6789    
    6790     buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL);
    6791     if (buf == NULL) {
    6792     - kfree(full_path);
    6793     rc = -ENOMEM;
    6794     - free_xid(xid);
    6795     - return rc;
    6796     + goto mknod_out;
    6797     }
    6798    
    6799     if (backup_cred(cifs_sb))
    6800     @@ -742,7 +743,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode,
    6801     pdev->minor = cpu_to_le64(MINOR(device_number));
    6802     rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
    6803     &bytes_written, iov, 1);
    6804     - } /* else if (S_ISFIFO) */
    6805     + }
    6806     tcon->ses->server->ops->close(xid, tcon, &fid);
    6807     d_drop(direntry);
    6808    
    6809     diff --git a/fs/dax.c b/fs/dax.c
    6810     index 191306cd8b6b..ddb4981ae32e 100644
    6811     --- a/fs/dax.c
    6812     +++ b/fs/dax.c
    6813     @@ -630,8 +630,8 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping,
    6814     set_pmd_at(vma->vm_mm, address, pmdp, pmd);
    6815     mmu_notifier_invalidate_range(vma->vm_mm, start, end);
    6816     unlock_pmd:
    6817     - spin_unlock(ptl);
    6818     #endif
    6819     + spin_unlock(ptl);
    6820     } else {
    6821     if (pfn != pte_pfn(*ptep))
    6822     goto unlock_pte;
    6823     diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
    6824     index d5021ba69e7a..e5673a9b2619 100644
    6825     --- a/fs/f2fs/gc.c
    6826     +++ b/fs/f2fs/gc.c
    6827     @@ -696,7 +696,12 @@ static void move_data_block(struct inode *inode, block_t bidx,
    6828     fio.op = REQ_OP_WRITE;
    6829     fio.op_flags = REQ_SYNC;
    6830     fio.new_blkaddr = newaddr;
    6831     - f2fs_submit_page_write(&fio);
    6832     + err = f2fs_submit_page_write(&fio);
    6833     + if (err) {
    6834     + if (PageWriteback(fio.encrypted_page))
    6835     + end_page_writeback(fio.encrypted_page);
    6836     + goto put_page_out;
    6837     + }
    6838    
    6839     f2fs_update_iostat(fio.sbi, FS_GC_DATA_IO, F2FS_BLKSIZE);
    6840    
    6841     diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
    6842     index e96c6b05e43e..3c96f4bdc549 100644
    6843     --- a/fs/jffs2/fs.c
    6844     +++ b/fs/jffs2/fs.c
    6845     @@ -362,7 +362,6 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino)
    6846     ret = -EIO;
    6847     error:
    6848     mutex_unlock(&f->sem);
    6849     - jffs2_do_clear_inode(c, f);
    6850     iget_failed(inode);
    6851     return ERR_PTR(ret);
    6852     }
    6853     diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
    6854     index 2241d52710f7..ae8f43d270d6 100644
    6855     --- a/fs/nfs/nfs4proc.c
    6856     +++ b/fs/nfs/nfs4proc.c
    6857     @@ -1885,7 +1885,7 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta
    6858     return ret;
    6859     }
    6860    
    6861     -static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, int err)
    6862     +static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, struct file_lock *fl, int err)
    6863     {
    6864     switch (err) {
    6865     default:
    6866     @@ -1932,7 +1932,11 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
    6867     return -EAGAIN;
    6868     case -ENOMEM:
    6869     case -NFS4ERR_DENIED:
    6870     - /* kill_proc(fl->fl_pid, SIGLOST, 1); */
    6871     + if (fl) {
    6872     + struct nfs4_lock_state *lsp = fl->fl_u.nfs4_fl.owner;
    6873     + if (lsp)
    6874     + set_bit(NFS_LOCK_LOST, &lsp->ls_flags);
    6875     + }
    6876     return 0;
    6877     }
    6878     return err;
    6879     @@ -1968,7 +1972,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx,
    6880     err = nfs4_open_recover_helper(opendata, FMODE_READ);
    6881     }
    6882     nfs4_opendata_put(opendata);
    6883     - return nfs4_handle_delegation_recall_error(server, state, stateid, err);
    6884     + return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err);
    6885     }
    6886    
    6887     static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata)
    6888     @@ -6595,7 +6599,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
    6889     if (err != 0)
    6890     return err;
    6891     err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
    6892     - return nfs4_handle_delegation_recall_error(server, state, stateid, err);
    6893     + return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
    6894     }
    6895    
    6896     struct nfs_release_lockowner_data {
    6897     diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
    6898     index 0378e2257ca7..45873ed92057 100644
    6899     --- a/fs/nfs/nfs4state.c
    6900     +++ b/fs/nfs/nfs4state.c
    6901     @@ -1447,6 +1447,7 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_
    6902     struct inode *inode = state->inode;
    6903     struct nfs_inode *nfsi = NFS_I(inode);
    6904     struct file_lock *fl;
    6905     + struct nfs4_lock_state *lsp;
    6906     int status = 0;
    6907     struct file_lock_context *flctx = inode->i_flctx;
    6908     struct list_head *list;
    6909     @@ -1487,7 +1488,9 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_
    6910     case -NFS4ERR_DENIED:
    6911     case -NFS4ERR_RECLAIM_BAD:
    6912     case -NFS4ERR_RECLAIM_CONFLICT:
    6913     - /* kill_proc(fl->fl_pid, SIGLOST, 1); */
    6914     + lsp = fl->fl_u.nfs4_fl.owner;
    6915     + if (lsp)
    6916     + set_bit(NFS_LOCK_LOST, &lsp->ls_flags);
    6917     status = 0;
    6918     }
    6919     spin_lock(&flctx->flc_lock);
    6920     diff --git a/fs/nfs/nfs4sysctl.c b/fs/nfs/nfs4sysctl.c
    6921     index 0d91d84e5822..c394e4447100 100644
    6922     --- a/fs/nfs/nfs4sysctl.c
    6923     +++ b/fs/nfs/nfs4sysctl.c
    6924     @@ -32,7 +32,7 @@ static struct ctl_table nfs4_cb_sysctls[] = {
    6925     .data = &nfs_idmap_cache_timeout,
    6926     .maxlen = sizeof(int),
    6927     .mode = 0644,
    6928     - .proc_handler = proc_dointvec_jiffies,
    6929     + .proc_handler = proc_dointvec,
    6930     },
    6931     { }
    6932     };
    6933     diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
    6934     index 40b5cc97f7b0..917fadca8a7b 100644
    6935     --- a/fs/ocfs2/acl.c
    6936     +++ b/fs/ocfs2/acl.c
    6937     @@ -311,7 +311,9 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type)
    6938     if (had_lock < 0)
    6939     return ERR_PTR(had_lock);
    6940    
    6941     + down_read(&OCFS2_I(inode)->ip_xattr_sem);
    6942     acl = ocfs2_get_acl_nolock(inode, type, di_bh);
    6943     + up_read(&OCFS2_I(inode)->ip_xattr_sem);
    6944    
    6945     ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);
    6946     brelse(di_bh);
    6947     @@ -330,7 +332,9 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh)
    6948     if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL))
    6949     return 0;
    6950    
    6951     + down_read(&OCFS2_I(inode)->ip_xattr_sem);
    6952     acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh);
    6953     + up_read(&OCFS2_I(inode)->ip_xattr_sem);
    6954     if (IS_ERR(acl) || !acl)
    6955     return PTR_ERR(acl);
    6956     ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
    6957     @@ -361,8 +365,10 @@ int ocfs2_init_acl(handle_t *handle,
    6958    
    6959     if (!S_ISLNK(inode->i_mode)) {
    6960     if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
    6961     + down_read(&OCFS2_I(dir)->ip_xattr_sem);
    6962     acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT,
    6963     dir_bh);
    6964     + up_read(&OCFS2_I(dir)->ip_xattr_sem);
    6965     if (IS_ERR(acl))
    6966     return PTR_ERR(acl);
    6967     }
    6968     diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
    6969     index 36304434eacf..e5dcea6cee5f 100644
    6970     --- a/fs/ocfs2/journal.c
    6971     +++ b/fs/ocfs2/journal.c
    6972     @@ -666,23 +666,24 @@ static int __ocfs2_journal_access(handle_t *handle,
    6973     /* we can safely remove this assertion after testing. */
    6974     if (!buffer_uptodate(bh)) {
    6975     mlog(ML_ERROR, "giving me a buffer that's not uptodate!\n");
    6976     - mlog(ML_ERROR, "b_blocknr=%llu\n",
    6977     - (unsigned long long)bh->b_blocknr);
    6978     + mlog(ML_ERROR, "b_blocknr=%llu, b_state=0x%lx\n",
    6979     + (unsigned long long)bh->b_blocknr, bh->b_state);
    6980    
    6981     lock_buffer(bh);
    6982     /*
    6983     - * A previous attempt to write this buffer head failed.
    6984     - * Nothing we can do but to retry the write and hope for
    6985     - * the best.
    6986     + * A previous transaction with a couple of buffer heads fail
    6987     + * to checkpoint, so all the bhs are marked as BH_Write_EIO.
    6988     + * For current transaction, the bh is just among those error
    6989     + * bhs which previous transaction handle. We can't just clear
    6990     + * its BH_Write_EIO and reuse directly, since other bhs are
    6991     + * not written to disk yet and that will cause metadata
    6992     + * inconsistency. So we should set fs read-only to avoid
    6993     + * further damage.
    6994     */
    6995     if (buffer_write_io_error(bh) && !buffer_uptodate(bh)) {
    6996     - clear_buffer_write_io_error(bh);
    6997     - set_buffer_uptodate(bh);
    6998     - }
    6999     -
    7000     - if (!buffer_uptodate(bh)) {
    7001     unlock_buffer(bh);
    7002     - return -EIO;
    7003     + return ocfs2_error(osb->sb, "A previous attempt to "
    7004     + "write this buffer head failed\n");
    7005     }
    7006     unlock_buffer(bh);
    7007     }
    7008     diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
    7009     index 80733496b22a..24ab735d91dd 100644
    7010     --- a/fs/ocfs2/super.c
    7011     +++ b/fs/ocfs2/super.c
    7012     @@ -474,9 +474,8 @@ static int ocfs2_init_global_system_inodes(struct ocfs2_super *osb)
    7013     new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
    7014     if (!new) {
    7015     ocfs2_release_system_inodes(osb);
    7016     - status = -EINVAL;
    7017     + status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
    7018     mlog_errno(status);
    7019     - /* FIXME: Should ERROR_RO_FS */
    7020     mlog(ML_ERROR, "Unable to load system inode %d, "
    7021     "possibly corrupt fs?", i);
    7022     goto bail;
    7023     @@ -505,7 +504,7 @@ static int ocfs2_init_local_system_inodes(struct ocfs2_super *osb)
    7024     new = ocfs2_get_system_file_inode(osb, i, osb->slot_num);
    7025     if (!new) {
    7026     ocfs2_release_system_inodes(osb);
    7027     - status = -EINVAL;
    7028     + status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL;
    7029     mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n",
    7030     status, i, osb->slot_num);
    7031     goto bail;
    7032     diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
    7033     index 5fdf269ba82e..fb0a4eec310c 100644
    7034     --- a/fs/ocfs2/xattr.c
    7035     +++ b/fs/ocfs2/xattr.c
    7036     @@ -638,9 +638,11 @@ int ocfs2_calc_xattr_init(struct inode *dir,
    7037     si->value_len);
    7038    
    7039     if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
    7040     + down_read(&OCFS2_I(dir)->ip_xattr_sem);
    7041     acl_len = ocfs2_xattr_get_nolock(dir, dir_bh,
    7042     OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT,
    7043     "", NULL, 0);
    7044     + up_read(&OCFS2_I(dir)->ip_xattr_sem);
    7045     if (acl_len > 0) {
    7046     a_size = ocfs2_xattr_entry_real_size(0, acl_len);
    7047     if (S_ISDIR(mode))
    7048     diff --git a/fs/proc/base.c b/fs/proc/base.c
    7049     index 9d357b2ea6cb..2ff11a693360 100644
    7050     --- a/fs/proc/base.c
    7051     +++ b/fs/proc/base.c
    7052     @@ -100,6 +100,8 @@
    7053     #include "internal.h"
    7054     #include "fd.h"
    7055    
    7056     +#include "../../lib/kstrtox.h"
    7057     +
    7058     /* NOTE:
    7059     * Implementing inode permission operations in /proc is almost
    7060     * certainly an error. Permission checks need to happen during
    7061     @@ -1908,8 +1910,33 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx,
    7062     static int dname_to_vma_addr(struct dentry *dentry,
    7063     unsigned long *start, unsigned long *end)
    7064     {
    7065     - if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2)
    7066     + const char *str = dentry->d_name.name;
    7067     + unsigned long long sval, eval;
    7068     + unsigned int len;
    7069     +
    7070     + len = _parse_integer(str, 16, &sval);
    7071     + if (len & KSTRTOX_OVERFLOW)
    7072     + return -EINVAL;
    7073     + if (sval != (unsigned long)sval)
    7074     + return -EINVAL;
    7075     + str += len;
    7076     +
    7077     + if (*str != '-')
    7078     return -EINVAL;
    7079     + str++;
    7080     +
    7081     + len = _parse_integer(str, 16, &eval);
    7082     + if (len & KSTRTOX_OVERFLOW)
    7083     + return -EINVAL;
    7084     + if (eval != (unsigned long)eval)
    7085     + return -EINVAL;
    7086     + str += len;
    7087     +
    7088     + if (*str != '\0')
    7089     + return -EINVAL;
    7090     +
    7091     + *start = sval;
    7092     + *end = eval;
    7093    
    7094     return 0;
    7095     }
    7096     diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
    7097     index e8a93bc8285d..d1e82761de81 100644
    7098     --- a/fs/proc/kcore.c
    7099     +++ b/fs/proc/kcore.c
    7100     @@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
    7101     /* we have to zero-fill user buffer even if no read */
    7102     if (copy_to_user(buffer, buf, tsz))
    7103     return -EFAULT;
    7104     + } else if (m->type == KCORE_USER) {
    7105     + /* User page is handled prior to normal kernel page: */
    7106     + if (copy_to_user(buffer, (char *)start, tsz))
    7107     + return -EFAULT;
    7108     } else {
    7109     if (kern_addr_valid(start)) {
    7110     /*
    7111     diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
    7112     index 0a213dcba2a1..ba3d0e0f8615 100644
    7113     --- a/fs/ubifs/tnc.c
    7114     +++ b/fs/ubifs/tnc.c
    7115     @@ -1890,35 +1890,28 @@ static int search_dh_cookie(struct ubifs_info *c, const union ubifs_key *key,
    7116     union ubifs_key *dkey;
    7117    
    7118     for (;;) {
    7119     - if (!err) {
    7120     - err = tnc_next(c, &znode, n);
    7121     - if (err)
    7122     - goto out;
    7123     - }
    7124     -
    7125     zbr = &znode->zbranch[*n];
    7126     dkey = &zbr->key;
    7127    
    7128     if (key_inum(c, dkey) != key_inum(c, key) ||
    7129     key_type(c, dkey) != key_type(c, key)) {
    7130     - err = -ENOENT;
    7131     - goto out;
    7132     + return -ENOENT;
    7133     }
    7134    
    7135     err = tnc_read_hashed_node(c, zbr, dent);
    7136     if (err)
    7137     - goto out;
    7138     + return err;
    7139    
    7140     if (key_hash(c, key) == key_hash(c, dkey) &&
    7141     le32_to_cpu(dent->cookie) == cookie) {
    7142     *zn = znode;
    7143     - goto out;
    7144     + return 0;
    7145     }
    7146     - }
    7147     -
    7148     -out:
    7149    
    7150     - return err;
    7151     + err = tnc_next(c, &znode, n);
    7152     + if (err)
    7153     + return err;
    7154     + }
    7155     }
    7156    
    7157     static int do_lookup_dh(struct ubifs_info *c, const union ubifs_key *key,
    7158     diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
    7159     index 77b891a8f191..2142bceaeb75 100644
    7160     --- a/include/asm-generic/pgtable.h
    7161     +++ b/include/asm-generic/pgtable.h
    7162     @@ -309,6 +309,21 @@ extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
    7163     extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp);
    7164     #endif
    7165    
    7166     +#ifdef CONFIG_TRANSPARENT_HUGEPAGE
    7167     +/*
    7168     + * This is an implementation of pmdp_establish() that is only suitable for an
    7169     + * architecture that doesn't have hardware dirty/accessed bits. In this case we
    7170     + * can't race with CPU which sets these bits and non-atomic aproach is fine.
