logo

live-bootstrap

Mirror of <https://github.com/fosslinux/live-bootstrap>

4.14.341-openela.patch (488475B)

    

  1. SPDX-FileCopyrightText: 1991-2024 kernel.org contributors
  2. SPDX-FileCopyrightText: 2023-2024 Open Enterprise Linux Association <kernel-lts@openela.org>
  4. SPDX-License-Identifier: GPL-2.0-only
  6. Patch kernel up to 4.14.341-openela
  8. diff --git Documentation/ABI/testing/sysfs-class-net-queues Documentation/ABI/testing/sysfs-class-net-queues
  9. index 0c0df91b1516..2734cd9ee43c 100644
  10. --- linux-4.14.336/Documentation/ABI/testing/sysfs-class-net-queues
  11. +++ linux-4.14.336/Documentation/ABI/testing/sysfs-class-net-queues
  12. @@ -1,4 +1,4 @@
  13. -What:		/sys/class/<iface>/queues/rx-<queue>/rps_cpus
  14. +What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_cpus
  15.  Date:		March 2010
  16.  KernelVersion:	2.6.35
  17.  Contact:	netdev@vger.kernel.org
  18. @@ -8,7 +8,7 @@ Description:
  19.  		network device queue. Possible values depend on the number
  20.  		of available CPU(s) in the system.
  21.  
  22. -What:		/sys/class/<iface>/queues/rx-<queue>/rps_flow_cnt
  23. +What:		/sys/class/net/<iface>/queues/rx-<queue>/rps_flow_cnt
  24.  Date:		April 2010
  25.  KernelVersion:	2.6.35
  26.  Contact:	netdev@vger.kernel.org
  27. @@ -16,7 +16,7 @@ Description:
  28.  		Number of Receive Packet Steering flows being currently
  29.  		processed by this particular network device receive queue.
  30.  
  31. -What:		/sys/class/<iface>/queues/tx-<queue>/tx_timeout
  32. +What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_timeout
  33.  Date:		November 2011
  34.  KernelVersion:	3.3
  35.  Contact:	netdev@vger.kernel.org
  36. @@ -24,7 +24,7 @@ Description:
  37.  		Indicates the number of transmit timeout events seen by this
  38.  		network interface transmit queue.
  39.  
  40. -What:		/sys/class/<iface>/queues/tx-<queue>/tx_maxrate
  41. +What:		/sys/class/net/<iface>/queues/tx-<queue>/tx_maxrate
  42.  Date:		March 2015
  43.  KernelVersion:	4.1
  44.  Contact:	netdev@vger.kernel.org
  45. @@ -32,7 +32,7 @@ Description:
  46.  		A Mbps max-rate set for the queue, a value of zero means disabled,
  47.  		default is disabled.
  48.  
  49. -What:		/sys/class/<iface>/queues/tx-<queue>/xps_cpus
  50. +What:		/sys/class/net/<iface>/queues/tx-<queue>/xps_cpus
  51.  Date:		November 2010
  52.  KernelVersion:	2.6.38
  53.  Contact:	netdev@vger.kernel.org
  54. @@ -42,7 +42,7 @@ Description:
  55.  		network device transmit queue. Possible vaules depend on the
  56.  		number of available CPU(s) in the system.
  57.  
  58. -What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
  59. +What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/hold_time
  60.  Date:		November 2011
  61.  KernelVersion:	3.3
  62.  Contact:	netdev@vger.kernel.org
  63. @@ -51,7 +51,7 @@ Description:
  64.  		of this particular network device transmit queue.
  65.  		Default value is 1000.
  66.  
  67. -What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
  68. +What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/inflight
  69.  Date:		November 2011
  70.  KernelVersion:	3.3
  71.  Contact:	netdev@vger.kernel.org
  72. @@ -59,7 +59,7 @@ Description:
  73.  		Indicates the number of bytes (objects) in flight on this
  74.  		network device transmit queue.
  75.  
  76. -What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit
  77. +What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit
  78.  Date:		November 2011
  79.  KernelVersion:	3.3
  80.  Contact:	netdev@vger.kernel.org
  81. @@ -68,7 +68,7 @@ Description:
  82.  		on this network device transmit queue. This value is clamped
  83.  		to be within the bounds defined by limit_max and limit_min.
  84.  
  85. -What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
  86. +What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_max
  87.  Date:		November 2011
  88.  KernelVersion:	3.3
  89.  Contact:	netdev@vger.kernel.org
  90. @@ -77,7 +77,7 @@ Description:
  91.  		queued on this network device transmit queue. See
  92.  		include/linux/dynamic_queue_limits.h for the default value.
  93.  
  94. -What:		/sys/class/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
  95. +What:		/sys/class/net/<iface>/queues/tx-<queue>/byte_queue_limits/limit_min
  96.  Date:		November 2011
