From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1067330-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id BB3EE138334
for <garchives@archives.gentoo.org>; Wed, 16 Jan 2019 23:34:19 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id EE261E0ADB;
Wed, 16 Jan 2019 23:34:18 +0000 (UTC)
Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id B6EF4E0ADB
for <gentoo-commits@lists.gentoo.org>; Wed, 16 Jan 2019 23:34:18 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 46B65335C51
for <gentoo-commits@lists.gentoo.org>; Wed, 16 Jan 2019 23:34:17 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id F2E61266
for <gentoo-commits@lists.gentoo.org>; Wed, 16 Jan 2019 23:34:14 +0000 (UTC)
From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" <mpagano@gentoo.org>
Message-ID: <1547681628.50b5973dba7e280fdff49b75c5e01b25f78ec68e.mpagano@gentoo>
Subject: [gentoo-commits] proj/linux-patches:4.20 commit in: /
X-VCS-Repository: proj/linux-patches
X-VCS-Files: 0000_README 1002_linux-4.20.3.patch
X-VCS-Directories: /
X-VCS-Committer: mpagano
X-VCS-Committer-Name: Mike Pagano
X-VCS-Revision: 50b5973dba7e280fdff49b75c5e01b25f78ec68e
X-VCS-Branch: 4.20
Date: Wed, 16 Jan 2019 23:34:14 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: 4ba0e7ba-9a04-43c3-9b3d-a55fbda01c44
X-Archives-Hash: 24694125a1a7b788b2abed89558f63dc
commit: 50b5973dba7e280fdff49b75c5e01b25f78ec68e
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jan 16 23:33:48 2019 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jan 16 23:33:48 2019 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=50b5973d
proj/linux-patches: Linux patch 4.20.3
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1002_linux-4.20.3.patch | 1927 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1931 insertions(+)
diff --git a/0000_README b/0000_README
index 0e0dc28..d6c119a 100644
--- a/0000_README
+++ b/0000_README
@@ -51,6 +51,10 @@ Patch: 1001_linux-4.20.2.patch
From: http://www.kernel.org
Desc: Linux 4.20.2
+Patch: 1002_linux-4.20.3.patch
+From: http://www.kernel.org
+Desc: Linux 4.20.3
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1002_linux-4.20.3.patch b/1002_linux-4.20.3.patch
new file mode 100644
index 0000000..268cb43
--- /dev/null
+++ b/1002_linux-4.20.3.patch
@@ -0,0 +1,1927 @@
+diff --git a/Makefile b/Makefile
+index 4ba3dd0bf35d..3b9e4658d31f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 20
+-SUBLEVEL = 2
++SUBLEVEL = 3
+ EXTRAVERSION =
+ NAME = Shy Crocodile
+
+diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c
+index 7d8ab36ff83d..b3a3f5a59b5c 100644
+--- a/arch/arm/mach-davinci/board-da830-evm.c
++++ b/arch/arm/mach-davinci/board-da830-evm.c
+@@ -207,9 +207,9 @@ static struct gpiod_lookup_table mmc_gpios_table = {
+ .dev_id = "da830-mmc.0",
+ .table = {
+ /* gpio chip 1 contains gpio range 32-63 */
+- GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_CD_PIN, "cd",
++ GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_CD_PIN, "cd",
+ GPIO_ACTIVE_LOW),
+- GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_WP_PIN, "wp",
++ GPIO_LOOKUP("davinci_gpio", DA830_MMCSD_WP_PIN, "wp",
+ GPIO_ACTIVE_LOW),
+ },
+ };
+diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c
+index e1a949b47306..bf2549e1894b 100644
+--- a/arch/arm/mach-davinci/board-da850-evm.c
++++ b/arch/arm/mach-davinci/board-da850-evm.c
+@@ -780,9 +780,9 @@ static struct gpiod_lookup_table mmc_gpios_table = {
+ .dev_id = "da830-mmc.0",
+ .table = {
+ /* gpio chip 2 contains gpio range 64-95 */
+- GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd",
++ GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_CD_PIN, "cd",
+ GPIO_ACTIVE_LOW),
+- GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp",
++ GPIO_LOOKUP("davinci_gpio", DA850_MMCSD_WP_PIN, "wp",
+ GPIO_ACTIVE_HIGH),
+ },
+ };
+diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c
+index f53a461a606f..f7fa960c23e3 100644
+--- a/arch/arm/mach-davinci/board-dm355-evm.c
++++ b/arch/arm/mach-davinci/board-dm355-evm.c
+@@ -117,9 +117,9 @@ static struct platform_device davinci_nand_device = {
+ static struct gpiod_lookup_table i2c_recovery_gpiod_table = {
+ .dev_id = "i2c_davinci.1",
+ .table = {
+- GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SDA_PIN, "sda",
++ GPIO_LOOKUP("davinci_gpio", DM355_I2C_SDA_PIN, "sda",
+ GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
+- GPIO_LOOKUP("davinci_gpio.0", DM355_I2C_SCL_PIN, "scl",
++ GPIO_LOOKUP("davinci_gpio", DM355_I2C_SCL_PIN, "scl",
+ GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
+ },
+ };
+diff --git a/arch/arm/mach-davinci/board-dm644x-evm.c b/arch/arm/mach-davinci/board-dm644x-evm.c
+index e4a8f9225d16..f752d828e42f 100644
+--- a/arch/arm/mach-davinci/board-dm644x-evm.c
++++ b/arch/arm/mach-davinci/board-dm644x-evm.c
+@@ -638,9 +638,9 @@ static struct i2c_board_info __initdata i2c_info[] = {
+ static struct gpiod_lookup_table i2c_recovery_gpiod_table = {
+ .dev_id = "i2c_davinci.1",
+ .table = {
+- GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SDA_PIN, "sda",
++ GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SDA_PIN, "sda",
+ GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
+- GPIO_LOOKUP("davinci_gpio.0", DM644X_I2C_SCL_PIN, "scl",
++ GPIO_LOOKUP("davinci_gpio", DM644X_I2C_SCL_PIN, "scl",
+ GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN),
+ },
+ };
+diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
+index 8e8d51f4a276..94c4f126ef86 100644
+--- a/arch/arm/mach-davinci/board-omapl138-hawk.c
++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
+@@ -134,9 +134,9 @@ static const short hawk_mmcsd0_pins[] = {
+ static struct gpiod_lookup_table mmc_gpios_table = {
+ .dev_id = "da830-mmc.0",
+ .table = {
+- GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd",
++ GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_CD_PIN, "cd",
+ GPIO_ACTIVE_LOW),
+- GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp",
++ GPIO_LOOKUP("davinci_gpio", DA850_HAWK_MMCSD_WP_PIN, "wp",
+ GPIO_ACTIVE_LOW),
+ },
+ };
+diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
+index fd59fef9931b..1355fab5f676 100644
+--- a/arch/powerpc/kernel/signal_32.c
++++ b/arch/powerpc/kernel/signal_32.c
+@@ -1158,11 +1158,11 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ {
+ struct rt_sigframe __user *rt_sf;
+ struct pt_regs *regs = current_pt_regs();
++ int tm_restore = 0;
+ #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ struct ucontext __user *uc_transact;
+ unsigned long msr_hi;
+ unsigned long tmp;
+- int tm_restore = 0;
+ #endif
+ /* Always make any pending restarted system calls return -EINTR */
+ current->restart_block.fn = do_no_restart_syscall;
+@@ -1210,11 +1210,19 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ goto bad;
+ }
+ }
+- if (!tm_restore)
+- /* Fall through, for non-TM restore */
++ if (!tm_restore) {
++ /*
++ * Unset regs->msr because ucontext MSR TS is not
++ * set, and recheckpoint was not called. This avoid
++ * hitting a TM Bad thing at RFID
++ */
++ regs->msr &= ~MSR_TS_MASK;
++ }
++ /* Fall through, for non-TM restore */
+ #endif
+- if (do_setcontext(&rt_sf->uc, regs, 1))
+- goto bad;
++ if (!tm_restore)
++ if (do_setcontext(&rt_sf->uc, regs, 1))
++ goto bad;
+
+ /*
+ * It's not clear whether or why it is desirable to save the
+diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
+index bbd1c73243d7..6f70d1b4bf36 100644
+--- a/arch/powerpc/kernel/signal_64.c
++++ b/arch/powerpc/kernel/signal_64.c
+@@ -756,11 +756,23 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ &uc_transact->uc_mcontext))
+ goto badframe;
+ }
+- else
+- /* Fall through, for non-TM restore */
+ #endif
+- if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
+- goto badframe;
++ /* Fall through, for non-TM restore */
++ if (!MSR_TM_ACTIVE(msr)) {
++ /*
++ * Unset MSR[TS] on the thread regs since MSR from user
++ * context does not have MSR active, and recheckpoint was
++ * not called since restore_tm_sigcontexts() was not called
++ * also.