    7171     + */
    7172     +static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma,
    7173     + unsigned long address, pmd_t *pmdp, pmd_t pmd)
    7174     +{
    7175     + pmd_t old_pmd = *pmdp;
    7176     + set_pmd_at(vma->vm_mm, address, pmdp, pmd);
    7177     + return old_pmd;
    7178     +}
    7179     +#endif
    7180     +
    7181     #ifndef __HAVE_ARCH_PMDP_INVALIDATE
    7182     extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
    7183     pmd_t *pmdp);
    7184     diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
    7185     index 8d3125c493b2..db461a07bf38 100644
    7186     --- a/include/linux/cpumask.h
    7187     +++ b/include/linux/cpumask.h
    7188     @@ -165,6 +165,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node)
    7189     for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
    7190     #define for_each_cpu_not(cpu, mask) \
    7191     for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask)
    7192     +#define for_each_cpu_wrap(cpu, mask, start) \
    7193     + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start))
    7194     #define for_each_cpu_and(cpu, mask, and) \
    7195     for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and)
    7196     #else
    7197     diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
    7198     index 2d9f80848d4b..c643cc7fefb5 100644
    7199     --- a/include/linux/etherdevice.h
    7200     +++ b/include/linux/etherdevice.h
    7201     @@ -31,7 +31,7 @@
    7202     #ifdef __KERNEL__
    7203     struct device;
    7204     int eth_platform_get_mac_address(struct device *dev, u8 *mac_addr);
    7205     -unsigned char *arch_get_platform_get_mac_address(void);
    7206     +unsigned char *arch_get_platform_mac_address(void);
    7207     u32 eth_get_headlen(void *data, unsigned int max_len);
    7208     __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev);
    7209     extern const struct header_ops eth_header_ops;
    7210     diff --git a/include/linux/kcore.h b/include/linux/kcore.h
    7211     index 7ff25a808fef..80db19d3a505 100644
    7212     --- a/include/linux/kcore.h
    7213     +++ b/include/linux/kcore.h
    7214     @@ -10,6 +10,7 @@ enum kcore_type {
    7215     KCORE_VMALLOC,
    7216     KCORE_RAM,
    7217     KCORE_VMEMMAP,
    7218     + KCORE_USER,
    7219     KCORE_OTHER,
    7220     };
    7221    
    7222     diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
    7223     index 8e46c35d654b..54f346a45cd0 100644
    7224     --- a/include/linux/netfilter/x_tables.h
    7225     +++ b/include/linux/netfilter/x_tables.h
    7226     @@ -301,6 +301,7 @@ int xt_data_to_user(void __user *dst, const void *src,
    7227    
    7228     void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
    7229     struct xt_counters_info *info, bool compat);
    7230     +struct xt_counters *xt_counters_alloc(unsigned int counters);
    7231    
    7232     struct xt_table *xt_register_table(struct net *net,
    7233     const struct xt_table *table,
    7234     @@ -507,7 +508,7 @@ void xt_compat_unlock(u_int8_t af);
    7235    
    7236     int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta);
    7237     void xt_compat_flush_offsets(u_int8_t af);
    7238     -void xt_compat_init_offsets(u_int8_t af, unsigned int number);
    7239     +int xt_compat_init_offsets(u8 af, unsigned int number);
    7240     int xt_compat_calc_jump(u_int8_t af, unsigned int offset);
    7241    
    7242     int xt_compat_match_offset(const struct xt_match *match);
    7243     diff --git a/include/linux/pci.h b/include/linux/pci.h
    7244     index d16a7c037ec0..727e309baa5e 100644
    7245     --- a/include/linux/pci.h
    7246     +++ b/include/linux/pci.h
    7247     @@ -1688,6 +1688,13 @@ static inline int pci_get_new_domain_nr(void) { return -ENOSYS; }
    7248     #define dev_is_pf(d) (false)
    7249     static inline bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags)
    7250     { return false; }
    7251     +static inline int pci_irqd_intx_xlate(struct irq_domain *d,
    7252     + struct device_node *node,
    7253     + const u32 *intspec,
    7254     + unsigned int intsize,
    7255     + unsigned long *out_hwirq,
    7256     + unsigned int *out_type)
    7257     +{ return -EINVAL; }
    7258     #endif /* CONFIG_PCI */
    7259    
    7260     /* Include architecture-dependent settings and functions */
    7261     diff --git a/include/linux/property.h b/include/linux/property.h
    7262     index 6bebee13c5e0..89d94b349912 100644
    7263     --- a/include/linux/property.h
    7264     +++ b/include/linux/property.h
    7265     @@ -206,7 +206,7 @@ struct property_entry {
    7266     */
    7267    
    7268     #define PROPERTY_ENTRY_INTEGER_ARRAY(_name_, _type_, _val_) \
    7269     -{ \
    7270     +(struct property_entry) { \
    7271     .name = _name_, \
    7272     .length = ARRAY_SIZE(_val_) * sizeof(_type_), \
    7273     .is_array = true, \
    7274     @@ -224,7 +224,7 @@ struct property_entry {
    7275     PROPERTY_ENTRY_INTEGER_ARRAY(_name_, u64, _val_)
    7276    
    7277     #define PROPERTY_ENTRY_STRING_ARRAY(_name_, _val_) \
    7278     -{ \
    7279     +(struct property_entry) { \
    7280     .name = _name_, \
    7281     .length = ARRAY_SIZE(_val_) * sizeof(const char *), \
    7282     .is_array = true, \
    7283     @@ -233,7 +233,7 @@ struct property_entry {
    7284     }
    7285    
    7286     #define PROPERTY_ENTRY_INTEGER(_name_, _type_, _val_) \
    7287     -{ \
    7288     +(struct property_entry) { \
    7289     .name = _name_, \
    7290     .length = sizeof(_type_), \
    7291     .is_string = false, \
    7292     @@ -250,7 +250,7 @@ struct property_entry {
    7293     PROPERTY_ENTRY_INTEGER(_name_, u64, _val_)
    7294    
    7295     #define PROPERTY_ENTRY_STRING(_name_, _val_) \
    7296     -{ \
    7297     +(struct property_entry) { \
    7298     .name = _name_, \
    7299     .length = sizeof(_val_), \
    7300     .is_string = true, \
    7301     @@ -258,7 +258,7 @@ struct property_entry {
    7302     }
    7303    
    7304     #define PROPERTY_ENTRY_BOOL(_name_) \
    7305     -{ \
    7306     +(struct property_entry) { \
    7307     .name = _name_, \
    7308     }
    7309    
    7310     diff --git a/include/linux/suspend.h b/include/linux/suspend.h
    7311     index d60b0f5c38d5..8544357d92d0 100644
    7312     --- a/include/linux/suspend.h
    7313     +++ b/include/linux/suspend.h
    7314     @@ -384,6 +384,8 @@ extern int swsusp_page_is_forbidden(struct page *);
    7315     extern void swsusp_set_page_free(struct page *);
    7316     extern void swsusp_unset_page_free(struct page *);
    7317     extern unsigned long get_safe_page(gfp_t gfp_mask);
    7318     +extern asmlinkage int swsusp_arch_suspend(void);
    7319     +extern asmlinkage int swsusp_arch_resume(void);
    7320    
    7321     extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
    7322     extern int hibernate(void);
    7323     diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
    7324     index 6533aa64f009..08f3d8699a27 100644
    7325     --- a/include/rdma/ib_verbs.h
    7326     +++ b/include/rdma/ib_verbs.h
    7327     @@ -866,6 +866,7 @@ struct ib_mr_status {
    7328     __attribute_const__ enum ib_rate mult_to_ib_rate(int mult);
    7329    
    7330     enum rdma_ah_attr_type {
    7331     + RDMA_AH_ATTR_TYPE_UNDEFINED,
    7332     RDMA_AH_ATTR_TYPE_IB,
    7333     RDMA_AH_ATTR_TYPE_ROCE,
    7334     RDMA_AH_ATTR_TYPE_OPA,
    7335     @@ -3762,18 +3763,24 @@ static inline void rdma_ah_set_grh(struct rdma_ah_attr *attr,
    7336     grh->traffic_class = traffic_class;
    7337     }
    7338    
    7339     -/*Get AH type */
    7340     +/**
    7341     + * rdma_ah_find_type - Return address handle type.
    7342     + *
    7343     + * @dev: Device to be checked
    7344     + * @port_num: Port number
    7345     + */
    7346     static inline enum rdma_ah_attr_type rdma_ah_find_type(struct ib_device *dev,
    7347     - u32 port_num)
    7348     + u8 port_num)
    7349     {
    7350     - if ((rdma_protocol_roce(dev, port_num)) ||
    7351     - (rdma_protocol_iwarp(dev, port_num)))
    7352     + if (rdma_protocol_roce(dev, port_num))
    7353     return RDMA_AH_ATTR_TYPE_ROCE;
    7354     - else if ((rdma_protocol_ib(dev, port_num)) &&
    7355     - (rdma_cap_opa_ah(dev, port_num)))
    7356     - return RDMA_AH_ATTR_TYPE_OPA;
    7357     - else
    7358     + if (rdma_protocol_ib(dev, port_num)) {
    7359     + if (rdma_cap_opa_ah(dev, port_num))
    7360     + return RDMA_AH_ATTR_TYPE_OPA;
    7361     return RDMA_AH_ATTR_TYPE_IB;
    7362     + }
    7363     +
    7364     + return RDMA_AH_ATTR_TYPE_UNDEFINED;
    7365     }
    7366    
    7367     /**
    7368     diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
    7369     index 16e305e69f34..c6f728037c53 100644
    7370     --- a/include/trace/events/timer.h
    7371     +++ b/include/trace/events/timer.h
    7372     @@ -136,6 +136,20 @@ DEFINE_EVENT(timer_class, timer_cancel,
    7373     TP_ARGS(timer)
    7374     );
    7375    
    7376     +#define decode_clockid(type) \
    7377     + __print_symbolic(type, \
    7378     + { CLOCK_REALTIME, "CLOCK_REALTIME" }, \
    7379     + { CLOCK_MONOTONIC, "CLOCK_MONOTONIC" }, \
    7380     + { CLOCK_BOOTTIME, "CLOCK_BOOTTIME" }, \
    7381     + { CLOCK_TAI, "CLOCK_TAI" })
    7382     +
    7383     +#define decode_hrtimer_mode(mode) \
    7384     + __print_symbolic(mode, \
    7385     + { HRTIMER_MODE_ABS, "ABS" }, \
    7386     + { HRTIMER_MODE_REL, "REL" }, \
    7387     + { HRTIMER_MODE_ABS_PINNED, "ABS|PINNED" }, \
    7388     + { HRTIMER_MODE_REL_PINNED, "REL|PINNED" })
    7389     +
    7390     /**
    7391     * hrtimer_init - called when the hrtimer is initialized
    7392     * @hrtimer: pointer to struct hrtimer
    7393     @@ -162,10 +176,8 @@ TRACE_EVENT(hrtimer_init,
    7394     ),
    7395    
    7396     TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer,
    7397     - __entry->clockid == CLOCK_REALTIME ?
    7398     - "CLOCK_REALTIME" : "CLOCK_MONOTONIC",
    7399     - __entry->mode == HRTIMER_MODE_ABS ?
    7400     - "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL")
    7401     + decode_clockid(__entry->clockid),
    7402     + decode_hrtimer_mode(__entry->mode))
    7403     );
    7404    
    7405     /**
    7406     diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
    7407     index 1890be7ea9cd..53a4787c08d8 100644
    7408     --- a/kernel/bpf/sockmap.c
    7409     +++ b/kernel/bpf/sockmap.c
    7410     @@ -601,11 +601,6 @@ static void sock_map_free(struct bpf_map *map)
    7411     }
    7412     rcu_read_unlock();
    7413    
    7414     - if (stab->bpf_verdict)
    7415     - bpf_prog_put(stab->bpf_verdict);
    7416     - if (stab->bpf_parse)
    7417     - bpf_prog_put(stab->bpf_parse);
    7418     -
    7419     sock_map_remove_complete(stab);
    7420     }
    7421    
    7422     @@ -877,6 +872,19 @@ static int sock_map_update_elem(struct bpf_map *map,
    7423     return err;
    7424     }
    7425    
    7426     +static void sock_map_release(struct bpf_map *map, struct file *map_file)
    7427     +{
    7428     + struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
    7429     + struct bpf_prog *orig;
    7430     +
    7431     + orig = xchg(&stab->bpf_parse, NULL);
    7432     + if (orig)
    7433     + bpf_prog_put(orig);
    7434     + orig = xchg(&stab->bpf_verdict, NULL);
    7435     + if (orig)
    7436     + bpf_prog_put(orig);
    7437     +}
    7438     +
    7439     const struct bpf_map_ops sock_map_ops = {
    7440     .map_alloc = sock_map_alloc,
    7441     .map_free = sock_map_free,
    7442     @@ -884,6 +892,7 @@ const struct bpf_map_ops sock_map_ops = {
    7443     .map_get_next_key = sock_map_get_next_key,
    7444     .map_update_elem = sock_map_update_elem,
    7445     .map_delete_elem = sock_map_delete_elem,
    7446     + .map_release = sock_map_release,
    7447     };
    7448    
    7449     BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock,
    7450     diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
    7451     index 1b2be63c8528..fa4f47a0a631 100644
    7452     --- a/kernel/events/callchain.c
    7453     +++ b/kernel/events/callchain.c
    7454     @@ -119,19 +119,22 @@ int get_callchain_buffers(int event_max_stack)
    7455     goto exit;
    7456     }
    7457    
    7458     + /*
    7459     + * If requesting per event more than the global cap,
    7460     + * return a different error to help userspace figure
    7461     + * this out.