  97.  KernelVersion:	3.3
  98.  Contact:	netdev@vger.kernel.org
  99. diff --git Documentation/ABI/testing/sysfs-class-net-statistics Documentation/ABI/testing/sysfs-class-net-statistics
  100. index 397118de7b5e..53e508c6936a 100644
  101. --- linux-4.14.336/Documentation/ABI/testing/sysfs-class-net-statistics
  102. +++ linux-4.14.336/Documentation/ABI/testing/sysfs-class-net-statistics
  103. @@ -1,4 +1,4 @@
  104. -What:		/sys/class/<iface>/statistics/collisions
  105. +What:		/sys/class/net/<iface>/statistics/collisions
  106.  Date:		April 2005
  107.  KernelVersion:	2.6.12
  108.  Contact:	netdev@vger.kernel.org
  109. @@ -6,7 +6,7 @@ Description:
  110.  		Indicates the number of collisions seen by this network device.
  111.  		This value might not be relevant with all MAC layers.
  112.  
  113. -What:		/sys/class/<iface>/statistics/multicast
  114. +What:		/sys/class/net/<iface>/statistics/multicast
  115.  Date:		April 2005
  116.  KernelVersion:	2.6.12
  117.  Contact:	netdev@vger.kernel.org
  118. @@ -14,7 +14,7 @@ Description:
  119.  		Indicates the number of multicast packets received by this
  120.  		network device.
  121.  
  122. -What:		/sys/class/<iface>/statistics/rx_bytes
  123. +What:		/sys/class/net/<iface>/statistics/rx_bytes
  124.  Date:		April 2005
  125.  KernelVersion:	2.6.12
  126.  Contact:	netdev@vger.kernel.org
  127. @@ -23,7 +23,7 @@ Description:
  128.  		See the network driver for the exact meaning of when this
  129.  		value is incremented.
  130.  
  131. -What:		/sys/class/<iface>/statistics/rx_compressed
  132. +What:		/sys/class/net/<iface>/statistics/rx_compressed
  133.  Date:		April 2005
  134.  KernelVersion:	2.6.12
  135.  Contact:	netdev@vger.kernel.org
  136. @@ -32,7 +32,7 @@ Description:
  137.  		network device. This value might only be relevant for interfaces
  138.  		that support packet compression (e.g: PPP).
  139.  
  140. -What:		/sys/class/<iface>/statistics/rx_crc_errors
  141. +What:		/sys/class/net/<iface>/statistics/rx_crc_errors
  142.  Date:		April 2005
  143.  KernelVersion:	2.6.12
  144.  Contact:	netdev@vger.kernel.org
  145. @@ -41,7 +41,7 @@ Description:
  146.  		by this network device. Note that the specific meaning might
  147.  		depend on the MAC layer used by the interface.
  148.  
  149. -What:		/sys/class/<iface>/statistics/rx_dropped
  150. +What:		/sys/class/net/<iface>/statistics/rx_dropped
  151.  Date:		April 2005
  152.  KernelVersion:	2.6.12
  153.  Contact:	netdev@vger.kernel.org
  154. @@ -51,7 +51,15 @@ Description:
  155.  		packet processing. See the network driver for the exact
  156.  		meaning of this value.
  157.  
  158. -What:		/sys/class/<iface>/statistics/rx_fifo_errors
  159. +What:		/sys/class/net/<iface>/statistics/rx_errors
  160. +Date:		April 2005
  161. +KernelVersion:	2.6.12
  162. +Contact:	netdev@vger.kernel.org
  163. +Description:
  164. +		Indicates the number of receive errors on this network device.
  165. +		See the network driver for the exact meaning of this value.
  166. +
  167. +What:		/sys/class/net/<iface>/statistics/rx_fifo_errors
  168.  Date:		April 2005
  169.  KernelVersion:	2.6.12
  170.  Contact:	netdev@vger.kernel.org
  171. @@ -60,7 +68,7 @@ Description:
  172.  		network device. See the network driver for the exact
  173.  		meaning of this value.
  174.  
  175. -What:		/sys/class/<iface>/statistics/rx_frame_errors
  176. +What:		/sys/class/net/<iface>/statistics/rx_frame_errors
  177.  Date:		April 2005
  178.  KernelVersion:	2.6.12
  179.  Contact:	netdev@vger.kernel.org
  180. @@ -70,7 +78,7 @@ Description:
  181.  		on the MAC layer protocol used. See the network driver for
  182.  		the exact meaning of this value.
  183.  
  184. -What:		/sys/class/<iface>/statistics/rx_length_errors
  185. +What:		/sys/class/net/<iface>/statistics/rx_length_errors
  186.  Date:		April 2005
  187.  KernelVersion:	2.6.12
  188.  Contact:	netdev@vger.kernel.org
  189. @@ -79,7 +87,7 @@ Description:
  190.  		error, oversized or undersized. See the network driver for the
  191.  		exact meaning of this value.
  192.  
  193. -What:		/sys/class/<iface>/statistics/rx_missed_errors
  194. +What:		/sys/class/net/<iface>/statistics/rx_missed_errors
  195.  Date:		April 2005
  196.  KernelVersion:	2.6.12
  197.  Contact:	netdev@vger.kernel.org