++ *
++ * If not unsetting it, the code can RFID to userspace with
++ * MSR[TS] set, but without CPU in the proper state,
++ * causing a TM bad thing.
++ */
++ current->thread.regs->msr &= ~MSR_TS_MASK;
++ if (restore_sigcontext(current, NULL, 1, &uc->uc_mcontext))
++ goto badframe;
++ }
+
+ if (restore_altstack(&uc->uc_stack))
+ goto badframe;
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 362f3cde6a31..7b135796813f 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -213,7 +213,7 @@ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
+ SPECTRE_V2_USER_NONE;
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ static bool spectre_v2_bad_module;
+
+ bool retpoline_module_ok(bool has_retpoline)
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 70f4e80b9246..a1a22e9c0328 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -951,9 +951,10 @@ static int rc_dma_get_range(struct device *dev, u64 *size)
+ {
+ struct acpi_iort_node *node;
+ struct acpi_iort_root_complex *rc;
++ struct pci_bus *pbus = to_pci_dev(dev)->bus;
+
+ node = iort_scan_node(ACPI_IORT_NODE_PCI_ROOT_COMPLEX,
+- iort_match_node_callback, dev);
++ iort_match_node_callback, &pbus->dev);
+ if (!node || node->revision < 1)
+ return -ENODEV;
+
+diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c
+index 2579675b7082..e7c0006e6602 100644
+--- a/drivers/acpi/pmic/intel_pmic_xpower.c
++++ b/drivers/acpi/pmic/intel_pmic_xpower.c
+@@ -20,8 +20,11 @@
+ #define GPI1_LDO_ON (3 << 0)
+ #define GPI1_LDO_OFF (4 << 0)
+
+-#define AXP288_ADC_TS_PIN_GPADC 0xf2
+-#define AXP288_ADC_TS_PIN_ON 0xf3
++#define AXP288_ADC_TS_CURRENT_ON_OFF_MASK GENMASK(1, 0)
++#define AXP288_ADC_TS_CURRENT_OFF (0 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_WHEN_CHARGING (1 << 0)
++#define AXP288_ADC_TS_CURRENT_ON_ONDEMAND (2 << 0)
++#define AXP288_ADC_TS_CURRENT_ON (3 << 0)
+
+ static struct pmic_table power_table[] = {
+ {
+@@ -212,22 +215,44 @@ out:
+ */
+ static int intel_xpower_pmic_get_raw_temp(struct regmap *regmap, int reg)
+ {
++ int ret, adc_ts_pin_ctrl;
+ u8 buf[2];
+- int ret;
+
+- ret = regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL,
+- AXP288_ADC_TS_PIN_GPADC);
++ /*
++ * The current-source used for the battery temp-sensor (TS) is shared
++ * with the GPADC. For proper fuel-gauge and charger operation the TS
++ * current-source needs to be permanently on. But to read the GPADC we
++ * need to temporary switch the TS current-source to ondemand, so that
++ * the GPADC can use it, otherwise we will always read an all 0 value.
++ *
++ * Note that the switching from on to on-ondemand is not necessary
++ * when the TS current-source is off (this happens on devices which
++ * do not use the TS-pin).
++ */
++ ret = regmap_read(regmap, AXP288_ADC_TS_PIN_CTRL, &adc_ts_pin_ctrl);
+ if (ret)
+ return ret;
+
+- /* After switching to the GPADC pin give things some time to settle */
+- usleep_range(6000, 10000);
++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
++ ret = regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON_ONDEMAND);
++ if (ret)
++ return ret;
++
++ /* Wait a bit after switching the current-source */
++ usleep_range(6000, 10000);
++ }
+
+ ret = regmap_bulk_read(regmap, AXP288_GP_ADC_H, buf, 2);
+ if (ret == 0)
+ ret = (buf[0] << 4) + ((buf[1] >> 4) & 0x0f);
+
+- regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON);
++ if (adc_ts_pin_ctrl & AXP288_ADC_TS_CURRENT_ON_OFF_MASK) {
++ regmap_update_bits(regmap, AXP288_ADC_TS_PIN_CTRL,
++ AXP288_ADC_TS_CURRENT_ON_OFF_MASK,
++ AXP288_ADC_TS_CURRENT_ON);
++ }
+
+ return ret;
+ }
+diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
+index 1b475bc1ae16..665e93ca0b40 100644
+--- a/drivers/acpi/power.c
++++ b/drivers/acpi/power.c
+@@ -131,6 +131,23 @@ void acpi_power_resources_list_free(struct list_head *list)
+ }
+ }
+
++static bool acpi_power_resource_is_dup(union acpi_object *package,
++ unsigned int start, unsigned int i)
++{
++ acpi_handle rhandle, dup;
++ unsigned int j;
++
++ /* The caller is expected to check the package element types */
++ rhandle = package->package.elements[i].reference.handle;
++ for (j = start; j < i; j++) {
++ dup = package->package.elements[j].reference.handle;
++ if (dup == rhandle)
++ return true;
++ }
++
++ return false;
++}
++
+ int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
+ struct list_head *list)
+ {
+@@ -150,6 +167,11 @@ int acpi_extract_power_resources(union acpi_object *package, unsigned int start,
+ err = -ENODEV;
+ break;
+ }
++
++ /* Some ACPI tables contain duplicate power resource references */
++ if (acpi_power_resource_is_dup(package, start, i))
++ continue;
++
+ err = acpi_add_power_resource(rhandle);
+ if (err)
+ break;
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 8e5140bbf241..1e92b61d0bd5 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -5986,7 +5986,6 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
+ struct list_head *tmp;
+ int dev_id;
+ char opt_buf[6];
+- bool already = false;
+ bool force = false;
+ int ret;
+
+@@ -6019,13 +6018,13 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
+ spin_lock_irq(&rbd_dev->lock);
+ if (rbd_dev->open_count && !force)
+ ret = -EBUSY;
+- else
+- already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
+- &rbd_dev->flags);
++ else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING,
++ &rbd_dev->flags))
++ ret = -EINPROGRESS;
+ spin_unlock_irq(&rbd_dev->lock);
+ }
+ spin_unlock(&rbd_dev_list_lock);
+- if (ret < 0 || already)
++ if (ret)
+ return ret;
+
+ if (force) {
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index 50b1551ba894..242c3370544e 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -52,9 +52,9 @@ scmi_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
+ int ret;
+ struct scmi_data *priv = policy->driver_data;
+ struct scmi_perf_ops *perf_ops = handle->perf_ops;
+- u64 freq = policy->freq_table[index].frequency * 1000;
++ u64 freq = policy->freq_table[index].frequency;
+
+- ret = perf_ops->freq_set(handle, priv->domain_id, freq, false);
++ ret = perf_ops->freq_set(handle, priv->domain_id, freq * 1000, false);
+ if (!ret)
+ arch_set_freq_scale(policy->related_cpus, freq,
+ policy->cpuinfo.max_freq);
+@@ -176,7 +176,7 @@ static int scmi_cpufreq_init(struct cpufreq_policy *policy)
+ out_free_priv:
+ kfree(priv);
+ out_free_opp:
+- dev_pm_opp_cpumask_remove_table(policy->cpus);
++ dev_pm_opp_remove_all_dynamic(cpu_dev);
+
+ return ret;
+ }
+@@ -188,7 +188,7 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
+ cpufreq_cooling_unregister(priv->cdev);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+ kfree(priv);
+- dev_pm_opp_cpumask_remove_table(policy->related_cpus);
++ dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+
+ return 0;
+ }
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index 87a98ec77773..99449738faa4 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -177,7 +177,7 @@ out_free_cpufreq_table:
+ out_free_priv:
+ kfree(priv);
+ out_free_opp:
+- dev_pm_opp_cpumask_remove_table(policy->cpus);
++ dev_pm_opp_remove_all_dynamic(cpu_dev);
+
+ return ret;
+ }
+@@ -190,7 +190,7 @@ static int scpi_cpufreq_exit(struct cpufreq_policy *policy)
+ clk_put(priv->clk);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+ kfree(priv);
+- dev_pm_opp_cpumask_remove_table(policy->related_cpus);
++ dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 74b611e8a1b1..c79517dc8804 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -864,6 +864,7 @@ static const struct pci_device_id pciidlist[] = {
+ /* VEGAM */
+ {0x1002, 0x694C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
+ {0x1002, 0x694E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
++ {0x1002, 0x694F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGAM},
+ /* Vega 10 */
+ {0x1002, 0x6860, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+ {0x1002, 0x6861, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VEGA10},