    7462     + *
    7463     + * And also do it here so that we have &callchain_mutex held.
    7464     + */
    7465     + if (event_max_stack > sysctl_perf_event_max_stack) {
    7466     + err = -EOVERFLOW;
    7467     + goto exit;
    7468     + }
    7469     +
    7470     if (count > 1) {
    7471     /* If the allocation failed, give up */
    7472     if (!callchain_cpus_entries)
    7473     err = -ENOMEM;
    7474     - /*
    7475     - * If requesting per event more than the global cap,
    7476     - * return a different error to help userspace figure
    7477     - * this out.
    7478     - *
    7479     - * And also do it here so that we have &callchain_mutex held.
    7480     - */
    7481     - if (event_max_stack > sysctl_perf_event_max_stack)
    7482     - err = -EOVERFLOW;
    7483     goto exit;
    7484     }
    7485    
    7486     diff --git a/kernel/events/core.c b/kernel/events/core.c
    7487     index e9b0beca830f..cb8274d7824f 100644
    7488     --- a/kernel/events/core.c
    7489     +++ b/kernel/events/core.c
    7490     @@ -9750,9 +9750,9 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
    7491     * __u16 sample size limit.
    7492     */
    7493     if (attr->sample_stack_user >= USHRT_MAX)
    7494     - ret = -EINVAL;
    7495     + return -EINVAL;
    7496     else if (!IS_ALIGNED(attr->sample_stack_user, sizeof(u64)))
    7497     - ret = -EINVAL;
    7498     + return -EINVAL;
    7499     }
    7500    
    7501     if (attr->sample_type & PERF_SAMPLE_REGS_INTR)
    7502     diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
    7503     index 294294c71ba4..50dc42aeaa56 100644
    7504     --- a/kernel/locking/qspinlock.c
    7505     +++ b/kernel/locking/qspinlock.c
    7506     @@ -379,6 +379,14 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)
    7507     tail = encode_tail(smp_processor_id(), idx);
    7508    
    7509     node += idx;
    7510     +
    7511     + /*
    7512     + * Ensure that we increment the head node->count before initialising
    7513     + * the actual node. If the compiler is kind enough to reorder these
    7514     + * stores, then an IRQ could overwrite our assignments.
    7515     + */
    7516     + barrier();
    7517     +
    7518     node->locked = 0;
    7519     node->next = NULL;
    7520     pv_init_node(node);
    7521     diff --git a/kernel/power/power.h b/kernel/power/power.h
    7522     index f29cd178df90..9e58bdc8a562 100644
    7523     --- a/kernel/power/power.h
    7524     +++ b/kernel/power/power.h
    7525     @@ -104,9 +104,6 @@ extern int in_suspend;
    7526     extern dev_t swsusp_resume_device;
    7527     extern sector_t swsusp_resume_block;
    7528    
    7529     -extern asmlinkage int swsusp_arch_suspend(void);
    7530     -extern asmlinkage int swsusp_arch_resume(void);
    7531     -
    7532     extern int create_basic_memory_bitmaps(void);
    7533     extern void free_basic_memory_bitmaps(void);
    7534     extern int hibernate_preallocate_memory(void);
    7535     diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
    7536     index ec09ce9a6012..639321bf2e39 100644
    7537     --- a/kernel/time/alarmtimer.c
    7538     +++ b/kernel/time/alarmtimer.c
    7539     @@ -326,6 +326,17 @@ static int alarmtimer_resume(struct device *dev)
    7540     }
    7541     #endif
    7542    
    7543     +static void
    7544     +__alarm_init(struct alarm *alarm, enum alarmtimer_type type,
    7545     + enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
    7546     +{
    7547     + timerqueue_init(&alarm->node);
    7548     + alarm->timer.function = alarmtimer_fired;
    7549     + alarm->function = function;
    7550     + alarm->type = type;
    7551     + alarm->state = ALARMTIMER_STATE_INACTIVE;
    7552     +}
    7553     +
    7554     /**
    7555     * alarm_init - Initialize an alarm structure
    7556     * @alarm: ptr to alarm to be initialized
    7557     @@ -335,13 +346,9 @@ static int alarmtimer_resume(struct device *dev)
    7558     void alarm_init(struct alarm *alarm, enum alarmtimer_type type,
    7559     enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
    7560     {
    7561     - timerqueue_init(&alarm->node);
    7562     hrtimer_init(&alarm->timer, alarm_bases[type].base_clockid,
    7563     - HRTIMER_MODE_ABS);
    7564     - alarm->timer.function = alarmtimer_fired;
    7565     - alarm->function = function;
    7566     - alarm->type = type;
    7567     - alarm->state = ALARMTIMER_STATE_INACTIVE;
    7568     + HRTIMER_MODE_ABS);
    7569     + __alarm_init(alarm, type, function);
    7570     }
    7571     EXPORT_SYMBOL_GPL(alarm_init);
    7572    
    7573     @@ -719,6 +726,8 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp,
    7574    
    7575     __set_current_state(TASK_RUNNING);
    7576    
    7577     + destroy_hrtimer_on_stack(&alarm->timer);
    7578     +
    7579     if (!alarm->data)
    7580     return 0;
    7581    
    7582     @@ -740,6 +749,15 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp,
    7583     return -ERESTART_RESTARTBLOCK;
    7584     }
    7585    
    7586     +static void
    7587     +alarm_init_on_stack(struct alarm *alarm, enum alarmtimer_type type,
    7588     + enum alarmtimer_restart (*function)(struct alarm *, ktime_t))
    7589     +{
    7590     + hrtimer_init_on_stack(&alarm->timer, alarm_bases[type].base_clockid,
    7591     + HRTIMER_MODE_ABS);
    7592     + __alarm_init(alarm, type, function);
    7593     +}
    7594     +
    7595     /**
    7596     * alarm_timer_nsleep_restart - restartblock alarmtimer nsleep
    7597     * @restart: ptr to restart block
    7598     @@ -752,7 +770,7 @@ static long __sched alarm_timer_nsleep_restart(struct restart_block *restart)
    7599     ktime_t exp = restart->nanosleep.expires;
    7600     struct alarm alarm;
    7601    
    7602     - alarm_init(&alarm, type, alarmtimer_nsleep_wakeup);
    7603     + alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup);
    7604    
    7605     return alarmtimer_do_nsleep(&alarm, exp, type);
    7606     }
    7607     @@ -784,7 +802,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
    7608     if (!capable(CAP_WAKE_ALARM))
    7609     return -EPERM;
    7610    
    7611     - alarm_init(&alarm, type, alarmtimer_nsleep_wakeup);
    7612     + alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup);
    7613    
    7614     exp = timespec64_to_ktime(*tsreq);
    7615     /* Convert (if necessary) to absolute time */
    7616     diff --git a/lib/test_bpf.c b/lib/test_bpf.c
    7617     index 6fbb73f3f531..64701b4c9900 100644
    7618     --- a/lib/test_bpf.c
    7619     +++ b/lib/test_bpf.c
    7620     @@ -83,6 +83,7 @@ struct bpf_test {
    7621     __u32 result;
    7622     } test[MAX_SUBTESTS];
    7623     int (*fill_helper)(struct bpf_test *self);
    7624     + int expected_errcode; /* used when FLAG_EXPECTED_FAIL is set in the aux */
    7625     __u8 frag_data[MAX_DATA];
    7626     int stack_depth; /* for eBPF only, since tests don't call verifier */
    7627     };
    7628     @@ -1987,7 +1988,9 @@ static struct bpf_test tests[] = {
    7629     },
    7630     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7631     { },
    7632     - { }
    7633     + { },
    7634     + .fill_helper = NULL,
    7635     + .expected_errcode = -EINVAL,
    7636     },
    7637     {
    7638     "check: div_k_0",
    7639     @@ -1997,7 +2000,9 @@ static struct bpf_test tests[] = {
    7640     },
    7641     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7642     { },
    7643     - { }
    7644     + { },
    7645     + .fill_helper = NULL,
    7646     + .expected_errcode = -EINVAL,
    7647     },
    7648     {
    7649     "check: unknown insn",
    7650     @@ -2008,7 +2013,9 @@ static struct bpf_test tests[] = {
    7651     },
    7652     CLASSIC | FLAG_EXPECTED_FAIL,
    7653     { },
    7654     - { }
    7655     + { },
    7656     + .fill_helper = NULL,
    7657     + .expected_errcode = -EINVAL,
    7658     },
    7659     {
    7660     "check: out of range spill/fill",
    7661     @@ -2018,7 +2025,9 @@ static struct bpf_test tests[] = {
    7662     },
    7663     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7664     { },
    7665     - { }
    7666     + { },
    7667     + .fill_helper = NULL,
    7668     + .expected_errcode = -EINVAL,
    7669     },
    7670     {
    7671     "JUMPS + HOLES",
    7672     @@ -2110,6 +2119,8 @@ static struct bpf_test tests[] = {
    7673     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7674     { },
    7675     { },
    7676     + .fill_helper = NULL,
    7677     + .expected_errcode = -EINVAL,
    7678     },
    7679     {
    7680     "check: LDX + RET X",
    7681     @@ -2120,6 +2131,8 @@ static struct bpf_test tests[] = {
    7682     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7683     { },
    7684     { },
    7685     + .fill_helper = NULL,
    7686     + .expected_errcode = -EINVAL,
    7687     },
    7688     { /* Mainly checking JIT here. */
    7689     "M[]: alt STX + LDX",
    7690     @@ -2294,6 +2307,8 @@ static struct bpf_test tests[] = {
    7691     CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7692     { },
    7693     { },
    7694     + .fill_helper = NULL,
    7695     + .expected_errcode = -EINVAL,
    7696     },
    7697     { /* Passes checker but fails during runtime. */
    7698     "LD [SKF_AD_OFF-1]",
    7699     @@ -5356,6 +5371,7 @@ static struct bpf_test tests[] = {
    7700     { },
    7701     { },
    7702     .fill_helper = bpf_fill_maxinsns4,
    7703     + .expected_errcode = -EINVAL,
    7704     },
    7705     { /* Mainly checking JIT here. */
    7706     "BPF_MAXINSNS: Very long jump",
    7707     @@ -5411,10 +5427,15 @@ static struct bpf_test tests[] = {
    7708     {
    7709     "BPF_MAXINSNS: Jump, gap, jump, ...",
    7710     { },
    7711     +#ifdef CONFIG_BPF_JIT_ALWAYS_ON
    7712     + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL,
    7713     +#else
    7714     CLASSIC | FLAG_NO_DATA,
    7715     +#endif
    7716     { },
    7717     { { 0, 0xababcbac } },
    7718     .fill_helper = bpf_fill_maxinsns11,
    7719     + .expected_errcode = -ENOTSUPP,
    7720     },
    7721     {
    7722     "BPF_MAXINSNS: ld_abs+get_processor_id",
    7723     @@ -6193,7 +6214,7 @@ static struct bpf_prog *generate_filter(int which, int *err)
    7724    
    7725     *err = bpf_prog_create(&fp, &fprog);
    7726     if (tests[which].aux & FLAG_EXPECTED_FAIL) {
    7727     - if (*err == -EINVAL) {
    7728     + if (*err == tests[which].expected_errcode) {
    7729     pr_cont("PASS\n");
    7730     /* Verifier rejected filter as expected. */
    7731     *err = 0;
    7732     diff --git a/mm/fadvise.c b/mm/fadvise.c
    7733     index ec70d6e4b86d..767887f5f3bf 100644
    7734     --- a/mm/fadvise.c
    7735     +++ b/mm/fadvise.c
    7736     @@ -127,7 +127,15 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
    7737     */
    7738     start_index = (offset+(PAGE_SIZE-1)) >> PAGE_SHIFT;
    7739     end_index = (endbyte >> PAGE_SHIFT);
    7740     - if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK) {
    7741     + /*
    7742     + * The page at end_index will be inclusively discarded according
    7743     + * by invalidate_mapping_pages(), so subtracting 1 from
    7744     + * end_index means we will skip the last page. But if endbyte
    7745     + * is page aligned or is at the end of file, we should not skip
    7746     + * that page - discarding the last page is safe enough.
    7747     + */
    7748     + if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK &&
    7749     + endbyte != inode->i_size - 1) {
    7750     /* First page is tricky as 0 - 1 = -1, but pgoff_t
    7751     * is unsigned, so the end_index >= start_index
    7752     * check below would be true and we'll discard the whole
    7753     diff --git a/mm/khugepaged.c b/mm/khugepaged.c
    7754     index 2fe26634e1a2..29221602d802 100644
    7755     --- a/mm/khugepaged.c
    7756     +++ b/mm/khugepaged.c
    7757     @@ -1679,10 +1679,14 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
    7758     spin_unlock(&khugepaged_mm_lock);
    7759    
    7760     mm = mm_slot->mm;
    7761     - down_read(&mm->mmap_sem);
    7762     - if (unlikely(khugepaged_test_exit(mm)))
    7763     - vma = NULL;
    7764     - else
    7765     + /*
    7766     + * Don't wait for semaphore (to avoid long wait times). Just move to
    7767     + * the next mm on the list.
    7768     + */
    7769     + vma = NULL;
    7770     + if (unlikely(!down_read_trylock(&mm->mmap_sem)))
    7771     + goto breakouterloop_mmap_sem;
    7772     + if (likely(!khugepaged_test_exit(mm)))
    7773     vma = find_vma(mm, khugepaged_scan.address);
    7774    
    7775     progress++;
    7776     diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    7777     index a2af6d58a68f..2d3077ce50cd 100644
    7778     --- a/mm/mempolicy.c
    7779     +++ b/mm/mempolicy.c
    7780     @@ -1262,6 +1262,7 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
    7781     unsigned long maxnode)
    7782     {
    7783     unsigned long k;
    7784     + unsigned long t;
    7785     unsigned long nlongs;
    7786     unsigned long endmask;
    7787    
    7788     @@ -1278,13 +1279,19 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
    7789     else
    7790     endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1;
    7791    
    7792     - /* When the user specified more nodes than supported just check
    7793     - if the non supported part is all zero. */
    7794     + /*
    7795     + * When the user specified more nodes than supported just check
    7796     + * if the non supported part is all zero.