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 5a6edf65c9ea..3118ae0e7a87 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -645,22 +645,36 @@ static void s3_handle_mst(struct drm_device *dev, bool suspend)
+ {
+ struct amdgpu_dm_connector *aconnector;
+ struct drm_connector *connector;
++ struct drm_dp_mst_topology_mgr *mgr;
++ int ret;
++ bool need_hotplug = false;
+
+ drm_modeset_lock(&dev->mode_config.connection_mutex, NULL);
+
+- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
+- aconnector = to_amdgpu_dm_connector(connector);
+- if (aconnector->dc_link->type == dc_connection_mst_branch &&
+- !aconnector->mst_port) {
++ list_for_each_entry(connector, &dev->mode_config.connector_list,
++ head) {
++ aconnector = to_amdgpu_dm_connector(connector);
++ if (aconnector->dc_link->type != dc_connection_mst_branch ||
++ aconnector->mst_port)
++ continue;
+
+- if (suspend)
+- drm_dp_mst_topology_mgr_suspend(&aconnector->mst_mgr);
+- else
+- drm_dp_mst_topology_mgr_resume(&aconnector->mst_mgr);
+- }
++ mgr = &aconnector->mst_mgr;
++
++ if (suspend) {
++ drm_dp_mst_topology_mgr_suspend(mgr);
++ } else {
++ ret = drm_dp_mst_topology_mgr_resume(mgr);
++ if (ret < 0) {
++ drm_dp_mst_topology_mgr_set_mst(mgr, false);
++ need_hotplug = true;
++ }
++ }
+ }
+
+ drm_modeset_unlock(&dev->mode_config.connection_mutex);
++
++ if (need_hotplug)
++ drm_kms_helper_hotplug_event(dev);
+ }
+
+ static int dm_hw_init(void *handle)
+@@ -816,7 +830,6 @@ static int dm_resume(void *handle)
+ struct drm_plane_state *new_plane_state;
+ struct dm_plane_state *dm_new_plane_state;
+ enum dc_connection_type new_connection_type = dc_connection_none;
+- int ret;
+ int i;
+
+ /* power on hardware */
+@@ -889,13 +902,13 @@ static int dm_resume(void *handle)
+ }
+ }
+
+- ret = drm_atomic_helper_resume(ddev, dm->cached_state);
++ drm_atomic_helper_resume(ddev, dm->cached_state);
+
+ dm->cached_state = NULL;
+
+ amdgpu_dm_irq_resume_late(adev);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct amd_ip_funcs amdgpu_dm_funcs = {
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 5da2186b3615..5141c1401889 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -2617,11 +2617,11 @@ void core_link_disable_stream(struct pipe_ctx *pipe_ctx, int option)
+ {
+ struct dc *core_dc = pipe_ctx->stream->ctx->dc;
+
++ core_dc->hwss.blank_stream(pipe_ctx);
++
+ if (pipe_ctx->stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ deallocate_mst_payload(pipe_ctx);
+
+- core_dc->hwss.blank_stream(pipe_ctx);
+-
+ core_dc->hwss.disable_stream(pipe_ctx, option);
+
+ disable_link(pipe_ctx->stream->sink->link, pipe_ctx->stream->signal);
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 9d64f874f965..b10ed61526a5 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -1621,6 +1621,64 @@ static bool drm_fb_pixel_format_equal(const struct fb_var_screeninfo *var_1,
+ var_1->transp.msb_right == var_2->transp.msb_right;
+ }
+
++static void drm_fb_helper_fill_pixel_fmt(struct fb_var_screeninfo *var,
++ u8 depth)
++{
++ switch (depth) {
++ case 8:
++ var->red.offset = 0;
++ var->green.offset = 0;
++ var->blue.offset = 0;
++ var->red.length = 8; /* 8bit DAC */
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 0;
++ var->transp.length = 0;
++ break;
++ case 15:
++ var->red.offset = 10;
++ var->green.offset = 5;
++ var->blue.offset = 0;
++ var->red.length = 5;
++ var->green.length = 5;
++ var->blue.length = 5;
++ var->transp.offset = 15;
++ var->transp.length = 1;
++ break;
++ case 16:
++ var->red.offset = 11;
++ var->green.offset = 5;
++ var->blue.offset = 0;
++ var->red.length = 5;
++ var->green.length = 6;
++ var->blue.length = 5;
++ var->transp.offset = 0;
++ break;
++ case 24:
++ var->red.offset = 16;
++ var->green.offset = 8;
++ var->blue.offset = 0;
++ var->red.length = 8;
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 0;
++ var->transp.length = 0;
++ break;
++ case 32:
++ var->red.offset = 16;
++ var->green.offset = 8;
++ var->blue.offset = 0;
++ var->red.length = 8;
++ var->green.length = 8;
++ var->blue.length = 8;
++ var->transp.offset = 24;
++ var->transp.length = 8;
++ break;
++ default:
++ break;
++ }
++}
++
+ /**
+ * drm_fb_helper_check_var - implementation for &fb_ops.fb_check_var
+ * @var: screeninfo to check
+@@ -1650,6 +1708,20 @@ int drm_fb_helper_check_var(struct fb_var_screeninfo *var,
+ return -EINVAL;
+ }
+
++ /*
++ * Workaround for SDL 1.2, which is known to be setting all pixel format
++ * fields values to zero in some cases. We treat this situation as a
++ * kind of "use some reasonable autodetected values".
++ */
++ if (!var->red.offset && !var->green.offset &&
++ !var->blue.offset && !var->transp.offset &&
++ !var->red.length && !var->green.length &&
++ !var->blue.length && !var->transp.length &&
++ !var->red.msb_right && !var->green.msb_right &&
++ !var->blue.msb_right && !var->transp.msb_right) {
++ drm_fb_helper_fill_pixel_fmt(var, fb->format->depth);
++ }
++
+ /*
+ * drm fbdev emulation doesn't support changing the pixel format at all,
+ * so reject all pixel format changing requests.
+@@ -1961,59 +2033,7 @@ void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helpe
+ info->var.yoffset = 0;
+ info->var.activate = FB_ACTIVATE_NOW;
+
+- switch (fb->format->depth) {
+- case 8:
+- info->var.red.offset = 0;
+- info->var.green.offset = 0;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8; /* 8bit DAC */
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 0;
+- info->var.transp.length = 0;
+- break;
+- case 15:
+- info->var.red.offset = 10;
+- info->var.green.offset = 5;
+- info->var.blue.offset = 0;
+- info->var.red.length = 5;
+- info->var.green.length = 5;
+- info->var.blue.length = 5;
+- info->var.transp.offset = 15;
+- info->var.transp.length = 1;
+- break;
+- case 16:
+- info->var.red.offset = 11;
+- info->var.green.offset = 5;
+- info->var.blue.offset = 0;
+- info->var.red.length = 5;
+- info->var.green.length = 6;
+- info->var.blue.length = 5;
+- info->var.transp.offset = 0;
+- break;
+- case 24:
+- info->var.red.offset = 16;
+- info->var.green.offset = 8;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8;
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 0;
+- info->var.transp.length = 0;
+- break;
+- case 32:
+- info->var.red.offset = 16;
+- info->var.green.offset = 8;
+- info->var.blue.offset = 0;
+- info->var.red.length = 8;
+- info->var.green.length = 8;
+- info->var.blue.length = 8;
+- info->var.transp.offset = 24;
+- info->var.transp.length = 8;
+- break;
+- default:
+- break;
+- }
++ drm_fb_helper_fill_pixel_fmt(&info->var, fb->format->depth);
+
+ info->var.xres = fb_width;
+ info->var.yres = fb_height;
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
+index 07999fe09ad2..4fa1d2b146b1 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -2117,6 +2117,7 @@ static struct i915_vma *pd_vma_create(struct gen6_hw_ppgtt *ppgtt, int size)
+ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
+ {
+ struct gen6_hw_ppgtt *ppgtt = to_gen6_ppgtt(base);
++ int err;
+
+ /*
+ * Workaround the limited maximum vma->pin_count and the aliasing_ppgtt
+@@ -2132,9 +2133,17 @@ int gen6_ppgtt_pin(struct i915_hw_ppgtt *base)
+ * allocator works in address space sizes, so it's multiplied by page
+ * size. We allocate at the top of the GTT to avoid fragmentation.
+ */
+- return i915_vma_pin(ppgtt->vma,
+- 0, GEN6_PD_ALIGN,
+- PIN_GLOBAL | PIN_HIGH);
++ err = i915_vma_pin(ppgtt->vma,
++ 0, GEN6_PD_ALIGN,
++ PIN_GLOBAL | PIN_HIGH);
++ if (err)
++ goto unpin;
++
++ return 0;
++
++unpin:
++ ppgtt->pin_count = 0;
++ return err;
+ }
+
+ void gen6_ppgtt_unpin(struct i915_hw_ppgtt *base)
+diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
+index 1aca742fde4a..ccd76c71af09 100644
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -470,9 +470,15 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ data_arg.data);
+ }
+ case I2C_RETRIES:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ client->adapter->retries = arg;
+ break;
+ case I2C_TIMEOUT:
++ if (arg > INT_MAX)
++ return -EINVAL;
++
+ /* For historical reasons, user-space sets the timeout
+ * value in units of 10 ms.
+ */
+diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c
+index 699d3cf49c6d..7c42a57aca1f 100644
+--- a/drivers/mtd/nand/raw/qcom_nandc.c
++++ b/drivers/mtd/nand/raw/qcom_nandc.c
+@@ -2833,6 +2833,16 @@ static int qcom_nand_host_init_and_register(struct qcom_nand_controller *nandc,
+ if (ret)
+ return ret;
+
++ if (nandc->props->is_bam) {
++ free_bam_transaction(nandc);
++ nandc->bam_txn = alloc_bam_transaction(nandc);
++ if (!nandc->bam_txn) {
++ dev_err(nandc->dev,
++ "failed to allocate bam transaction\n");
++ return -ENOMEM;
++ }
++ }
++
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret)
+ nand_cleanup(chip);
+@@ -2847,16 +2857,6 @@ static int qcom_probe_nand_devices(struct qcom_nand_controller *nandc)
+ struct qcom_nand_host *host;
+ int ret;
+
+- if (nandc->props->is_bam) {
+- free_bam_transaction(nandc);
+- nandc->bam_txn = alloc_bam_transaction(nandc);
+- if (!nandc->bam_txn) {
+- dev_err(nandc->dev,
+- "failed to allocate bam transaction\n");
+- return -ENOMEM;
+- }
+- }
+-
+ for_each_available_child_of_node(dn, child) {
+ host = devm_kzalloc(dev, sizeof(*host), GFP_KERNEL);
+ if (!host) {
+diff --git a/drivers/opp/core.c b/drivers/opp/core.c
+index 2c2df4e4fc14..9280f51f1ce6 100644
+--- a/drivers/opp/core.c
++++ b/drivers/opp/core.c
+@@ -951,11 +951,9 @@ void _opp_free(struct dev_pm_opp *opp)
+ kfree(opp);
+ }
+
+-static void _opp_kref_release(struct kref *kref)
++static void _opp_kref_release(struct dev_pm_opp *opp,
++ struct opp_table *opp_table)
+ {
+- struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
+- struct opp_table *opp_table = opp->opp_table;
+-
+ /*
+ * Notify the changes in the availability of the operable
+ * frequency/voltage list.
+@@ -964,7 +962,22 @@ static void _opp_kref_release(struct kref *kref)
+ opp_debug_remove_one(opp);
+ list_del(&opp->node);
+ kfree(opp);
++}
+
++static void _opp_kref_release_unlocked(struct kref *kref)
++{
++ struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
++ struct opp_table *opp_table = opp->opp_table;
++
++ _opp_kref_release(opp, opp_table);
++}
++
++static void _opp_kref_release_locked(struct kref *kref)
++{
++ struct dev_pm_opp *opp = container_of(kref, struct dev_pm_opp, kref);
++ struct opp_table *opp_table = opp->opp_table;
++
++ _opp_kref_release(opp, opp_table);
+ mutex_unlock(&opp_table->lock);
+ }
+
+@@ -975,10 +988,16 @@ void dev_pm_opp_get(struct dev_pm_opp *opp)
+
+ void dev_pm_opp_put(struct dev_pm_opp *opp)
+ {
+- kref_put_mutex(&opp->kref, _opp_kref_release, &opp->opp_table->lock);
++ kref_put_mutex(&opp->kref, _opp_kref_release_locked,
++ &opp->opp_table->lock);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_put);
+
++static void dev_pm_opp_put_unlocked(struct dev_pm_opp *opp)
++{
++ kref_put(&opp->kref, _opp_kref_release_unlocked);
++}
++
+ /**
+ * dev_pm_opp_remove() - Remove an OPP from OPP table
+ * @dev: device for which we do this operation
+@@ -1022,6 +1041,40 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq)
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_opp_remove);
+
++/**
++ * dev_pm_opp_remove_all_dynamic() - Remove all dynamically created OPPs
++ * @dev: device for which we do this operation
++ *
++ * This function removes all dynamically created OPPs from the opp table.
++ */
++void dev_pm_opp_remove_all_dynamic(struct device *dev)
++{
++ struct opp_table *opp_table;
++ struct dev_pm_opp *opp, *temp;
++ int count = 0;
++
++ opp_table = _find_opp_table(dev);
++ if (IS_ERR(opp_table))
++ return;
++
++ mutex_lock(&opp_table->lock);
++ list_for_each_entry_safe(opp, temp, &opp_table->opp_list, node) {
++ if (opp->dynamic) {
++ dev_pm_opp_put_unlocked(opp);
++ count++;
++ }
++ }
++ mutex_unlock(&opp_table->lock);
++
++ /* Drop the references taken by dev_pm_opp_add() */
++ while (count--)
++ dev_pm_opp_put_opp_table(opp_table);
++
++ /* Drop the reference taken by _find_opp_table() */
++ dev_pm_opp_put_opp_table(opp_table);
++}
++EXPORT_SYMBOL_GPL(dev_pm_opp_remove_all_dynamic);
++
+ struct dev_pm_opp *_opp_allocate(struct opp_table *table)
+ {
+ struct dev_pm_opp *opp;
+diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
+index 29a05759a294..0fa9e8fdce66 100644
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -99,9 +99,6 @@ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
+ (i * MAX_MSI_IRQS_PER_CTRL) +
+ pos);
+ generic_handle_irq(irq);
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS +
+- (i * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, 1 << pos);
+ pos++;
+ }
+ }
+@@ -168,8 +165,8 @@ static void dw_pci_bottom_mask(struct irq_data *data)
+ bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
+
+ pp->irq_status[ctrl] &= ~(1 << bit);
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
+- pp->irq_status[ctrl]);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
++ ~pp->irq_status[ctrl]);
+ }
+
+ raw_spin_unlock_irqrestore(&pp->lock, flags);
+@@ -191,8 +188,8 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
+ bit = data->hwirq % MAX_MSI_IRQS_PER_CTRL;
+
+ pp->irq_status[ctrl] |= 1 << bit;
+- dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE + res, 4,
+- pp->irq_status[ctrl]);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK + res, 4,
++ ~pp->irq_status[ctrl]);
+ }
+
+ raw_spin_unlock_irqrestore(&pp->lock, flags);
+@@ -200,13 +197,22 @@ static void dw_pci_bottom_unmask(struct irq_data *data)
+
+ static void dw_pci_bottom_ack(struct irq_data *d)
+ {
+- struct msi_desc *msi = irq_data_get_msi_desc(d);
+- struct pcie_port *pp;
++ struct pcie_port *pp = irq_data_get_irq_chip_data(d);
++ unsigned int res, bit, ctrl;
++ unsigned long flags;
++
++ ctrl = d->hwirq / MAX_MSI_IRQS_PER_CTRL;
++ res = ctrl * MSI_REG_CTRL_BLOCK_SIZE;
++ bit = d->hwirq % MAX_MSI_IRQS_PER_CTRL;
++
++ raw_spin_lock_irqsave(&pp->lock, flags);
+
+- pp = msi_desc_to_pci_sysdata(msi);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_STATUS + res, 4, 1 << bit);
+
+ if (pp->ops->msi_irq_ack)
+ pp->ops->msi_irq_ack(d->hwirq, pp);
++
++ raw_spin_unlock_irqrestore(&pp->lock, flags);
+ }
+
+ static struct irq_chip dw_pci_msi_bottom_irq_chip = {
+@@ -658,10 +664,15 @@ void dw_pcie_setup_rc(struct pcie_port *pp)
+ num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
+
+ /* Initialize IRQ Status array */
+- for (ctrl = 0; ctrl < num_ctrls; ctrl++)
+- dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
++ for (ctrl = 0; ctrl < num_ctrls; ctrl++) {
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_MASK +
+ (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, &pp->irq_status[ctrl]);
++ 4, ~0);
++ dw_pcie_wr_own_conf(pp, PCIE_MSI_INTR0_ENABLE +
++ (ctrl * MSI_REG_CTRL_BLOCK_SIZE),
++ 4, ~0);
++ pp->irq_status[ctrl] = 0;
++ }
+
+ /* Setup RC BARs */
+ dw_pcie_writel_dbi(pci, PCI_BASE_ADDRESS_0, 0x00000004);
+diff --git a/drivers/staging/rtl8188eu/core/rtw_security.c b/drivers/staging/rtl8188eu/core/rtw_security.c
+index f7407632e80b..bab96c870042 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_security.c
++++ b/drivers/staging/rtl8188eu/core/rtw_security.c
+@@ -154,7 +154,7 @@ void rtw_wep_encrypt(struct adapter *padapter, u8 *pxmitframe)
+
+ pframe = ((struct xmit_frame *)pxmitframe)->buf_addr + hw_hdr_offset;
+
+- crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
++ crypto_ops = lib80211_get_crypto_ops("WEP");
+
+ if (!crypto_ops)
+ return;
+@@ -210,7 +210,7 @@ int rtw_wep_decrypt(struct adapter *padapter, u8 *precvframe)
+ void *crypto_private = NULL;
+ int status = _SUCCESS;
+ const int keyindex = prxattrib->key_index;
+- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("WEP"), "lib80211_crypt_wep");
++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("WEP");
+ char iv[4], icv[4];
+
+ if (!crypto_ops) {
+@@ -1291,7 +1291,7 @@ u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
+ struct sk_buff *skb = ((struct recv_frame *)precvframe)->pkt;