    7797     + *
    7798     + * If maxnode have more longs than MAX_NUMNODES, check
    7799     + * the bits in that area first. And then go through to
    7800     + * check the rest bits which equal or bigger than MAX_NUMNODES.
    7801     + * Otherwise, just check bits [MAX_NUMNODES, maxnode).
    7802     + */
    7803     if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) {
    7804     if (nlongs > PAGE_SIZE/sizeof(long))
    7805     return -EINVAL;
    7806     for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) {
    7807     - unsigned long t;
    7808     if (get_user(t, nmask + k))
    7809     return -EFAULT;
    7810     if (k == nlongs - 1) {
    7811     @@ -1297,6 +1304,16 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
    7812     endmask = ~0UL;
    7813     }
    7814    
    7815     + if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) {
    7816     + unsigned long valid_mask = endmask;
    7817     +
    7818     + valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1);
    7819     + if (get_user(t, nmask + nlongs - 1))
    7820     + return -EFAULT;
    7821     + if (t & valid_mask)
    7822     + return -EINVAL;
    7823     + }
    7824     +
    7825     if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned long)))
    7826     return -EFAULT;
    7827     nodes_addr(*nodes)[nlongs-1] &= endmask;
    7828     @@ -1423,10 +1440,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
    7829     goto out_put;
    7830     }
    7831    
    7832     - if (!nodes_subset(*new, node_states[N_MEMORY])) {
    7833     - err = -EINVAL;
    7834     + task_nodes = cpuset_mems_allowed(current);
    7835     + nodes_and(*new, *new, task_nodes);
    7836     + if (nodes_empty(*new))
    7837     + goto out_put;
    7838     +
    7839     + nodes_and(*new, *new, node_states[N_MEMORY]);
    7840     + if (nodes_empty(*new))
    7841     goto out_put;
    7842     - }
    7843    
    7844     err = security_task_movememory(task);
    7845     if (err)
    7846     diff --git a/mm/vmscan.c b/mm/vmscan.c
    7847     index a8a3729bfaa9..b3f5e337b64a 100644
    7848     --- a/mm/vmscan.c
    7849     +++ b/mm/vmscan.c
    7850     @@ -1436,14 +1436,24 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode)
    7851    
    7852     if (PageDirty(page)) {
    7853     struct address_space *mapping;
    7854     + bool migrate_dirty;
    7855    
    7856     /*
    7857     * Only pages without mappings or that have a
    7858     * ->migratepage callback are possible to migrate
    7859     - * without blocking
    7860     + * without blocking. However, we can be racing with
    7861     + * truncation so it's necessary to lock the page
    7862     + * to stabilise the mapping as truncation holds
    7863     + * the page lock until after the page is removed
    7864     + * from the page cache.
    7865     */
    7866     + if (!trylock_page(page))
    7867     + return ret;
    7868     +
    7869     mapping = page_mapping(page);
    7870     - if (mapping && !mapping->a_ops->migratepage)
    7871     + migrate_dirty = mapping && mapping->a_ops->migratepage;
    7872     + unlock_page(page);
    7873     + if (!migrate_dirty)
    7874     return ret;
    7875     }
    7876     }
    7877     diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    7878     index 16eb99458df4..014a73b46064 100644
    7879     --- a/net/bridge/netfilter/ebtables.c
    7880     +++ b/net/bridge/netfilter/ebtables.c
    7881     @@ -1819,10 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info,
    7882     {
    7883     unsigned int size = info->entries_size;
    7884     const void *entries = info->entries;
    7885     + int ret;
    7886    
    7887     newinfo->entries_size = size;
    7888    
    7889     - xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
    7890     + ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries);
    7891     + if (ret)
    7892     + return ret;
    7893     +
    7894     return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
    7895     entries, newinfo);
    7896     }
    7897     @@ -2257,7 +2261,9 @@ static int compat_do_replace(struct net *net, void __user *user,
    7898    
    7899     xt_compat_lock(NFPROTO_BRIDGE);
    7900    
    7901     - xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
    7902     + ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
    7903     + if (ret < 0)
    7904     + goto out_unlock;
    7905     ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
    7906     if (ret < 0)
    7907     goto out_unlock;
    7908     diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
    7909     index aa4c3b7f7da4..356ae7da4f16 100644
    7910     --- a/net/ipv4/netfilter/arp_tables.c
    7911     +++ b/net/ipv4/netfilter/arp_tables.c
    7912     @@ -768,7 +768,9 @@ static int compat_table_info(const struct xt_table_info *info,
    7913     memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
    7914     newinfo->initial_entries = 0;
    7915     loc_cpu_entry = info->entries;
    7916     - xt_compat_init_offsets(NFPROTO_ARP, info->number);
    7917     + ret = xt_compat_init_offsets(NFPROTO_ARP, info->number);
    7918     + if (ret)
    7919     + return ret;
    7920     xt_entry_foreach(iter, loc_cpu_entry, info->size) {
    7921     ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
    7922     if (ret != 0)
    7923     @@ -883,7 +885,7 @@ static int __do_replace(struct net *net, const char *name,
    7924     struct arpt_entry *iter;
    7925    
    7926     ret = 0;
    7927     - counters = vzalloc(num_counters * sizeof(struct xt_counters));
    7928     + counters = xt_counters_alloc(num_counters);
    7929     if (!counters) {
    7930     ret = -ENOMEM;
    7931     goto out;
    7932     @@ -1157,7 +1159,7 @@ static int translate_compat_table(struct xt_table_info **pinfo,
    7933     struct compat_arpt_entry *iter0;
    7934     struct arpt_replace repl;
    7935     unsigned int size;
    7936     - int ret = 0;
    7937     + int ret;
    7938    
    7939     info = *pinfo;
    7940     entry0 = *pentry0;
    7941     @@ -1166,7 +1168,9 @@ static int translate_compat_table(struct xt_table_info **pinfo,
    7942    
    7943     j = 0;
    7944     xt_compat_lock(NFPROTO_ARP);
    7945     - xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
    7946     + ret = xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries);
    7947     + if (ret)
    7948     + goto out_unlock;
    7949     /* Walk through entries, checking offsets. */
    7950     xt_entry_foreach(iter0, entry0, compatr->size) {
    7951     ret = check_compat_entry_size_and_hooks(iter0, info, &size,
    7952     diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
    7953     index cadb82a906b8..1a925f2394ad 100644
    7954     --- a/net/ipv4/netfilter/ip_tables.c
    7955     +++ b/net/ipv4/netfilter/ip_tables.c
    7956     @@ -931,7 +931,9 @@ static int compat_table_info(const struct xt_table_info *info,
    7957     memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
    7958     newinfo->initial_entries = 0;
    7959     loc_cpu_entry = info->entries;
    7960     - xt_compat_init_offsets(AF_INET, info->number);
    7961     + ret = xt_compat_init_offsets(AF_INET, info->number);
    7962     + if (ret)
    7963     + return ret;
    7964     xt_entry_foreach(iter, loc_cpu_entry, info->size) {
    7965     ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
    7966     if (ret != 0)
    7967     @@ -1044,7 +1046,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
    7968     struct ipt_entry *iter;
    7969    
    7970     ret = 0;
    7971     - counters = vzalloc(num_counters * sizeof(struct xt_counters));
    7972     + counters = xt_counters_alloc(num_counters);
    7973     if (!counters) {
    7974     ret = -ENOMEM;
    7975     goto out;
    7976     @@ -1407,7 +1409,9 @@ translate_compat_table(struct net *net,
    7977    
    7978     j = 0;
    7979     xt_compat_lock(AF_INET);
    7980     - xt_compat_init_offsets(AF_INET, compatr->num_entries);
    7981     + ret = xt_compat_init_offsets(AF_INET, compatr->num_entries);
    7982     + if (ret)
    7983     + goto out_unlock;
    7984     /* Walk through entries, checking offsets. */
    7985     xt_entry_foreach(iter0, entry0, compatr->size) {
    7986     ret = check_compat_entry_size_and_hooks(iter0, info, &size,
    7987     diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c
    7988     index 125fc1450b01..09f8773fd769 100644
    7989     --- a/net/ipv4/tcp_nv.c
    7990     +++ b/net/ipv4/tcp_nv.c
    7991     @@ -327,7 +327,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
    7992     */
    7993     cwnd_by_slope = (u32)
    7994     div64_u64(((u64)ca->nv_rtt_max_rate) * ca->nv_min_rtt,
    7995     - (u64)(80000 * tp->mss_cache));
    7996     + 80000ULL * tp->mss_cache);
    7997     max_win = cwnd_by_slope + nv_pad;
    7998    
    7999     /* If cwnd > max_win, decrease cwnd
    8000     diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
    8001     index a0a31972fc75..c5fe42e6b7f7 100644
    8002     --- a/net/ipv6/netfilter/ip6_tables.c
    8003     +++ b/net/ipv6/netfilter/ip6_tables.c
    8004     @@ -949,7 +949,9 @@ static int compat_table_info(const struct xt_table_info *info,
    8005     memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
    8006     newinfo->initial_entries = 0;
    8007     loc_cpu_entry = info->entries;
    8008     - xt_compat_init_offsets(AF_INET6, info->number);
    8009     + ret = xt_compat_init_offsets(AF_INET6, info->number);
    8010     + if (ret)
    8011     + return ret;
    8012     xt_entry_foreach(iter, loc_cpu_entry, info->size) {
    8013     ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
    8014     if (ret != 0)
    8015     @@ -1063,7 +1065,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
    8016     struct ip6t_entry *iter;
    8017    
    8018     ret = 0;
    8019     - counters = vzalloc(num_counters * sizeof(struct xt_counters));
    8020     + counters = xt_counters_alloc(num_counters);
    8021     if (!counters) {
    8022     ret = -ENOMEM;
    8023     goto out;
    8024     @@ -1415,7 +1417,7 @@ translate_compat_table(struct net *net,
    8025     struct compat_ip6t_entry *iter0;
    8026     struct ip6t_replace repl;
    8027     unsigned int size;
    8028     - int ret = 0;
    8029     + int ret;
    8030    
    8031     info = *pinfo;
    8032     entry0 = *pentry0;
    8033     @@ -1424,7 +1426,9 @@ translate_compat_table(struct net *net,
    8034    
    8035     j = 0;
    8036     xt_compat_lock(AF_INET6);
    8037     - xt_compat_init_offsets(AF_INET6, compatr->num_entries);
    8038     + ret = xt_compat_init_offsets(AF_INET6, compatr->num_entries);
    8039     + if (ret)
    8040     + goto out_unlock;
    8041     /* Walk through entries, checking offsets. */
    8042     xt_entry_foreach(iter0, entry0, compatr->size) {
    8043     ret = check_compat_entry_size_and_hooks(iter0, info, &size,
    8044     diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
    8045     index b263bf3a19f7..64ec23388450 100644
    8046     --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
    8047     +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
    8048     @@ -230,7 +230,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
    8049    
    8050     if ((unsigned int)end > IPV6_MAXPLEN) {
    8051     pr_debug("offset is too large.\n");
    8052     - return -1;
    8053     + return -EINVAL;
    8054     }
    8055    
    8056     ecn = ip6_frag_ecn(ipv6_hdr(skb));
    8057     @@ -263,7 +263,8 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
    8058     * this case. -DaveM
    8059     */
    8060     pr_debug("end of fragment not rounded to 8 bytes.\n");
    8061     - return -1;
    8062     + inet_frag_kill(&fq->q, &nf_frags);
    8063     + return -EPROTO;
    8064     }
    8065     if (end > fq->q.len) {
    8066     /* Some bits beyond end -> corruption. */
    8067     @@ -357,7 +358,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
    8068     discard_fq:
    8069     inet_frag_kill(&fq->q, &nf_frags);
    8070     err:
    8071     - return -1;
    8072     + return -EINVAL;
    8073     }
    8074    
    8075     /*
    8076     @@ -566,6 +567,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
    8077    
    8078     int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
    8079     {
    8080     + u16 savethdr = skb->transport_header;
    8081     struct net_device *dev = skb->dev;
    8082     int fhoff, nhoff, ret;
    8083     struct frag_hdr *fhdr;
    8084     @@ -599,8 +601,12 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
    8085    
    8086     spin_lock_bh(&fq->q.lock);
    8087    
    8088     - if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) {
    8089     - ret = -EINVAL;
    8090     + ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff);
    8091     + if (ret < 0) {
    8092     + if (ret == -EPROTO) {
    8093     + skb->transport_header = savethdr;
    8094     + ret = 0;
    8095     + }
    8096     goto out_unlock;
    8097     }
    8098    
    8099     diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
    8100     index a450a1c8804b..8e054c63b54e 100644
    8101     --- a/net/netfilter/x_tables.c
    8102     +++ b/net/netfilter/x_tables.c
    8103     @@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
    8104     MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
    8105    
    8106     #define XT_PCPU_BLOCK_SIZE 4096
    8107     +#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024)
    8108    
    8109     struct compat_delta {
    8110     unsigned int offset; /* offset in kernel */
    8111     @@ -554,14 +555,8 @@ int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta)
    8112     {
    8113     struct xt_af *xp = &xt[af];
    8114    
    8115     - if (!xp->compat_tab) {
    8116     - if (!xp->number)
    8117     - return -EINVAL;
    8118     - xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number);
    8119     - if (!xp->compat_tab)
    8120     - return -ENOMEM;
    8121     - xp->cur = 0;
    8122     - }
    8123     + if (WARN_ON(!xp->compat_tab))
    8124     + return -ENOMEM;
    8125    
    8126     if (xp->cur >= xp->number)
    8127     return -EINVAL;
    8128     @@ -604,10 +599,28 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset)
    8129     }
    8130     EXPORT_SYMBOL_GPL(xt_compat_calc_jump);
    8131    
    8132     -void xt_compat_init_offsets(u_int8_t af, unsigned int number)
    8133     +int xt_compat_init_offsets(u8 af, unsigned int number)
    8134     {
    8135     + size_t mem;
    8136     +
    8137     + if (!number || number > (INT_MAX / sizeof(struct compat_delta)))
    8138     + return -EINVAL;
    8139     +
    8140     + if (WARN_ON(xt[af].compat_tab))
    8141     + return -EINVAL;
    8142     +
    8143     + mem = sizeof(struct compat_delta) * number;
    8144     + if (mem > XT_MAX_TABLE_SIZE)
    8145     + return -ENOMEM;
    8146     +
    8147     + xt[af].compat_tab = vmalloc(mem);
    8148     + if (!xt[af].compat_tab)
    8149     + return -ENOMEM;
    8150     +
    8151     xt[af].number = number;
    8152     xt[af].cur = 0;
    8153     +
    8154     + return 0;
    8155     }
    8156     EXPORT_SYMBOL(xt_compat_init_offsets);
    8157    
    8158     @@ -806,6 +819,9 @@ EXPORT_SYMBOL(xt_check_entry_offsets);
    8159     */
    8160     unsigned int *xt_alloc_entry_offsets(unsigned int size)
    8161     {
    8162     + if (size > XT_MAX_TABLE_SIZE / sizeof(unsigned int))
    8163     + return NULL;
    8164     +
    8165     return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO);
    8166    
    8167     }
    8168     @@ -1031,7 +1047,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
    8169     struct xt_table_info *info = NULL;
    8170     size_t sz = sizeof(*info) + size;
    8171    
    8172     - if (sz < sizeof(*info))
    8173     + if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE)
    8174     return NULL;
    8175    
    8176     /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
    8177     @@ -1186,6 +1202,21 @@ static int xt_jumpstack_alloc(struct xt_table_info *i)
    8178     return 0;
    8179     }
    8180    
    8181     +struct xt_counters *xt_counters_alloc(unsigned int counters)
    8182     +{
    8183     + struct xt_counters *mem;
    8184     +
    8185     + if (counters == 0 || counters > INT_MAX / sizeof(*mem))
    8186     + return NULL;
    8187     +
    8188     + counters *= sizeof(*mem);
    8189     + if (counters > XT_MAX_TABLE_SIZE)
    8190     + return NULL;
    8191     +
    8192     + return vzalloc(counters);
    8193     +}
    8194     +EXPORT_SYMBOL(xt_counters_alloc);
    8195     +
    8196     struct xt_table_info *
    8197     xt_replace_table(struct xt_table *table,
    8198     unsigned int num_counters,