+ void *crypto_private = NULL;
+ u8 *key, *pframe = skb->data;
+- struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("CCMP"), "lib80211_crypt_ccmp");
++ struct lib80211_crypto_ops *crypto_ops = lib80211_get_crypto_ops("CCMP");
+ struct security_priv *psecuritypriv = &padapter->securitypriv;
+ char iv[8], icv[8];
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index ed8c62b2d9d1..739f8960811a 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1865,6 +1865,13 @@ static const struct usb_device_id acm_ids[] = {
+ .driver_info = IGNORE_DEVICE,
+ },
+
++ { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
++ .driver_info = SEND_ZERO_PACKET,
++ },
++ { USB_DEVICE(0x1bc7, 0x0023), /* Telit 3G ACM + ECM composition */
++ .driver_info = SEND_ZERO_PACKET,
++ },
++
+ /* control interfaces without any protocol set */
+ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
+ USB_CDC_PROTO_NONE) },
+diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
+index 356b05c82dbc..f713cecc1f41 100644
+--- a/drivers/usb/core/generic.c
++++ b/drivers/usb/core/generic.c
+@@ -143,9 +143,12 @@ int usb_choose_configuration(struct usb_device *udev)
+ continue;
+ }
+
+- if (i > 0 && desc && is_audio(desc) && is_uac3_config(desc)) {
+- best = c;
+- break;
++ if (i > 0 && desc && is_audio(desc)) {
++ if (is_uac3_config(desc)) {
++ best = c;
++ break;
++ }
++ continue;
+ }
+
+ /* From the remaining configs, choose the first one whose
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 514c5214ddb2..8bc35d53408b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -394,7 +394,8 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1a40, 0x0101), .driver_info = USB_QUIRK_HUB_SLOW_RESET },
+
+ /* Corsair K70 RGB */
+- { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT |
++ USB_QUIRK_DELAY_CTRL_MSG },
+
+ /* Corsair Strafe */
+ { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index e227bb5b794f..101ebac43c87 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -235,8 +235,12 @@ static int slave_configure(struct scsi_device *sdev)
+ if (!(us->fflags & US_FL_NEEDS_CAP16))
+ sdev->try_rc_10_first = 1;
+
+- /* assume SPC3 or latter devices support sense size > 18 */
+- if (sdev->scsi_level > SCSI_SPC_2)
++ /*
++ * assume SPC3 or latter devices support sense size > 18
++ * unless US_FL_BAD_SENSE quirk is specified.
++ */
++ if (sdev->scsi_level > SCSI_SPC_2 &&
++ !(us->fflags & US_FL_BAD_SENSE))
+ us->fflags |= US_FL_SANE_SENSE;
+
+ /*
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index f7f83b21dc74..ea0d27a94afe 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1265,6 +1265,18 @@ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_FIX_CAPACITY ),
+
++/*
++ * Reported by Icenowy Zheng <icenowy@aosc.io>
++ * The SMI SM3350 USB-UFS bridge controller will enter a wrong state
++ * that do not process read/write command if a long sense is requested,
++ * so force to use 18-byte sense.
++ */
++UNUSUAL_DEV( 0x090c, 0x3350, 0x0000, 0xffff,
++ "SMI",
++ "SM3350 UFS-to-USB-Mass-Storage bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BAD_SENSE ),
++
+ /*
+ * Reported by Paul Hartman <paul.hartman+linux@gmail.com>
+ * This card reader returns "Illegal Request, Logical Block Address
+diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
+index d9fd3188615d..64cbc2d007c9 100644
+--- a/drivers/vfio/vfio_iommu_type1.c
++++ b/drivers/vfio/vfio_iommu_type1.c
+@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu,
+ return -EINVAL;
+ if (!unmap->size || unmap->size & mask)
+ return -EINVAL;
+- if (unmap->iova + unmap->size < unmap->iova ||
++ if (unmap->iova + unmap->size - 1 < unmap->iova ||
+ unmap->size > SIZE_MAX)
+ return -EINVAL;
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 99e7645ad94e..47f1183b3dbe 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1015,19 +1015,21 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ parent_start = parent->start;
+
+ /*
+- * If we are COWing a node/leaf from the extent, chunk or device trees,
+- * make sure that we do not finish block group creation of pending block
+- * groups. We do this to avoid a deadlock.
++ * If we are COWing a node/leaf from the extent, chunk, device or free
++ * space trees, make sure that we do not finish block group creation of
++ * pending block groups. We do this to avoid a deadlock.
+ * COWing can result in allocation of a new chunk, and flushing pending
+ * block groups (btrfs_create_pending_block_groups()) can be triggered
+ * when finishing allocation of a new chunk. Creation of a pending block
+- * group modifies the extent, chunk and device trees, therefore we could
+- * deadlock with ourselves since we are holding a lock on an extent
+- * buffer that btrfs_create_pending_block_groups() may try to COW later.
++ * group modifies the extent, chunk, device and free space trees,
++ * therefore we could deadlock with ourselves since we are holding a
++ * lock on an extent buffer that btrfs_create_pending_block_groups() may
++ * try to COW later.
+ */
+ if (root == fs_info->extent_root ||
+ root == fs_info->chunk_root ||
+- root == fs_info->dev_root)
++ root == fs_info->dev_root ||
++ root == fs_info->free_space_root)
+ trans->can_flush_pending_bgs = false;
+
+ cow = btrfs_alloc_tree_block(trans, root, parent_start,
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index f70825af6438..9e419f6878c5 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1013,16 +1013,22 @@ out_add_root:
+ btrfs_abort_transaction(trans, ret);
+ goto out_free_path;
+ }
+- spin_lock(&fs_info->qgroup_lock);
+- fs_info->quota_root = quota_root;
+- set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+- spin_unlock(&fs_info->qgroup_lock);
+
+ ret = btrfs_commit_transaction(trans);
+ trans = NULL;
+ if (ret)
+ goto out_free_path;
+
++ /*
++ * Set quota enabled flag after committing the transaction, to avoid
++ * deadlocks on fs_info->qgroup_ioctl_lock with concurrent snapshot
++ * creation.
++ */
++ spin_lock(&fs_info->qgroup_lock);
++ fs_info->quota_root = quota_root;
++ set_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
++ spin_unlock(&fs_info->qgroup_lock);
++
+ ret = qgroup_rescan_init(fs_info, 0, 1);
+ if (!ret) {
+ qgroup_rescan_zero_tracking(fs_info);
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index f435d397019e..c872adfc939e 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3724,6 +3724,7 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
+ int ret;
+ u64 num_devices;
+ unsigned seq;
++ bool reducing_integrity;
+
+ if (btrfs_fs_closing(fs_info) ||
+ atomic_read(&fs_info->balance_pause_req) ||
+@@ -3803,24 +3804,30 @@ int btrfs_balance(struct btrfs_fs_info *fs_info,
+ !(bctl->sys.target & allowed)) ||
+ ((bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) &&
+ (fs_info->avail_metadata_alloc_bits & allowed) &&
+- !(bctl->meta.target & allowed))) {
+- if (bctl->flags & BTRFS_BALANCE_FORCE) {
+- btrfs_info(fs_info,
+- "balance: force reducing metadata integrity");
+- } else {
+- btrfs_err(fs_info,
+- "balance: reduces metadata integrity, use --force if you want this");
+- ret = -EINVAL;
+- goto out;
+- }
+- }
++ !(bctl->meta.target & allowed)))
++ reducing_integrity = true;
++ else
++ reducing_integrity = false;
++
++ /* if we're not converting, the target field is uninitialized */
++ meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
++ bctl->meta.target : fs_info->avail_metadata_alloc_bits;
++ data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
++ bctl->data.target : fs_info->avail_data_alloc_bits;
+ } while (read_seqretry(&fs_info->profiles_lock, seq));
+
+- /* if we're not converting, the target field is uninitialized */
+- meta_target = (bctl->meta.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+- bctl->meta.target : fs_info->avail_metadata_alloc_bits;
+- data_target = (bctl->data.flags & BTRFS_BALANCE_ARGS_CONVERT) ?