    8199     diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
    8200     index bb5d6a058fb7..1141f08810b6 100644
    8201     --- a/net/netfilter/xt_IDLETIMER.c
    8202     +++ b/net/netfilter/xt_IDLETIMER.c
    8203     @@ -256,6 +256,7 @@ static struct xt_target idletimer_tg __read_mostly = {
    8204     .family = NFPROTO_UNSPEC,
    8205     .target = idletimer_tg_target,
    8206     .targetsize = sizeof(struct idletimer_tg_info),
    8207     + .usersize = offsetof(struct idletimer_tg_info, timer),
    8208     .checkentry = idletimer_tg_checkentry,
    8209     .destroy = idletimer_tg_destroy,
    8210     .me = THIS_MODULE,
    8211     diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c
    8212     index 0858fe17e14a..2d1c5c169a26 100644
    8213     --- a/net/netfilter/xt_LED.c
    8214     +++ b/net/netfilter/xt_LED.c
    8215     @@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = {
    8216     .family = NFPROTO_UNSPEC,
    8217     .target = led_tg,
    8218     .targetsize = sizeof(struct xt_led_info),
    8219     + .usersize = offsetof(struct xt_led_info, internal_data),
    8220     .checkentry = led_tg_check,
    8221     .destroy = led_tg_destroy,
    8222     .me = THIS_MODULE,
    8223     diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c
    8224     index d27b5f1ea619..61403b77361c 100644
    8225     --- a/net/netfilter/xt_limit.c
    8226     +++ b/net/netfilter/xt_limit.c
    8227     @@ -193,9 +193,8 @@ static struct xt_match limit_mt_reg __read_mostly = {
    8228     .compatsize = sizeof(struct compat_xt_rateinfo),
    8229     .compat_from_user = limit_mt_compat_from_user,
    8230     .compat_to_user = limit_mt_compat_to_user,
    8231     -#else
    8232     - .usersize = offsetof(struct xt_rateinfo, prev),
    8233     #endif
    8234     + .usersize = offsetof(struct xt_rateinfo, prev),
    8235     .me = THIS_MODULE,
    8236     };
    8237    
    8238     diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
    8239     index cc0518fe598e..6f92d25590a8 100644
    8240     --- a/net/netfilter/xt_nfacct.c
    8241     +++ b/net/netfilter/xt_nfacct.c
    8242     @@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = {
    8243     .match = nfacct_mt,
    8244     .destroy = nfacct_mt_destroy,
    8245     .matchsize = sizeof(struct xt_nfacct_match_info),
    8246     + .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    8247     .me = THIS_MODULE,
    8248     };
    8249    
    8250     diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
    8251     index 11de55e7a868..8710fdba2ae2 100644
    8252     --- a/net/netfilter/xt_statistic.c
    8253     +++ b/net/netfilter/xt_statistic.c
    8254     @@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = {
    8255     .checkentry = statistic_mt_check,
    8256     .destroy = statistic_mt_destroy,
    8257     .matchsize = sizeof(struct xt_statistic_info),
    8258     + .usersize = offsetof(struct xt_statistic_info, master),
    8259     .me = THIS_MODULE,
    8260     };
    8261    
    8262     diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
    8263     index d558e882ca0c..285f8797c26a 100644
    8264     --- a/net/openvswitch/conntrack.c
    8265     +++ b/net/openvswitch/conntrack.c
    8266     @@ -1097,6 +1097,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
    8267     return 0;
    8268     }
    8269    
    8270     +/* Trim the skb to the length specified by the IP/IPv6 header,
    8271     + * removing any trailing lower-layer padding. This prepares the skb
    8272     + * for higher-layer processing that assumes skb->len excludes padding
    8273     + * (such as nf_ip_checksum). The caller needs to pull the skb to the
    8274     + * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
    8275     + */
    8276     +static int ovs_skb_network_trim(struct sk_buff *skb)
    8277     +{
    8278     + unsigned int len;
    8279     + int err;
    8280     +
    8281     + switch (skb->protocol) {
    8282     + case htons(ETH_P_IP):
    8283     + len = ntohs(ip_hdr(skb)->tot_len);
    8284     + break;
    8285     + case htons(ETH_P_IPV6):
    8286     + len = sizeof(struct ipv6hdr)
    8287     + + ntohs(ipv6_hdr(skb)->payload_len);
    8288     + break;
    8289     + default:
    8290     + len = skb->len;
    8291     + }
    8292     +
    8293     + err = pskb_trim_rcsum(skb, len);
    8294     + if (err)
    8295     + kfree_skb(skb);
    8296     +
    8297     + return err;
    8298     +}
    8299     +
    8300     /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
    8301     * value if 'skb' is freed.
    8302     */
    8303     @@ -1111,6 +1141,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
    8304     nh_ofs = skb_network_offset(skb);
    8305     skb_pull_rcsum(skb, nh_ofs);
    8306    
    8307     + err = ovs_skb_network_trim(skb);
    8308     + if (err)
    8309     + return err;
    8310     +
    8311     if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
    8312     err = handle_fragments(net, key, info->zone.id, skb);
    8313     if (err)
    8314     diff --git a/net/rds/ib.c b/net/rds/ib.c
    8315     index a0954ace3774..c21eb4850b9d 100644
    8316     --- a/net/rds/ib.c
    8317     +++ b/net/rds/ib.c
    8318     @@ -346,7 +346,8 @@ static int rds_ib_laddr_check(struct net *net, __be32 addr)
    8319     /* Create a CMA ID and try to bind it. This catches both
    8320     * IB and iWARP capable NICs.
    8321     */
    8322     - cm_id = rdma_create_id(&init_net, NULL, NULL, RDMA_PS_TCP, IB_QPT_RC);
    8323     + cm_id = rdma_create_id(&init_net, rds_rdma_cm_event_handler,
    8324     + NULL, RDMA_PS_TCP, IB_QPT_RC);
    8325     if (IS_ERR(cm_id))
    8326     return PTR_ERR(cm_id);
    8327    
    8328     diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
    8329     index 59a51a56e7c8..0435c4167a1a 100644
    8330     --- a/net/rxrpc/conn_event.c
    8331     +++ b/net/rxrpc/conn_event.c
    8332     @@ -404,6 +404,7 @@ void rxrpc_process_connection(struct work_struct *work)
    8333     case -EKEYEXPIRED:
    8334     case -EKEYREJECTED:
    8335     goto protocol_error;
    8336     + case -ENOMEM:
    8337     case -EAGAIN:
    8338     goto requeue_and_leave;
    8339     case -ECONNABORTED:
    8340     diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
    8341     index c38b3a1de56c..77cb23c7bd0a 100644
    8342     --- a/net/rxrpc/rxkad.c
    8343     +++ b/net/rxrpc/rxkad.c
    8344     @@ -773,8 +773,7 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
    8345     {
    8346     const struct rxrpc_key_token *token;
    8347     struct rxkad_challenge challenge;
    8348     - struct rxkad_response resp
    8349     - __attribute__((aligned(8))); /* must be aligned for crypto */
    8350     + struct rxkad_response *resp;
    8351     struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
    8352     const char *eproto;
    8353     u32 version, nonce, min_level, abort_code;
    8354     @@ -818,26 +817,29 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn,
    8355     token = conn->params.key->payload.data[0];
    8356    
    8357     /* build the response packet */
    8358     - memset(&resp, 0, sizeof(resp));
    8359     -
    8360     - resp.version = htonl(RXKAD_VERSION);
    8361     - resp.encrypted.epoch = htonl(conn->proto.epoch);
    8362     - resp.encrypted.cid = htonl(conn->proto.cid);
    8363     - resp.encrypted.securityIndex = htonl(conn->security_ix);
    8364     - resp.encrypted.inc_nonce = htonl(nonce + 1);
    8365     - resp.encrypted.level = htonl(conn->params.security_level);
    8366     - resp.kvno = htonl(token->kad->kvno);
    8367     - resp.ticket_len = htonl(token->kad->ticket_len);
    8368     -
    8369     - resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter);
    8370     - resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter);
    8371     - resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter);
    8372     - resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter);
    8373     + resp = kzalloc(sizeof(struct rxkad_response), GFP_NOFS);
    8374     + if (!resp)
    8375     + return -ENOMEM;
    8376     +
    8377     + resp->version = htonl(RXKAD_VERSION);
    8378     + resp->encrypted.epoch = htonl(conn->proto.epoch);
    8379     + resp->encrypted.cid = htonl(conn->proto.cid);
    8380     + resp->encrypted.securityIndex = htonl(conn->security_ix);
    8381     + resp->encrypted.inc_nonce = htonl(nonce + 1);
    8382     + resp->encrypted.level = htonl(conn->params.security_level);
    8383     + resp->kvno = htonl(token->kad->kvno);
    8384     + resp->ticket_len = htonl(token->kad->ticket_len);
    8385     + resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter);
    8386     + resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter);
    8387     + resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter);
    8388     + resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter);
    8389    
    8390     /* calculate the response checksum and then do the encryption */
    8391     - rxkad_calc_response_checksum(&resp);
    8392     - rxkad_encrypt_response(conn, &resp, token->kad);
    8393     - return rxkad_send_response(conn, &sp->hdr, &resp, token->kad);
    8394     + rxkad_calc_response_checksum(resp);
    8395     + rxkad_encrypt_response(conn, resp, token->kad);
    8396     + ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad);
    8397     + kfree(resp);
    8398     + return ret;
    8399    
    8400     protocol_error:
    8401     trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto);
    8402     @@ -1048,8 +1050,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8403     struct sk_buff *skb,
    8404     u32 *_abort_code)
    8405     {
    8406     - struct rxkad_response response
    8407     - __attribute__((aligned(8))); /* must be aligned for crypto */
    8408     + struct rxkad_response *response;
    8409     struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
    8410     struct rxrpc_crypt session_key;
    8411     const char *eproto;
    8412     @@ -1061,17 +1062,22 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8413    
    8414     _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key));
    8415    
    8416     + ret = -ENOMEM;
    8417     + response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS);
    8418     + if (!response)
    8419     + goto temporary_error;
    8420     +
    8421     eproto = tracepoint_string("rxkad_rsp_short");
    8422     abort_code = RXKADPACKETSHORT;
    8423     if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
    8424     - &response, sizeof(response)) < 0)
    8425     + response, sizeof(*response)) < 0)
    8426     goto protocol_error;
    8427     - if (!pskb_pull(skb, sizeof(response)))
    8428     + if (!pskb_pull(skb, sizeof(*response)))
    8429     BUG();
    8430    
    8431     - version = ntohl(response.version);
    8432     - ticket_len = ntohl(response.ticket_len);
    8433     - kvno = ntohl(response.kvno);
    8434     + version = ntohl(response->version);
    8435     + ticket_len = ntohl(response->ticket_len);
    8436     + kvno = ntohl(response->kvno);
    8437     _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }",
    8438     sp->hdr.serial, version, kvno, ticket_len);
    8439    
    8440     @@ -1105,31 +1111,31 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8441     ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key,
    8442     &expiry, _abort_code);
    8443     if (ret < 0)
    8444     - goto temporary_error_free;
    8445     + goto temporary_error_free_resp;
    8446    
    8447     /* use the session key from inside the ticket to decrypt the
    8448     * response */
    8449     - rxkad_decrypt_response(conn, &response, &session_key);
    8450     + rxkad_decrypt_response(conn, response, &session_key);
    8451    
    8452     eproto = tracepoint_string("rxkad_rsp_param");
    8453     abort_code = RXKADSEALEDINCON;
    8454     - if (ntohl(response.encrypted.epoch) != conn->proto.epoch)
    8455     + if (ntohl(response->encrypted.epoch) != conn->proto.epoch)
    8456     goto protocol_error_free;
    8457     - if (ntohl(response.encrypted.cid) != conn->proto.cid)
    8458     + if (ntohl(response->encrypted.cid) != conn->proto.cid)
    8459     goto protocol_error_free;
    8460     - if (ntohl(response.encrypted.securityIndex) != conn->security_ix)
    8461     + if (ntohl(response->encrypted.securityIndex) != conn->security_ix)
    8462     goto protocol_error_free;
    8463     - csum = response.encrypted.checksum;
    8464     - response.encrypted.checksum = 0;
    8465     - rxkad_calc_response_checksum(&response);
    8466     + csum = response->encrypted.checksum;
    8467     + response->encrypted.checksum = 0;
    8468     + rxkad_calc_response_checksum(response);
    8469     eproto = tracepoint_string("rxkad_rsp_csum");
    8470     - if (response.encrypted.checksum != csum)
    8471     + if (response->encrypted.checksum != csum)
    8472     goto protocol_error_free;
    8473    
    8474     spin_lock(&conn->channel_lock);
    8475     for (i = 0; i < RXRPC_MAXCALLS; i++) {
    8476     struct rxrpc_call *call;
    8477     - u32 call_id = ntohl(response.encrypted.call_id[i]);
    8478     + u32 call_id = ntohl(response->encrypted.call_id[i]);
    8479    
    8480     eproto = tracepoint_string("rxkad_rsp_callid");
    8481     if (call_id > INT_MAX)
    8482     @@ -1153,12 +1159,12 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8483    
    8484     eproto = tracepoint_string("rxkad_rsp_seq");
    8485     abort_code = RXKADOUTOFSEQUENCE;
    8486     - if (ntohl(response.encrypted.inc_nonce) != conn->security_nonce + 1)
    8487     + if (ntohl(response->encrypted.inc_nonce) != conn->security_nonce + 1)
    8488     goto protocol_error_free;
    8489    
    8490     eproto = tracepoint_string("rxkad_rsp_level");
    8491     abort_code = RXKADLEVELFAIL;
    8492     - level = ntohl(response.encrypted.level);
    8493     + level = ntohl(response->encrypted.level);
    8494     if (level > RXRPC_SECURITY_ENCRYPT)
    8495     goto protocol_error_free;
    8496     conn->params.security_level = level;
    8497     @@ -1168,9 +1174,10 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8498     * as for a client connection */
    8499     ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno);
    8500     if (ret < 0)
    8501     - goto temporary_error_free;
    8502     + goto temporary_error_free_ticket;
    8503    
    8504     kfree(ticket);
    8505     + kfree(response);
    8506     _leave(" = 0");
    8507     return 0;
    8508    
    8509     @@ -1179,12 +1186,15 @@ static int rxkad_verify_response(struct rxrpc_connection *conn,
    8510     protocol_error_free:
    8511     kfree(ticket);
    8512     protocol_error:
    8513     + kfree(response);
    8514     trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto);
    8515     *_abort_code = abort_code;
    8516     return -EPROTO;
    8517    
    8518     -temporary_error_free:
    8519     +temporary_error_free_ticket:
    8520     kfree(ticket);
    8521     +temporary_error_free_resp:
    8522     + kfree(response);
    8523     temporary_error:
    8524     /* Ignore the response packet if we got a temporary error such as
    8525     * ENOMEM. We just want to send the challenge again. Note that we
    8526     diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
    8527     index 823a781ec89c..25e3602aa41f 100644
    8528     --- a/net/sunrpc/xprtrdma/backchannel.c
    8529     +++ b/net/sunrpc/xprtrdma/backchannel.c
    8530     @@ -74,21 +74,13 @@ static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt,
    8531     static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
    8532     unsigned int count)
    8533     {
    8534     - struct rpcrdma_rep *rep;
    8535     int rc = 0;
    8536    
    8537     while (count--) {
    8538     - rep = rpcrdma_create_rep(r_xprt);
    8539     - if (IS_ERR(rep)) {
    8540     - pr_err("RPC: %s: reply buffer alloc failed\n",
    8541     - __func__);
    8542     - rc = PTR_ERR(rep);
    8543     + rc = rpcrdma_create_rep(r_xprt);
    8544     + if (rc)
    8545     break;
    8546     - }
    8547     -
    8548     - rpcrdma_recv_buffer_put(rep);
    8549     }
    8550     -
    8551     return rc;
    8552     }
    8553    
    8554     diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
    8555     index 9bd04549a1ad..12b9a7e0b6d2 100644
    8556     --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
    8557     +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
    8558     @@ -727,12 +727,16 @@ static int svc_rdma_build_normal_read_chunk(struct svc_rqst *rqstp,
    8559     head->arg.head[0].iov_len - info->ri_position;
    8560     head->arg.head[0].iov_len = info->ri_position;
    8561    
    8562     - /* Read chunk may need XDR roundup (see RFC 5666, s. 3.7).
    8563     + /* Read chunk may need XDR roundup (see RFC 8166, s. 3.4.5.2).
    8564     *
    8565     - * NFSv2/3 write decoders need the length of the tail to
    8566     - * contain the size of the roundup padding.
    8567     + * If the client already rounded up the chunk length, the
    8568     + * length does not change. Otherwise, the length of the page
    8569     + * list is increased to include XDR round-up.
    8570     + *
    8571     + * Currently these chunks always start at page offset 0,
    8572     + * thus the rounded-up length never crosses a page boundary.
    8573     */
    8574     - head->arg.tail[0].iov_len += 4 - (info->ri_chunklen & 3);
    8575     + info->ri_chunklen = XDR_QUADLEN(info->ri_chunklen) << 2;
    8576    
    8577     head->arg.page_len = info->ri_chunklen;
    8578     head->arg.len += info->ri_chunklen;
    8579     diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
    8580     index 9e8e1de19b2e..97b9d4f671ac 100644
    8581     --- a/net/sunrpc/xprtrdma/verbs.c
    8582     +++ b/net/sunrpc/xprtrdma/verbs.c
    8583     @@ -951,10 +951,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt)
    8584     return req;
    8585     }
    8586    
    8587     -struct rpcrdma_rep *
    8588     +/**
    8589     + * rpcrdma_create_rep - Allocate an rpcrdma_rep object
    8590     + * @r_xprt: controlling transport
    8591     + *
    8592     + * Returns 0 on success or a negative errno on failure.
    8593     + */
    8594     +int
    8595     rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
    8596     {
    8597     struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data;
    8598     + struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
    8599     struct rpcrdma_rep *rep;
    8600     int rc;
    8601    
    8602     @@ -979,12 +986,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
    8603     rep->rr_recv_wr.wr_cqe = &rep->rr_cqe;
    8604     rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov;
    8605     rep->rr_recv_wr.num_sge = 1;
    8606     - return rep;
    8607     +
    8608     + spin_lock(&buf->rb_lock);
    8609     + list_add(&rep->rr_list, &buf->rb_recv_bufs);
    8610     + spin_unlock(&buf->rb_lock);
    8611     + return 0;
    8612    
    8613     out_free:
    8614     kfree(rep);
    8615     out:
    8616     - return ERR_PTR(rc);
    8617     + dprintk("RPC: %s: reply buffer %d alloc failed\n",
    8618     + __func__, rc);
    8619     + return rc;
    8620     }
    8621    
    8622     int
    8623     @@ -1027,17 +1040,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
    8624     }
    8625    
    8626     INIT_LIST_HEAD(&buf->rb_recv_bufs);
    8627     - for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) {
    8628     - struct rpcrdma_rep *rep;
    8629     -
    8630     - rep = rpcrdma_create_rep(r_xprt);
    8631     - if (IS_ERR(rep)) {
    8632     - dprintk("RPC: %s: reply buffer %d alloc failed\n",
    8633     - __func__, i);
    8634     - rc = PTR_ERR(rep);
    8635     + for (i = 0; i <= buf->rb_max_requests; i++) {
    8636     + rc = rpcrdma_create_rep(r_xprt);
    8637     + if (rc)
    8638     goto out;
    8639     - }
    8640     - list_add(&rep->rr_list, &buf->rb_recv_bufs);
    8641     }
    8642    
    8643     return 0;
    8644     diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
    8645     index e26a97d2f922..fcb0b3227ee1 100644
    8646     --- a/net/sunrpc/xprtrdma/xprt_rdma.h
    8647     +++ b/net/sunrpc/xprtrdma/xprt_rdma.h
    8648     @@ -550,8 +550,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_ia *, struct rpcrdma_rep *);
    8649     * Buffer calls - xprtrdma/verbs.c
    8650     */
    8651     struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *);
    8652     -struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *);
    8653     void rpcrdma_destroy_req(struct rpcrdma_req *);
    8654     +int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt);
    8655     int rpcrdma_buffer_create(struct rpcrdma_xprt *);
    8656     void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
    8657    
    8658     diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    8659     index 8cb40f8ffa5b..30192abfdc3b 100644
    8660     --- a/net/sunrpc/xprtsock.c
    8661     +++ b/net/sunrpc/xprtsock.c
    8662     @@ -1069,18 +1069,18 @@ static void xs_udp_data_read_skb(struct rpc_xprt *xprt,
    8663    
    8664     /* Suck it into the iovec, verify checksum if not done by hw. */
    8665     if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb)) {
    8666     - __UDPX_INC_STATS(sk, UDP_MIB_INERRORS);
    8667     spin_lock(&xprt->recv_lock);
    8668     + __UDPX_INC_STATS(sk, UDP_MIB_INERRORS);
    8669     goto out_unpin;
    8670     }
    8671    
    8672     - __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS);
    8673    
    8674     spin_lock_bh(&xprt->transport_lock);
    8675     xprt_adjust_cwnd(xprt, task, copied);
    8676     spin_unlock_bh(&xprt->transport_lock);
    8677     spin_lock(&xprt->recv_lock);
    8678     xprt_complete_rqst(task, copied);
    8679     + __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS);
    8680     out_unpin:
    8681     xprt_unpin_rqst(rovr);
    8682     out_unlock:
    8683     diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
    8684     index 9b4a66e3363e..c1dc632d4ea4 100644
    8685     --- a/samples/bpf/Makefile
    8686     +++ b/samples/bpf/Makefile
    8687     @@ -179,13 +179,16 @@ LLC ?= llc
    8688     CLANG ?= clang
    8689    
    8690     # Trick to allow make to be run from this directory
    8691     -all:
    8692     +all: $(LIBBPF)
    8693     $(MAKE) -C ../../ $(CURDIR)/
    8694    
    8695     clean:
    8696     $(MAKE) -C ../../ M=$(CURDIR) clean
    8697     @rm -f *~
    8698    
    8699     +$(LIBBPF): FORCE
    8700     + $(MAKE) -C $(dir $@) $(notdir $@)
    8701     +
    8702     $(obj)/syscall_nrs.s: $(src)/syscall_nrs.c
    8703     $(call if_changed_dep,cc_s_c)
    8704    
    8705     diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
    8706     index cbf4996dd9c1..ed29bad1f03a 100644
    8707     --- a/scripts/kconfig/expr.c
    8708     +++ b/scripts/kconfig/expr.c
    8709     @@ -113,7 +113,7 @@ void expr_free(struct expr *e)
    8710     break;
    8711     case E_NOT:
    8712     expr_free(e->left.expr);
    8713     - return;
    8714     + break;
    8715     case E_EQUAL:
    8716     case E_GEQ:
    8717     case E_GTH:
    8718     diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
    8719     index e9357931b47d..749c2bd5fc51 100644
    8720     --- a/scripts/kconfig/menu.c
    8721     +++ b/scripts/kconfig/menu.c
    8722     @@ -372,6 +372,7 @@ void menu_finalize(struct menu *parent)
    8723     menu->parent = parent;
    8724     last_menu = menu;
    8725     }
    8726     + expr_free(basedep);
    8727     if (last_menu) {
    8728     parent->list = parent->next;
    8729     parent->next = last_menu->next;
    8730     diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y
    8731     index c8f396c3b190..20d9caa4be99 100644
    8732     --- a/scripts/kconfig/zconf.y
    8733     +++ b/scripts/kconfig/zconf.y
    8734     @@ -108,7 +108,27 @@ static struct menu *current_menu, *current_entry;
    8735     %%
    8736     input: nl start | start;
    8737    
    8738     -start: mainmenu_stmt stmt_list | stmt_list;
    8739     +start: mainmenu_stmt stmt_list | no_mainmenu_stmt stmt_list;
    8740     +
    8741     +/* mainmenu entry */
    8742     +
    8743     +mainmenu_stmt: T_MAINMENU prompt nl
    8744     +{
    8745     + menu_add_prompt(P_MENU, $2, NULL);
    8746     +};
    8747     +
    8748     +/* Default main menu, if there's no mainmenu entry */
    8749     +
    8750     +no_mainmenu_stmt: /* empty */
    8751     +{
    8752     + /*
    8753     + * Hack: Keep the main menu title on the heap so we can safely free it
    8754     + * later regardless of whether it comes from the 'prompt' in
    8755     + * mainmenu_stmt or here
    8756     + */
    8757     + menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL);
    8758     +};
    8759     +
    8760    
    8761     stmt_list:
    8762     /* empty */
    8763     @@ -351,13 +371,6 @@ if_block:
    8764     | if_block choice_stmt
    8765     ;
    8766    
    8767     -/* mainmenu entry */
    8768     -
    8769     -mainmenu_stmt: T_MAINMENU prompt nl
    8770     -{
    8771     - menu_add_prompt(P_MENU, $2, NULL);
    8772     -};
    8773     -
    8774     /* menu entry */
    8775    
    8776     menu: T_MENU prompt T_EOL
    8777     @@ -502,6 +515,7 @@ word_opt: /* empty */ { $$ = NULL; }
    8778    
    8779     void conf_parse(const char *name)
    8780     {
    8781     + const char *tmp;
    8782     struct symbol *sym;
    8783     int i;
    8784    
    8785     @@ -509,7 +523,6 @@ void conf_parse(const char *name)
    8786    
    8787     sym_init();
    8788     _menu_init();
    8789     - rootmenu.prompt = menu_add_prompt(P_MENU, "Linux Kernel Configuration", NULL);
    8790    
    8791     if (getenv("ZCONF_DEBUG"))
    8792     zconfdebug = 1;
    8793     @@ -519,8 +532,10 @@ void conf_parse(const char *name)
    8794     if (!modules_sym)
    8795     modules_sym = sym_find( "n" );
    8796    
    8797     + tmp = rootmenu.prompt->text;
    8798     rootmenu.prompt->text = _(rootmenu.prompt->text);
    8799     rootmenu.prompt->text = sym_expand_string_value(rootmenu.prompt->text);
    8800     + free((char*)tmp);
    8801    
    8802     menu_finalize(&rootmenu);
    8803     for_all_symbols(i, sym) {
    8804     diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig
    8805     index 7f3b5ed81995..f7a492c382d9 100644
    8806     --- a/sound/pci/hda/Kconfig
    8807     +++ b/sound/pci/hda/Kconfig
    8808     @@ -88,7 +88,6 @@ config SND_HDA_PATCH_LOADER
    8809     config SND_HDA_CODEC_REALTEK
    8810     tristate "Build Realtek HD-audio codec support"
    8811     select SND_HDA_GENERIC
    8812     - select INPUT
    8813     help
    8814     Say Y or M here to include Realtek HD-audio codec support in
    8815     snd-hda-intel driver, such as ALC880.