+- bctl->data.target : fs_info->avail_data_alloc_bits;
++ if (reducing_integrity) {
++ if (bctl->flags & BTRFS_BALANCE_FORCE) {
++ btrfs_info(fs_info,
++ "balance: force reducing metadata integrity");
++ } else {
++ btrfs_err(fs_info,
++ "balance: reduces metadata integrity, use --force if you want this");
++ ret = -EINVAL;
++ goto out;
++ }
++ }
++
+ if (btrfs_get_num_tolerated_disk_barrier_failures(meta_target) <
+ btrfs_get_num_tolerated_disk_barrier_failures(data_target)) {
+ int meta_index = btrfs_bg_flags_to_raid_index(meta_target);
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index ea78c3d6dcfc..f141b45ce349 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -11,6 +11,7 @@
+ #include <linux/security.h>
+ #include <linux/posix_acl_xattr.h>
+ #include <linux/iversion.h>
++#include <linux/sched/mm.h>
+ #include "ctree.h"
+ #include "btrfs_inode.h"
+ #include "transaction.h"
+@@ -422,9 +423,15 @@ static int btrfs_initxattrs(struct inode *inode,
+ {
+ const struct xattr *xattr;
+ struct btrfs_trans_handle *trans = fs_info;
++ unsigned int nofs_flag;
+ char *name;
+ int err = 0;
+
++ /*
++ * We're holding a transaction handle, so use a NOFS memory allocation
++ * context to avoid deadlock if reclaim happens.
++ */
++ nofs_flag = memalloc_nofs_save();
+ for (xattr = xattr_array; xattr->name != NULL; xattr++) {
+ name = kmalloc(XATTR_SECURITY_PREFIX_LEN +
+ strlen(xattr->name) + 1, GFP_KERNEL);
+@@ -440,6 +447,7 @@ static int btrfs_initxattrs(struct inode *inode,
+ if (err < 0)
+ break;
+ }
++ memalloc_nofs_restore(nofs_flag);
+ return err;
+ }
+
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index c23bf9da93d2..d5c3e0725849 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1131,10 +1131,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf) {
++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) {
+ free_xid(xid);
+ return -EINVAL;
+ }
+@@ -1471,10 +1471,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf)
++ if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE)))
+ return -EINVAL;
+
+ max_num = (max_buf - sizeof(struct smb_hdr)) /
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 8a41f4eba726..6f33253938cd 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -111,21 +111,27 @@ struct cifs_tcon *
+ tconInfoAlloc(void)
+ {
+ struct cifs_tcon *ret_buf;
+- ret_buf = kzalloc(sizeof(struct cifs_tcon), GFP_KERNEL);
+- if (ret_buf) {
+- atomic_inc(&tconInfoAllocCount);
+- ret_buf->tidStatus = CifsNew;
+- ++ret_buf->tc_count;
+- INIT_LIST_HEAD(&ret_buf->openFileList);
+- INIT_LIST_HEAD(&ret_buf->tcon_list);
+- spin_lock_init(&ret_buf->open_file_lock);
+- mutex_init(&ret_buf->crfid.fid_mutex);
+- ret_buf->crfid.fid = kzalloc(sizeof(struct cifs_fid),
+- GFP_KERNEL);
+- spin_lock_init(&ret_buf->stat_lock);
+- atomic_set(&ret_buf->num_local_opens, 0);
+- atomic_set(&ret_buf->num_remote_opens, 0);
++
++ ret_buf = kzalloc(sizeof(*ret_buf), GFP_KERNEL);
++ if (!ret_buf)
++ return NULL;
++ ret_buf->crfid.fid = kzalloc(sizeof(*ret_buf->crfid.fid), GFP_KERNEL);
++ if (!ret_buf->crfid.fid) {
++ kfree(ret_buf);
++ return NULL;
+ }
++
++ atomic_inc(&tconInfoAllocCount);
++ ret_buf->tidStatus = CifsNew;
++ ++ret_buf->tc_count;
++ INIT_LIST_HEAD(&ret_buf->openFileList);
++ INIT_LIST_HEAD(&ret_buf->tcon_list);
++ spin_lock_init(&ret_buf->open_file_lock);
++ mutex_init(&ret_buf->crfid.fid_mutex);
++ spin_lock_init(&ret_buf->stat_lock);
++ atomic_set(&ret_buf->num_local_opens, 0);
++ atomic_set(&ret_buf->num_remote_opens, 0);
++
+ return ret_buf;
+ }
+
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 4ed10dd086e6..2fc3d31967ee 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -122,10 +122,10 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ /*
+ * Accessing maxBuf is racy with cifs_reconnect - need to store value
+- * and check it for zero before using.
++ * and check it before using.
+ */
+ max_buf = tcon->ses->server->maxBuf;
+- if (!max_buf)
++ if (max_buf < sizeof(struct smb2_lock_element))
+ return -EINVAL;
+
+ max_num = max_buf / sizeof(struct smb2_lock_element);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 27f86537a5d1..836c59fca049 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3197,12 +3197,14 @@ smb2_async_readv(struct cifs_readdata *rdata)
+ if (rdata->credits) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest = shdr->CreditCharge;
++ shdr->CreditRequest =
++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
+ spin_lock(&server->req_lock);
+ server->credits += rdata->credits -
+ le16_to_cpu(shdr->CreditCharge);
+ spin_unlock(&server->req_lock);
+ wake_up(&server->request_q);
++ rdata->credits = le16_to_cpu(shdr->CreditCharge);
+ flags |= CIFS_HAS_CREDITS;
+ }
+
+@@ -3474,12 +3476,14 @@ smb2_async_writev(struct cifs_writedata *wdata,
+ if (wdata->credits) {
+ shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
+ SMB2_MAX_BUFFER_SIZE));
+- shdr->CreditRequest = shdr->CreditCharge;
++ shdr->CreditRequest =
++ cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1);
+ spin_lock(&server->req_lock);
+ server->credits += wdata->credits -
+ le16_to_cpu(shdr->CreditCharge);
+ spin_unlock(&server->req_lock);
+ wake_up(&server->request_q);
++ wdata->credits = le16_to_cpu(shdr->CreditCharge);
+ flags |= CIFS_HAS_CREDITS;
+ }
+
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 83ff0c25710d..d51064c1ba42 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -385,7 +385,7 @@ smbd_done:
+ if (rc < 0 && rc != -EINTR)
+ cifs_dbg(VFS, "Error %d sending data on socket to server\n",
+ rc);
+- else
++ else if (rc > 0)
+ rc = 0;
+
+ return rc;
+@@ -793,7 +793,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ int i, j, rc = 0;
+ int timeout, optype;
+ struct mid_q_entry *midQ[MAX_COMPOUND];
+- unsigned int credits = 0;
++ bool cancelled_mid[MAX_COMPOUND] = {false};
++ unsigned int credits[MAX_COMPOUND] = {0};
+ char *buf;
+
+ timeout = flags & CIFS_TIMEOUT_MASK;
+@@ -811,13 +812,31 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ return -ENOENT;
+
+ /*
+- * Ensure that we do not send more than 50 overlapping requests
+- * to the same server. We may make this configurable later or
+- * use ses->maxReq.
++ * Ensure we obtain 1 credit per request in the compound chain.
++ * It can be optimized further by waiting for all the credits
++ * at once but this can wait long enough if we don't have enough
++ * credits due to some heavy operations in progress or the server
++ * not granting us much, so a fallback to the current approach is
++ * needed anyway.
+ */
+- rc = wait_for_free_request(ses->server, timeout, optype);
+- if (rc)
+- return rc;
++ for (i = 0; i < num_rqst; i++) {
++ rc = wait_for_free_request(ses->server, timeout, optype);
++ if (rc) {
++ /*
++ * We haven't sent an SMB packet to the server yet but
++ * we already obtained credits for i requests in the
++ * compound chain - need to return those credits back
++ * for future use. Note that we need to call add_credits
++ * multiple times to match the way we obtained credits
++ * in the first place and to account for in flight
++ * requests correctly.