    8816     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    8817     index b1b28c6928a7..590887d9b7a1 100644
    8818     --- a/sound/pci/hda/patch_realtek.c
    8819     +++ b/sound/pci/hda/patch_realtek.c
    8820     @@ -3721,6 +3721,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec,
    8821     }
    8822     }
    8823    
    8824     +#if IS_REACHABLE(INPUT)
    8825     static void gpio2_mic_hotkey_event(struct hda_codec *codec,
    8826     struct hda_jack_callback *event)
    8827     {
    8828     @@ -3853,6 +3854,10 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec,
    8829     spec->kb_dev = NULL;
    8830     }
    8831     }
    8832     +#else /* INPUT */
    8833     +#define alc280_fixup_hp_gpio2_mic_hotkey NULL
    8834     +#define alc233_fixup_lenovo_line2_mic_hotkey NULL
    8835     +#endif /* INPUT */
    8836    
    8837     static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec,
    8838     const struct hda_fixup *fix, int action)
    8839     diff --git a/sound/soc/au1x/ac97c.c b/sound/soc/au1x/ac97c.c
    8840     index 29a97d52e8ad..66d6c52e7761 100644
    8841     --- a/sound/soc/au1x/ac97c.c
    8842     +++ b/sound/soc/au1x/ac97c.c
    8843     @@ -91,8 +91,8 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97,
    8844     do {
    8845     mutex_lock(&ctx->lock);
    8846    
    8847     - tmo = 5;
    8848     - while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--)
    8849     + tmo = 6;
    8850     + while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo)
    8851     udelay(21); /* wait an ac97 frame time */
    8852     if (!tmo) {
    8853     pr_debug("ac97rd timeout #1\n");
    8854     @@ -105,7 +105,7 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97,
    8855     * poll, Forrest, poll...
    8856     */
    8857     tmo = 0x10000;
    8858     - while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--)
    8859     + while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo)
    8860     asm volatile ("nop");
    8861     data = RD(ctx, AC97_CMDRESP);
    8862    
    8863     diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c
    8864     index 0513fe480353..21ac8d6cce3a 100644
    8865     --- a/sound/soc/rockchip/rk3399_gru_sound.c
    8866     +++ b/sound/soc/rockchip/rk3399_gru_sound.c
    8867     @@ -387,7 +387,8 @@ static const struct snd_soc_dai_link rockchip_dais[] = {
    8868     [DAILINK_RT5514_DSP] = {
    8869     .name = "RT5514 DSP",
    8870     .stream_name = "Wake on Voice",
    8871     - .codec_dai_name = "rt5514-dsp-cpu-dai",
    8872     + .codec_name = "snd-soc-dummy",
    8873     + .codec_dai_name = "snd-soc-dummy-dai",
    8874     },
    8875     };
    8876    
    8877     @@ -432,7 +433,18 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
    8878     if (index < 0)
    8879     continue;
    8880    
    8881     - np_cpu = (index == DAILINK_CDNDP) ? np_cpu1 : np_cpu0;
    8882     + switch (index) {
    8883     + case DAILINK_CDNDP:
    8884     + np_cpu = np_cpu1;
    8885     + break;
    8886     + case DAILINK_RT5514_DSP:
    8887     + np_cpu = np_codec;
    8888     + break;
    8889     + default:
    8890     + np_cpu = np_cpu0;
    8891     + break;
    8892     + }
    8893     +
    8894     if (!np_cpu) {
    8895     dev_err(dev, "Missing 'rockchip,cpu' for %s\n",
    8896     rockchip_dais[index].name);
    8897     @@ -442,7 +454,8 @@ static int rockchip_sound_of_parse_dais(struct device *dev,
    8898     dai = &card->dai_link[card->num_links++];
    8899     *dai = rockchip_dais[index];
    8900    
    8901     - dai->codec_of_node = np_codec;
    8902     + if (!dai->codec_name)
    8903     + dai->codec_of_node = np_codec;
    8904     dai->platform_of_node = np_cpu;
    8905     dai->cpu_of_node = np_cpu;
    8906     }
    8907     diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
    8908     index 4555304dc18e..f02448e86d38 100644
    8909     --- a/tools/lib/bpf/Makefile
    8910     +++ b/tools/lib/bpf/Makefile
    8911     @@ -183,7 +183,7 @@ define do_install
    8912     if [ ! -d '$(DESTDIR_SQ)$2' ]; then \
    8913     $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \
    8914     fi; \
    8915     - $(INSTALL) $1 '$(DESTDIR_SQ)$2'
    8916     + $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2'
    8917     endef
    8918    
    8919     install_lib: all_cmd
    8920     diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
    8921     index 35f6dfcdc565..701d29c8364f 100644
    8922     --- a/tools/lib/bpf/libbpf.c
    8923     +++ b/tools/lib/bpf/libbpf.c
    8924     @@ -661,6 +661,24 @@ bpf_object__init_maps(struct bpf_object *obj)
    8925     return bpf_object__validate_maps(obj);
    8926     }
    8927    
    8928     +static bool section_have_execinstr(struct bpf_object *obj, int idx)
    8929     +{
    8930     + Elf_Scn *scn;
    8931     + GElf_Shdr sh;
    8932     +
    8933     + scn = elf_getscn(obj->efile.elf, idx);
    8934     + if (!scn)
    8935     + return false;
    8936     +
    8937     + if (gelf_getshdr(scn, &sh) != &sh)
    8938     + return false;
    8939     +
    8940     + if (sh.sh_flags & SHF_EXECINSTR)
    8941     + return true;
    8942     +
    8943     + return false;
    8944     +}
    8945     +
    8946     static int bpf_object__elf_collect(struct bpf_object *obj)
    8947     {
    8948     Elf *elf = obj->efile.elf;
    8949     @@ -742,6 +760,14 @@ static int bpf_object__elf_collect(struct bpf_object *obj)
    8950     } else if (sh.sh_type == SHT_REL) {
    8951     void *reloc = obj->efile.reloc;
    8952     int nr_reloc = obj->efile.nr_reloc + 1;
    8953     + int sec = sh.sh_info; /* points to other section */
    8954     +
    8955     + /* Only do relo for section with exec instructions */
    8956     + if (!section_have_execinstr(obj, sec)) {
    8957     + pr_debug("skip relo %s(%d) for section(%d)\n",
    8958     + name, idx, sec);
    8959     + continue;
    8960     + }
    8961    
    8962     reloc = realloc(reloc,
    8963     sizeof(*obj->efile.reloc) * nr_reloc);
    8964     diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
    8965     index 7ce724fc0544..9a17bc27296e 100644
    8966     --- a/tools/lib/traceevent/event-parse.c
    8967     +++ b/tools/lib/traceevent/event-parse.c
    8968     @@ -4949,21 +4949,22 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
    8969     else
    8970     ls = 2;
    8971    
    8972     - if (*(ptr+1) == 'F' || *(ptr+1) == 'f' ||
    8973     - *(ptr+1) == 'S' || *(ptr+1) == 's') {
    8974     + if (isalnum(ptr[1]))
    8975     ptr++;
    8976     +
    8977     + if (*ptr == 'F' || *ptr == 'f' ||
    8978     + *ptr == 'S' || *ptr == 's') {
    8979     show_func = *ptr;
    8980     - } else if (*(ptr+1) == 'M' || *(ptr+1) == 'm') {
    8981     - print_mac_arg(s, *(ptr+1), data, size, event, arg);
    8982     - ptr++;
    8983     + } else if (*ptr == 'M' || *ptr == 'm') {
    8984     + print_mac_arg(s, *ptr, data, size, event, arg);
    8985     arg = arg->next;
    8986     break;
    8987     - } else if (*(ptr+1) == 'I' || *(ptr+1) == 'i') {
    8988     + } else if (*ptr == 'I' || *ptr == 'i') {
    8989     int n;
    8990    
    8991     - n = print_ip_arg(s, ptr+1, data, size, event, arg);
    8992     + n = print_ip_arg(s, ptr, data, size, event, arg);
    8993     if (n > 0) {
    8994     - ptr += n;
    8995     + ptr += n - 1;
    8996     arg = arg->next;
    8997     break;
    8998     }
    8999     diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
    9000     index 7c214ceb9386..5e10ba796a6f 100644
    9001     --- a/tools/lib/traceevent/parse-filter.c
    9002     +++ b/tools/lib/traceevent/parse-filter.c
    9003     @@ -1879,17 +1879,25 @@ static const char *get_field_str(struct filter_arg *arg, struct pevent_record *r
    9004     struct pevent *pevent;
    9005     unsigned long long addr;
    9006     const char *val = NULL;
    9007     + unsigned int size;
    9008     char hex[64];
    9009    
    9010     /* If the field is not a string convert it */
    9011     if (arg->str.field->flags & FIELD_IS_STRING) {
    9012     val = record->data + arg->str.field->offset;
    9013     + size = arg->str.field->size;
    9014     +
    9015     + if (arg->str.field->flags & FIELD_IS_DYNAMIC) {
    9016     + addr = *(unsigned int *)val;
    9017     + val = record->data + (addr & 0xffff);
    9018     + size = addr >> 16;
    9019     + }
    9020    
    9021     /*
    9022     * We need to copy the data since we can't be sure the field
    9023     * is null terminated.
    9024     */
    9025     - if (*(val + arg->str.field->size - 1)) {
    9026     + if (*(val + size - 1)) {
    9027     /* copy it */
    9028     memcpy(arg->str.buffer, val, arg->str.field->size);
    9029     /* the buffer is already NULL terminated */
    9030     diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c
    9031     index 33027c5e6f92..c6b5204e0280 100644
    9032     --- a/tools/perf/arch/x86/util/header.c
    9033     +++ b/tools/perf/arch/x86/util/header.c
    9034     @@ -70,7 +70,7 @@ get_cpuid_str(void)
    9035     {
    9036     char *buf = malloc(128);
    9037    
    9038     - if (__get_cpuid(buf, 128, "%s-%u-%X$") < 0) {
    9039     + if (buf && __get_cpuid(buf, 128, "%s-%u-%X$") < 0) {
    9040     free(buf);
    9041     return NULL;
    9042     }
    9043     diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
    9044     index d00aac51130d..3479a1bc7caa 100644
    9045     --- a/tools/perf/builtin-c2c.c
    9046     +++ b/tools/perf/builtin-c2c.c
    9047     @@ -2393,9 +2393,10 @@ static int setup_callchain(struct perf_evlist *evlist)
    9048     enum perf_call_graph_mode mode = CALLCHAIN_NONE;
    9049    
    9050     if ((sample_type & PERF_SAMPLE_REGS_USER) &&
    9051     - (sample_type & PERF_SAMPLE_STACK_USER))
    9052     + (sample_type & PERF_SAMPLE_STACK_USER)) {
    9053     mode = CALLCHAIN_DWARF;
    9054     - else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9055     + dwarf_callchain_users = true;
    9056     + } else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9057     mode = CALLCHAIN_LBR;
    9058     else if (sample_type & PERF_SAMPLE_CALLCHAIN)
    9059     mode = CALLCHAIN_FP;
    9060     diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
    9061     index 1957abc1c8cf..b205c1340456 100644
    9062     --- a/tools/perf/builtin-record.c
    9063     +++ b/tools/perf/builtin-record.c
    9064     @@ -1611,7 +1611,8 @@ static struct option __record_options[] = {
    9065     OPT_BOOLEAN_SET('T', "timestamp", &record.opts.sample_time,
    9066     &record.opts.sample_time_set,
    9067     "Record the sample timestamps"),
    9068     - OPT_BOOLEAN('P', "period", &record.opts.period, "Record the sample period"),
    9069     + OPT_BOOLEAN_SET('P', "period", &record.opts.period, &record.opts.period_set,
    9070     + "Record the sample period"),
    9071     OPT_BOOLEAN('n', "no-samples", &record.opts.no_samples,
    9072     "don't sample"),
    9073     OPT_BOOLEAN_SET('N', "no-buildid-cache", &record.no_buildid_cache,
    9074     diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
    9075     index 183c3ed56e08..4ddb0726eebc 100644
    9076     --- a/tools/perf/builtin-report.c
    9077     +++ b/tools/perf/builtin-report.c
    9078     @@ -328,9 +328,10 @@ static int report__setup_sample_type(struct report *rep)
    9079    
    9080     if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) {
    9081     if ((sample_type & PERF_SAMPLE_REGS_USER) &&
    9082     - (sample_type & PERF_SAMPLE_STACK_USER))
    9083     + (sample_type & PERF_SAMPLE_STACK_USER)) {
    9084     callchain_param.record_mode = CALLCHAIN_DWARF;
    9085     - else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9086     + dwarf_callchain_users = true;
    9087     + } else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9088     callchain_param.record_mode = CALLCHAIN_LBR;
    9089     else
    9090     callchain_param.record_mode = CALLCHAIN_FP;
    9091     diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
    9092     index 0fe02758de7d..615fdc63452e 100644
    9093     --- a/tools/perf/builtin-script.c
    9094     +++ b/tools/perf/builtin-script.c
    9095     @@ -2574,9 +2574,10 @@ static void script__setup_sample_type(struct perf_script *script)
    9096    
    9097     if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) {
    9098     if ((sample_type & PERF_SAMPLE_REGS_USER) &&
    9099     - (sample_type & PERF_SAMPLE_STACK_USER))
    9100     + (sample_type & PERF_SAMPLE_STACK_USER)) {
    9101     callchain_param.record_mode = CALLCHAIN_DWARF;
    9102     - else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9103     + dwarf_callchain_users = true;
    9104     + } else if (sample_type & PERF_SAMPLE_BRANCH_STACK)
    9105     callchain_param.record_mode = CALLCHAIN_LBR;
    9106     else
    9107     callchain_param.record_mode = CALLCHAIN_FP;
    9108     diff --git a/tools/perf/perf.h b/tools/perf/perf.h
    9109     index f75f3dec7485..55086389fc06 100644
    9110     --- a/tools/perf/perf.h
    9111     +++ b/tools/perf/perf.h
    9112     @@ -50,6 +50,7 @@ struct record_opts {
    9113     bool sample_time_set;
    9114     bool sample_cpu;
    9115     bool period;
    9116     + bool period_set;
    9117     bool running_time;
    9118     bool full_auxtrace;
    9119     bool auxtrace_snapshot_mode;
    9120     diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c
    9121     index ac40e05bcab4..260418969120 100644
    9122     --- a/tools/perf/tests/dwarf-unwind.c
    9123     +++ b/tools/perf/tests/dwarf-unwind.c
    9124     @@ -173,6 +173,7 @@ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unu
    9125     }
    9126    
    9127     callchain_param.record_mode = CALLCHAIN_DWARF;
    9128     + dwarf_callchain_users = true;
    9129    
    9130     if (init_live_machine(machine)) {
    9131     pr_err("Could not init machine\n");
    9132     diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
    9133     index 7a84d73324e3..a2f757da49d9 100755
    9134     --- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
    9135     +++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh
    9136     @@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() {
    9137     expected[4]="rtt min.*"
    9138     expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)"
    9139     expected[6]=".*inet_pton[[:space:]]\($libc\)$"
    9140     - expected[7]="getaddrinfo[[:space:]]\($libc\)$"
    9141     - expected[8]=".*\(.*/bin/ping.*\)$"
    9142     + case "$(uname -m)" in
    9143     + s390x)
    9144     + eventattr='call-graph=dwarf'
    9145     + expected[7]="gaih_inet[[:space:]]\(inlined\)$"
    9146     + expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$"
    9147     + expected[9]="main[[:space:]]\(.*/bin/ping.*\)$"
    9148     + expected[10]="__libc_start_main[[:space:]]\($libc\)$"
    9149     + expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$"
    9150     + ;;
    9151     + *)
    9152     + eventattr='max-stack=3'
    9153     + expected[7]="getaddrinfo[[:space:]]\($libc\)$"
    9154     + expected[8]=".*\(.*/bin/ping.*\)$"
    9155     + ;;
    9156     + esac
    9157    
    9158     - perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
    9159     + perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do
    9160     echo $line
    9161     echo "$line" | egrep -q "${expected[$idx]}"
    9162     if [ $? -ne 0 ] ; then
    9163     @@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() {
    9164     exit 1
    9165     fi
    9166     let idx+=1
    9167     - [ $idx -eq 9 ] && break
    9168     + [ -z "${expected[$idx]}" ] && break
    9169     done
    9170     }
    9171    
    9172     diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
    9173     index 6031933d811c..146683b1c28d 100644
    9174     --- a/tools/perf/util/callchain.c
    9175     +++ b/tools/perf/util/callchain.c
    9176     @@ -37,6 +37,15 @@ struct callchain_param callchain_param = {
    9177     CALLCHAIN_PARAM_DEFAULT
    9178     };
    9179    
    9180     +/*
    9181     + * Are there any events usind DWARF callchains?
    9182     + *
    9183     + * I.e.
    9184     + *
    9185     + * -e cycles/call-graph=dwarf/
    9186     + */
    9187     +bool dwarf_callchain_users;
    9188     +
    9189     struct callchain_param callchain_param_default = {
    9190     CALLCHAIN_PARAM_DEFAULT
    9191     };
    9192     @@ -265,6 +274,7 @@ int parse_callchain_record(const char *arg, struct callchain_param *param)
    9193     ret = 0;
    9194     param->record_mode = CALLCHAIN_DWARF;
    9195     param->dump_size = default_stack_dump_size;
    9196     + dwarf_callchain_users = true;
    9197    
    9198     tok = strtok_r(NULL, ",", &saveptr);
    9199     if (tok) {
    9200     diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
    9201     index f967aa47d0a1..9ba5903c8d3e 100644
    9202     --- a/tools/perf/util/callchain.h
    9203     +++ b/tools/perf/util/callchain.h
    9204     @@ -89,6 +89,8 @@ enum chain_value {
    9205     CCVAL_COUNT,
    9206     };
    9207    
    9208     +extern bool dwarf_callchain_users;
    9209     +
    9210     struct callchain_param {
    9211     bool enabled;
    9212     enum perf_call_graph_mode record_mode;
    9213     diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
    9214     index ac19130c14d8..226a9245d1db 100644
    9215     --- a/tools/perf/util/evsel.c
    9216     +++ b/tools/perf/util/evsel.c
    9217     @@ -722,26 +722,28 @@ static void apply_config_terms(struct perf_evsel *evsel,
    9218     struct perf_evsel_config_term *term;
    9219     struct list_head *config_terms = &evsel->config_terms;
    9220     struct perf_event_attr *attr = &evsel->attr;
    9221     - struct callchain_param param;
    9222     + /* callgraph default */
    9223     + struct callchain_param param = {
    9224     + .record_mode = callchain_param.record_mode,
    9225     + };
    9226     u32 dump_size = 0;
    9227     int max_stack = 0;
    9228     const char *callgraph_buf = NULL;
    9229    
    9230     - /* callgraph default */
    9231     - param.record_mode = callchain_param.record_mode;
    9232     -
    9233     list_for_each_entry(term, config_terms, list) {
    9234     switch (term->type) {
    9235     case PERF_EVSEL__CONFIG_TERM_PERIOD:
    9236     if (!(term->weak && opts->user_interval != ULLONG_MAX)) {
    9237     attr->sample_period = term->val.period;
    9238     attr->freq = 0;
    9239     + perf_evsel__reset_sample_bit(evsel, PERIOD);
    9240     }
    9241     break;
    9242     case PERF_EVSEL__CONFIG_TERM_FREQ:
    9243     if (!(term->weak && opts->user_freq != UINT_MAX)) {
    9244     attr->sample_freq = term->val.freq;
    9245     attr->freq = 1;
    9246     + perf_evsel__set_sample_bit(evsel, PERIOD);
    9247     }
    9248     break;
    9249     case PERF_EVSEL__CONFIG_TERM_TIME:
    9250     @@ -943,9 +945,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
    9251     if (target__has_cpu(&opts->target) || opts->sample_cpu)
    9252     perf_evsel__set_sample_bit(evsel, CPU);
    9253    
    9254     - if (opts->period)
    9255     - perf_evsel__set_sample_bit(evsel, PERIOD);
    9256     -
    9257     /*
    9258     * When the user explicitly disabled time don't force it here.
    9259     */
    9260     @@ -1047,6 +1046,14 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
    9261     apply_config_terms(evsel, opts);
    9262    
    9263     evsel->ignore_missing_thread = opts->ignore_missing_thread;
    9264     +
    9265     + /* The --period option takes the precedence. */
    9266     + if (opts->period_set) {
    9267     + if (opts->period)
    9268     + perf_evsel__set_sample_bit(evsel, PERIOD);
    9269     + else
    9270     + perf_evsel__reset_sample_bit(evsel, PERIOD);
    9271     + }
    9272     }
    9273    
    9274     static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads)
    9275     diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
    9276     index 7a42f703e858..af873044d33a 100644
    9277     --- a/tools/perf/util/unwind-libunwind-local.c
    9278     +++ b/tools/perf/util/unwind-libunwind-local.c
    9279     @@ -631,9 +631,8 @@ static unw_accessors_t accessors = {
    9280    
    9281     static int _unwind__prepare_access(struct thread *thread)
    9282     {
    9283     - if (callchain_param.record_mode != CALLCHAIN_DWARF)
    9284     + if (!dwarf_callchain_users)
    9285     return 0;
    9286     -
    9287     thread->addr_space = unw_create_addr_space(&accessors, 0);
    9288     if (!thread->addr_space) {
    9289     pr_err("unwind: Can't create unwind address space.\n");
    9290     @@ -646,17 +645,15 @@ static int _unwind__prepare_access(struct thread *thread)
    9291    
    9292     static void _unwind__flush_access(struct thread *thread)
    9293     {
    9294     - if (callchain_param.record_mode != CALLCHAIN_DWARF)
    9295     + if (!dwarf_callchain_users)
    9296     return;
    9297     -
    9298     unw_flush_cache(thread->addr_space, 0, 0);
    9299     }
    9300    
    9301     static void _unwind__finish_access(struct thread *thread)
    9302     {
    9303     - if (callchain_param.record_mode != CALLCHAIN_DWARF)
    9304     + if (!dwarf_callchain_users)
    9305     return;
    9306     -
    9307     unw_destroy_addr_space(thread->addr_space);
    9308     }
    9309    
    9310     diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
    9311     index 50ce52d2013d..8b9470b5af6d 100644
    9312     --- a/tools/testing/selftests/bpf/test_maps.c
    9313     +++ b/tools/testing/selftests/bpf/test_maps.c
    9314     @@ -463,7 +463,7 @@ static void test_devmap(int task, void *data)
    9315     #define SOCKMAP_VERDICT_PROG "./sockmap_verdict_prog.o"
    9316     static void test_sockmap(int tasks, void *data)
    9317     {
    9318     - int one = 1, map_fd_rx, map_fd_tx, map_fd_break, s, sc, rc;
    9319     + int one = 1, map_fd_rx = 0, map_fd_tx = 0, map_fd_break, s, sc, rc;
    9320     struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_break;
    9321     int ports[] = {50200, 50201, 50202, 50204};
    9322     int err, i, fd, udp, sfd[6] = {0xdeadbeef};
    9323     @@ -868,9 +868,12 @@ static void test_sockmap(int tasks, void *data)
    9324     goto out_sockmap;
    9325     }
    9326    
    9327     - /* Test map close sockets */
    9328     - for (i = 0; i < 6; i++)
    9329     + /* Test map close sockets and empty maps */
    9330     + for (i = 0; i < 6; i++) {
    9331     + bpf_map_delete_elem(map_fd_tx, &i);
    9332     + bpf_map_delete_elem(map_fd_rx, &i);
    9333     close(sfd[i]);
    9334     + }
    9335     close(fd);
    9336     close(map_fd_rx);
    9337     bpf_object__close(obj);
    9338     @@ -881,8 +884,13 @@ static void test_sockmap(int tasks, void *data)
    9339     printf("Failed to create sockmap '%i:%s'!\n", i, strerror(errno));
    9340     exit(1);
    9341     out_sockmap:
    9342     - for (i = 0; i < 6; i++)
    9343     + for (i = 0; i < 6; i++) {
    9344     + if (map_fd_tx)
    9345     + bpf_map_delete_elem(map_fd_tx, &i);
    9346     + if (map_fd_rx)
    9347     + bpf_map_delete_elem(map_fd_rx, &i);
    9348     close(sfd[i]);
    9349     + }
    9350     close(fd);
    9351     exit(1);
    9352     }
    9353     diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
    9354     index 589d52b211b7..27a54a17da65 100644
    9355     --- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
    9356     +++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc
    9357     @@ -29,6 +29,12 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$'
    9358     # filter by *, end match
    9359     ftrace_filter_check 'schedule*' '^schedule.*$'
    9360    
    9361     +# filter by *mid*end
    9362     +ftrace_filter_check '*aw*lock' '.*aw.*lock$'
    9363     +
    9364     +# filter by start*mid*
    9365     +ftrace_filter_check 'mutex*try*' '^mutex.*try.*'
    9366     +
    9367     # Advanced full-glob matching feature is recently supported.
    9368     # Skip the tests if we are sure the kernel does not support it.
    9369     if grep -q 'accepts: .* glob-matching-pattern' README ; then
    9370     diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
    9371     index bb16cf91f1b5..e297bd7a2e79 100644
    9372     --- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
    9373     +++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
    9374     @@ -12,8 +12,8 @@ case `uname -m` in
    9375     *) OFFS=0;;
    9376     esac
    9377    
    9378     -echo "Setup up to 256 kprobes"
    9379     -grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
    9380     +echo "Setup up kprobes on first 256 text symbols"
    9381     +grep -i " t " /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
    9382     head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||:
    9383    
    9384     echo 1 > events/kprobes/enable
    9385     diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
    9386     index 4a8217448f20..cad14cd0ea92 100644
    9387     --- a/tools/testing/selftests/net/reuseport_bpf.c
    9388     +++ b/tools/testing/selftests/net/reuseport_bpf.c
    9389     @@ -21,6 +21,7 @@
    9390     #include <sys/epoll.h>
    9391     #include <sys/types.h>
    9392     #include <sys/socket.h>
    9393     +#include <sys/resource.h>
    9394     #include <unistd.h>
    9395    
    9396     #ifndef ARRAY_SIZE
    9397     @@ -190,11 +191,14 @@ static void send_from(struct test_params p, uint16_t sport, char *buf,
    9398     struct sockaddr * const saddr = new_any_sockaddr(p.send_family, sport);
    9399     struct sockaddr * const daddr =
    9400     new_loopback_sockaddr(p.send_family, p.recv_port);
    9401     - const int fd = socket(p.send_family, p.protocol, 0);
    9402     + const int fd = socket(p.send_family, p.protocol, 0), one = 1;
    9403    
    9404     if (fd < 0)
    9405     error(1, errno, "failed to create send socket");
    9406    
    9407     + if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one)))
    9408     + error(1, errno, "failed to set reuseaddr");
    9409     +
    9410     if (bind(fd, saddr, sockaddr_size()))
    9411     error(1, errno, "failed to bind send socket");
    9412    
    9413     @@ -433,6 +437,21 @@ void enable_fastopen(void)
    9414     }
    9415     }
    9416    
    9417     +static struct rlimit rlim_old, rlim_new;
    9418     +
    9419     +static __attribute__((constructor)) void main_ctor(void)
    9420     +{
    9421     + getrlimit(RLIMIT_MEMLOCK, &rlim_old);
    9422     + rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
    9423     + rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
    9424     + setrlimit(RLIMIT_MEMLOCK, &rlim_new);
    9425     +}
    9426     +
    9427     +static __attribute__((destructor)) void main_dtor(void)
    9428     +{
    9429     + setrlimit(RLIMIT_MEMLOCK, &rlim_old);
    9430     +}
    9431     +
    9432     int main(void)
    9433     {
    9434     fprintf(stderr, "---- IPv4 UDP ----\n");
    9435     diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    9436     index d81af263f50b..4f35f0dfe681 100644
    9437     --- a/virt/kvm/kvm_main.c
    9438     +++ b/virt/kvm/kvm_main.c
    9439     @@ -1434,7 +1434,8 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault)
    9440    
    9441     static int hva_to_pfn_remapped(struct vm_area_struct *vma,
    9442     unsigned long addr, bool *async,
    9443     - bool write_fault, kvm_pfn_t *p_pfn)
    9444     + bool write_fault, bool *writable,
    9445     + kvm_pfn_t *p_pfn)
    9446     {
    9447     unsigned long pfn;
    9448     int r;
    9449     @@ -1460,6 +1461,8 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma,
    9450    
    9451     }
    9452    
    9453     + if (writable)
    9454     + *writable = true;
    9455    
    9456     /*
    9457     * Get a reference here because callers of *hva_to_pfn* and
    9458     @@ -1525,7 +1528,7 @@ static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async,
    9459     if (vma == NULL)
    9460     pfn = KVM_PFN_ERR_FAULT;
    9461     else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) {
    9462     - r = hva_to_pfn_remapped(vma, addr, async, write_fault, &pfn);
    9463     + r = hva_to_pfn_remapped(vma, addr, async, write_fault, writable, &pfn);
    9464     if (r == -EAGAIN)
    9465     goto retry;
    9466     if (r < 0)