++ */
++ for (j = 0; j < i; j++)
++ add_credits(ses->server, 1, optype);
++ return rc;
++ }
++ credits[i] = 1;
++ }
+
+ /*
+ * Make sure that we sign in the same order that we send on this socket
+@@ -833,8 +852,10 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ for (j = 0; j < i; j++)
+ cifs_delete_mid(midQ[j]);
+ mutex_unlock(&ses->server->srv_mutex);
++
+ /* Update # of requests on wire to server */
+- add_credits(ses->server, 1, optype);
++ for (j = 0; j < num_rqst; j++)
++ add_credits(ses->server, credits[j], optype);
+ return PTR_ERR(midQ[i]);
+ }
+
+@@ -881,19 +902,16 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
+ midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
+ midQ[i]->callback = DeleteMidQEntry;
+- spin_unlock(&GlobalMid_Lock);
+- add_credits(ses->server, 1, optype);
+- return rc;
++ cancelled_mid[i] = true;
+ }
+ spin_unlock(&GlobalMid_Lock);
+ }
+ }
+
+ for (i = 0; i < num_rqst; i++)
+- if (midQ[i]->resp_buf)
+- credits += ses->server->ops->get_credits(midQ[i]);
+- if (!credits)
+- credits = 1;
++ if (!cancelled_mid[i] && midQ[i]->resp_buf
++ && (midQ[i]->mid_state == MID_RESPONSE_RECEIVED))
++ credits[i] = ses->server->ops->get_credits(midQ[i]);
+
+ for (i = 0; i < num_rqst; i++) {
+ if (rc < 0)
+@@ -901,8 +919,9 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+
+ rc = cifs_sync_mid_result(midQ[i], ses->server);
+ if (rc != 0) {
+- add_credits(ses->server, credits, optype);
+- return rc;
++ /* mark this mid as cancelled to not free it below */
++ cancelled_mid[i] = true;
++ goto out;
+ }
+
+ if (!midQ[i]->resp_buf ||
+@@ -949,9 +968,11 @@ out:
+ * This is prevented above by using a noop callback that will not
+ * wake this thread except for the very last PDU.
+ */
+- for (i = 0; i < num_rqst; i++)
+- cifs_delete_mid(midQ[i]);
+- add_credits(ses->server, credits, optype);
++ for (i = 0; i < num_rqst; i++) {
++ if (!cancelled_mid[i])
++ cifs_delete_mid(midQ[i]);
++ add_credits(ses->server, credits[i], optype);
++ }
+
+ return rc;
+ }
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index 26a7fe5c4fd3..712f00995390 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -116,8 +116,16 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
++ ret = file_write_and_wait_range(file, start, end);
++ if (ret)
++ return ret;
++
+ if (!journal) {
+- ret = __generic_file_fsync(file, start, end, datasync);
++ struct writeback_control wbc = {
++ .sync_mode = WB_SYNC_ALL
++ };
++
++ ret = ext4_write_inode(inode, &wbc);
+ if (!ret)
+ ret = ext4_sync_parent(inode);
+ if (test_opt(inode->i_sb, BARRIER))
+@@ -125,9 +133,6 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+ }
+
+- ret = file_write_and_wait_range(file, start, end);
+- if (ret)
+- return ret;
+ /*
+ * data=writeback,ordered:
+ * The caller's filemap_fdatawrite()/wait will sync the data.
+@@ -159,6 +164,9 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ ret = err;
+ }
+ out:
++ err = file_check_and_advance_wb_err(file);
++ if (ret == 0)
++ ret = err;
+ trace_ext4_sync_file_exit(inode, ret);
+ return ret;
+ }
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 27373d88b5f0..56f6e1782d5f 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1890,12 +1890,12 @@ int ext4_inline_data_fiemap(struct inode *inode,
+ physical += (char *)ext4_raw_inode(&iloc) - iloc.bh->b_data;
+ physical += offsetof(struct ext4_inode, i_block);
+
+- if (physical)
+- error = fiemap_fill_next_extent(fieinfo, start, physical,
+- inline_len, flags);
+ brelse(iloc.bh);
+ out:
+ up_read(&EXT4_I(inode)->xattr_sem);
++ if (physical)
++ error = fiemap_fill_next_extent(fieinfo, start, physical,
++ inline_len, flags);
+ return (error < 0 ? error : 0);
+ }
+
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 9affabd07682..34d7e0703cc6 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -2778,7 +2778,8 @@ static int ext4_writepages(struct address_space *mapping,
+ * We may need to convert up to one extent per block in
+ * the page and we may dirty the inode.
+ */
+- rsv_blocks = 1 + (PAGE_SIZE >> inode->i_blkbits);
++ rsv_blocks = 1 + ext4_chunk_trans_blocks(inode,
++ PAGE_SIZE >> inode->i_blkbits);
+ }
+
+ /*
+@@ -4833,7 +4834,7 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
+ gid_t i_gid;
+ projid_t i_projid;
+
+- if (((flags & EXT4_IGET_NORMAL) &&
++ if ((!(flags & EXT4_IGET_SPECIAL) &&
+ (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) ||
+ (ino < EXT4_ROOT_INO) ||
+ (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) {
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 6641a1b8a6a5..521320de2017 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4905,7 +4905,7 @@ static int ext4_commit_super(struct super_block *sb, int sync)
+ ext4_superblock_csum_set(sb);
+ if (sync)
+ lock_buffer(sbh);
+- if (buffer_write_io_error(sbh)) {
++ if (buffer_write_io_error(sbh) || !buffer_uptodate(sbh)) {
+ /*
+ * Oh, dear. A previous attempt to write the
+ * superblock failed. This could happen because the
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 2010493e1040..977ddf2774f9 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -68,7 +68,7 @@
+ */
+ #define uninitialized_var(x) x = x
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ #define __noretpoline __attribute__((__indirect_branch__("keep")))
+ #endif
+
+diff --git a/include/linux/module.h b/include/linux/module.h
+index fce6b4335e36..0c575f51fe57 100644
+--- a/include/linux/module.h
++++ b/include/linux/module.h
+@@ -817,7 +817,7 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr,
+ static inline void module_bug_cleanup(struct module *mod) {}
+ #endif /* CONFIG_GENERIC_BUG */
+
+-#ifdef RETPOLINE
++#ifdef CONFIG_RETPOLINE
+ extern bool retpoline_module_ok(bool has_retpoline);
+ #else
+ static inline bool retpoline_module_ok(bool has_retpoline)
+diff --git a/include/linux/pm_opp.h b/include/linux/pm_opp.h
+index 5d399eeef172..f4f8840eab04 100644
+--- a/include/linux/pm_opp.h
++++ b/include/linux/pm_opp.h
+@@ -108,6 +108,7 @@ void dev_pm_opp_put(struct dev_pm_opp *opp);
+ int dev_pm_opp_add(struct device *dev, unsigned long freq,
+ unsigned long u_volt);
+ void dev_pm_opp_remove(struct device *dev, unsigned long freq);
++void dev_pm_opp_remove_all_dynamic(struct device *dev);
+
+ int dev_pm_opp_enable(struct device *dev, unsigned long freq);
+
+@@ -214,6 +215,10 @@ static inline void dev_pm_opp_remove(struct device *dev, unsigned long freq)
+ {
+ }
+
++static inline void dev_pm_opp_remove_all_dynamic(struct device *dev)
++{
++}
++
+ static inline int dev_pm_opp_enable(struct device *dev, unsigned long freq)
+ {
+ return 0;
+diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
+index 73e130a840ce..fdb6b317d974 100644
+--- a/include/linux/sunrpc/svc.h
++++ b/include/linux/sunrpc/svc.h
+@@ -295,9 +295,12 @@ struct svc_rqst {
+ struct svc_cacherep * rq_cacherep; /* cache info */
+ struct task_struct *rq_task; /* service thread */
+ spinlock_t rq_lock; /* per-request lock */
++ struct net *rq_bc_net; /* pointer to backchannel's
++ * net namespace
++ */
+ };
+
+-#define SVC_NET(svc_rqst) (svc_rqst->rq_xprt->xpt_net)
++#define SVC_NET(rqst) (rqst->rq_xprt ? rqst->rq_xprt->xpt_net : rqst->rq_bc_net)
+
+ /*
+ * Rigorous type checking on sockaddr type conversions
+diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
+index 28e384186c35..8617f4fd6b70 100644
+--- a/include/trace/events/sunrpc.h
++++ b/include/trace/events/sunrpc.h
+@@ -569,7 +569,8 @@ TRACE_EVENT(svc_process,
+ __field(u32, vers)
+ __field(u32, proc)
+ __string(service, name)
+- __string(addr, rqst->rq_xprt->xpt_remotebuf)
++ __string(addr, rqst->rq_xprt ?
++ rqst->rq_xprt->xpt_remotebuf : "(null)")
+ ),
+
+ TP_fast_assign(
+@@ -577,7 +578,8 @@ TRACE_EVENT(svc_process,
+ __entry->vers = rqst->rq_vers;
+ __entry->proc = rqst->rq_proc;
+ __assign_str(service, name);
+- __assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
++ __assign_str(addr, rqst->rq_xprt ?
++ rqst->rq_xprt->xpt_remotebuf : "(null)");
+ ),
+
+ TP_printk("addr=%s xid=0x%08x service=%s vers=%u proc=%u",
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 3c16bc490583..906cd0c13d15 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -221,6 +221,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
+ memset(s->addr, 0, THREAD_SIZE);
+
+ tsk->stack_vm_area = s;
++ tsk->stack = s->addr;
+ return s->addr;
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 4ad2d293ddc2..59c00ae6b928 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2993,6 +2993,29 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
+ struct vm_area_struct *vma = vmf->vma;
+ vm_fault_t ret;
+
++ /*
++ * Preallocate pte before we take page_lock because this might lead to
++ * deadlocks for memcg reclaim which waits for pages under writeback:
++ * lock_page(A)
++ * SetPageWriteback(A)
++ * unlock_page(A)
++ * lock_page(B)
++ * lock_page(B)
++ * pte_alloc_pne
++ * shrink_page_list
++ * wait_on_page_writeback(A)
++ * SetPageWriteback(B)
++ * unlock_page(B)
++ * # flush A, B to clear the writeback
++ */
++ if (pmd_none(*vmf->pmd) && !vmf->prealloc_pte) {
++ vmf->prealloc_pte = pte_alloc_one(vmf->vma->vm_mm,
++ vmf->address);
++ if (!vmf->prealloc_pte)
++ return VM_FAULT_OOM;
++ smp_wmb(); /* See comment in __pte_alloc() */
++ }
++
+ ret = vma->vm_ops->fault(vmf);
+ if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY |
+ VM_FAULT_DONE_COW)))
+diff --git a/mm/slab.c b/mm/slab.c
+index 2a5654bb3b3f..9d5de959d9d9 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -679,8 +679,10 @@ static struct alien_cache *__alloc_alien_cache(int node, int entries,
+ struct alien_cache *alc = NULL;
+
+ alc = kmalloc_node(memsize, gfp, node);
+- init_arraycache(&alc->ac, entries, batch);
+- spin_lock_init(&alc->lock);
++ if (alc) {
++ init_arraycache(&alc->ac, entries, batch);
++ spin_lock_init(&alc->lock);
++ }
+ return alc;
+ }
+
+diff --git a/mm/usercopy.c b/mm/usercopy.c
+index 852eb4e53f06..14faadcedd06 100644
+--- a/mm/usercopy.c
++++ b/mm/usercopy.c
+@@ -247,7 +247,8 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
+ /*
+ * Validates that the given object is:
+ * - not bogus address
+- * - known-safe heap or stack object
++ * - fully contained by stack (or stack frame, when available)
++ * - fully within SLAB object (or object whitelist area, when available)
+ * - not in kernel text
+ */
+ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+@@ -262,9 +263,6 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+ /* Check for invalid addresses. */
+ check_bogus_address((const unsigned long)ptr, n, to_user);
+
+- /* Check for bad heap object. */
+- check_heap_object(ptr, n, to_user);
+-
+ /* Check for bad stack object. */
+ switch (check_stack_object(ptr, n)) {
+ case NOT_STACK:
+@@ -282,6 +280,9 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+ usercopy_abort("process stack", NULL, to_user, 0, n);
+ }
+
++ /* Check for bad heap object. */
++ check_heap_object(ptr, n, to_user);
++
+ /* Check for object in kernel to avoid text exposure. */
+ check_kernel_text_object((const unsigned long)ptr, n, to_user);
+ }
+diff --git a/mm/util.c b/mm/util.c
+index 8bf08b5b5760..5c9c7359ee8a 100644
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -478,7 +478,7 @@ bool page_mapped(struct page *page)
+ return true;
+ if (PageHuge(page))
+ return false;
+- for (i = 0; i < hpage_nr_pages(page); i++) {
++ for (i = 0; i < (1 << compound_order(page)); i++) {
+ if (atomic_read(&page[i]._mapcount) >= 0)
+ return true;
+ }
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index d13e05f1a990..d65f8d35de87 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1144,6 +1144,8 @@ void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
+ static __printf(2,3) void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...) {}
+ #endif
+
++extern void svc_tcp_prep_reply_hdr(struct svc_rqst *);
++
+ /*
+ * Common routine for processing the RPC request.
+ */
+@@ -1172,7 +1174,8 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ clear_bit(RQ_DROPME, &rqstp->rq_flags);
+
+ /* Setup reply header */
+- rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp);
++ if (rqstp->rq_prot == IPPROTO_TCP)
++ svc_tcp_prep_reply_hdr(rqstp);
+
+ svc_putu32(resv, rqstp->rq_xid);
+
+@@ -1244,7 +1247,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ * for lower versions. RPC_PROG_MISMATCH seems to be the closest
+ * fit.
+ */
+- if (versp->vs_need_cong_ctrl &&
++ if (versp->vs_need_cong_ctrl && rqstp->rq_xprt &&
+ !test_bit(XPT_CONG_CTRL, &rqstp->rq_xprt->xpt_flags))
+ goto err_bad_vers;
+
+@@ -1336,7 +1339,7 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
+ return 0;
+
+ close:
+- if (test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
++ if (rqstp->rq_xprt && test_bit(XPT_TEMP, &rqstp->rq_xprt->xpt_flags))
+ svc_close_xprt(rqstp->rq_xprt);
+ dprintk("svc: svc_process close\n");
+ return 0;
+@@ -1459,10 +1462,10 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
+ dprintk("svc: %s(%p)\n", __func__, req);
+
+ /* Build the svc_rqst used by the common processing routine */
+- rqstp->rq_xprt = serv->sv_bc_xprt;
+ rqstp->rq_xid = req->rq_xid;
+ rqstp->rq_prot = req->rq_xprt->prot;
+ rqstp->rq_server = serv;
++ rqstp->rq_bc_net = req->rq_xprt->xprt_net;
+
+ rqstp->rq_addrlen = sizeof(req->rq_xprt->addr);
+ memcpy(&rqstp->rq_addr, &req->rq_xprt->addr, rqstp->rq_addrlen);
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 51d36230b6e3..bd42da287c26 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -468,10 +468,11 @@ out:
+ */
+ void svc_reserve(struct svc_rqst *rqstp, int space)
+ {
++ struct svc_xprt *xprt = rqstp->rq_xprt;
++
+ space += rqstp->rq_res.head[0].iov_len;
+
+- if (space < rqstp->rq_reserved) {
+- struct svc_xprt *xprt = rqstp->rq_xprt;
++ if (xprt && space < rqstp->rq_reserved) {
+ atomic_sub((rqstp->rq_reserved - space), &xprt->xpt_reserved);
+ rqstp->rq_reserved = space;
+
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index b7e67310ec37..b90492c43711 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -1173,7 +1173,7 @@ static int svc_tcp_sendto(struct svc_rqst *rqstp)
+ /*
+ * Setup response header. TCP has a 4B record length field.
+ */
+-static void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
++void svc_tcp_prep_reply_hdr(struct svc_rqst *rqstp)
+ {
+ struct kvec *resv = &rqstp->rq_res.head[0];
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 0d998c54564d..5a5b3780456f 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -2157,7 +2157,7 @@ static void add_intree_flag(struct buffer *b, int is_intree)
+ /* Cannot check for assembler */
+ static void add_retpoline(struct buffer *b)
+ {
+- buf_printf(b, "\n#ifdef RETPOLINE\n");
++ buf_printf(b, "\n#ifdef CONFIG_RETPOLINE\n");
+ buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
+ buf_printf(b, "#endif\n");
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 54fc9c0f07de..0d95316d6dbd 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ case 0x10ec0295:
+ case 0x10ec0289:
+ case 0x10ec0299:
++ alc_process_coef_fw(codec, alc225_pre_hsmode);
+ alc_process_coef_fw(codec, coef0225);
+ break;
+ case 0x10ec0867:
+@@ -5380,6 +5381,13 @@ static void alc285_fixup_invalidate_dacs(struct hda_codec *codec,
+ snd_hda_override_wcaps(codec, 0x03, 0);
+ }
+
++static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -5492,6 +5500,7 @@ enum {
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
++ ALC225_FIXUP_DISABLE_MIC_VREF,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_FIXUP_DISABLE_DAC3,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+@@ -6191,6 +6200,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC225_FIXUP_DISABLE_MIC_VREF] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_mic_vref,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
+ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -6200,7 +6215,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ {}
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF
+ },
+ [ALC280_FIXUP_HP_HEADSET_MIC] = {
+ .type = HDA_FIXUP_FUNC,
+@@ -6503,6 +6518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),