  198. @@ -88,7 +96,15 @@ Description:
  199.  		due to lack of capacity in the receive side. See the network
  200.  		driver for the exact meaning of this value.
  201.  
  202. -What:		/sys/class/<iface>/statistics/rx_over_errors
  203. +What:		/sys/class/net/<iface>/statistics/rx_nohandler
  204. +Date:		February 2016
  205. +KernelVersion:	4.6
  206. +Contact:	netdev@vger.kernel.org
  207. +Description:
  208. +		Indicates the number of received packets that were dropped on
  209. +		an inactive device by the network core.
  210. +
  211. +What:		/sys/class/net/<iface>/statistics/rx_over_errors
  212.  Date:		April 2005
  213.  KernelVersion:	2.6.12
  214.  Contact:	netdev@vger.kernel.org
  215. @@ -98,7 +114,7 @@ Description:
  216.  		(e.g: larger than MTU). See the network driver for the exact
  217.  		meaning of this value.
  218.  
  219. -What:		/sys/class/<iface>/statistics/rx_packets
  220. +What:		/sys/class/net/<iface>/statistics/rx_packets
  221.  Date:		April 2005
  222.  KernelVersion:	2.6.12
  223.  Contact:	netdev@vger.kernel.org
  224. @@ -106,7 +122,7 @@ Description:
  225.  		Indicates the total number of good packets received by this
  226.  		network device.
  227.  
  228. -What:		/sys/class/<iface>/statistics/tx_aborted_errors
  229. +What:		/sys/class/net/<iface>/statistics/tx_aborted_errors
  230.  Date:		April 2005
  231.  KernelVersion:	2.6.12
  232.  Contact:	netdev@vger.kernel.org
  233. @@ -116,7 +132,7 @@ Description:
  234.  		a medium collision). See the network driver for the exact
  235.  		meaning of this value.
  236.  
  237. -What:		/sys/class/<iface>/statistics/tx_bytes
  238. +What:		/sys/class/net/<iface>/statistics/tx_bytes
  239.  Date:		April 2005
  240.  KernelVersion:	2.6.12
  241.  Contact:	netdev@vger.kernel.org
  242. @@ -127,7 +143,7 @@ Description:
  243.  		transmitted packets or all packets that have been queued for
  244.  		transmission.
  245.  
  246. -What:		/sys/class/<iface>/statistics/tx_carrier_errors
  247. +What:		/sys/class/net/<iface>/statistics/tx_carrier_errors
  248.  Date:		April 2005
  249.  KernelVersion:	2.6.12
  250.  Contact:	netdev@vger.kernel.org
  251. @@ -136,7 +152,7 @@ Description:
  252.  		because of carrier errors (e.g: physical link down). See the
  253.  		network driver for the exact meaning of this value.
  254.  
  255. -What:		/sys/class/<iface>/statistics/tx_compressed
  256. +What:		/sys/class/net/<iface>/statistics/tx_compressed
  257.  Date:		April 2005
  258.  KernelVersion:	2.6.12
  259.  Contact:	netdev@vger.kernel.org
  260. @@ -145,7 +161,7 @@ Description:
  261.  		this might only be relevant for devices that support
  262.  		compression (e.g: PPP).
  263.  
  264. -What:		/sys/class/<iface>/statistics/tx_dropped
  265. +What:		/sys/class/net/<iface>/statistics/tx_dropped
  266.  Date:		April 2005
  267.  KernelVersion:	2.6.12
  268.  Contact:	netdev@vger.kernel.org
  269. @@ -154,7 +170,7 @@ Description:
  270.  		See the driver for the exact reasons as to why the packets were
  271.  		dropped.
  272.  
  273. -What:		/sys/class/<iface>/statistics/tx_errors
  274. +What:		/sys/class/net/<iface>/statistics/tx_errors
  275.  Date:		April 2005
  276.  KernelVersion:	2.6.12
  277.  Contact:	netdev@vger.kernel.org
  278. @@ -163,7 +179,7 @@ Description:
  279.  		a network device. See the driver for the exact reasons as to
  280.  		why the packets were dropped.
  281.  
  282. -What:		/sys/class/<iface>/statistics/tx_fifo_errors
  283. +What:		/sys/class/net/<iface>/statistics/tx_fifo_errors
  284.  Date:		April 2005
  285.  KernelVersion:	2.6.12
  286.  Contact:	netdev@vger.kernel.org
  287. @@ -172,7 +188,7 @@ Description:
  288.  		FIFO error. See the driver for the exact reasons as to why the
  289.  		packets were dropped.
  290.  
  291. -What:		/sys/class/<iface>/statistics/tx_heartbeat_errors
  292. +What:		/sys/class/net/<iface>/statistics/tx_heartbeat_errors
  293.  Date:		April 2005
  294.  KernelVersion:	2.6.12
  295.  Contact:	netdev@vger.kernel.org
  296. @@ -181,7 +197,7 @@ Description:
  297.  		reported as heartbeat errors. See the driver for the exact
  298.  		reasons as to why the packets were dropped.
  299.  
  300. -What:		/sys/class/<iface>/statistics/tx_packets
  301. +What:		/sys/class/net/<iface>/statistics/tx_packets
  302.  Date:		April 2005
  303.  KernelVersion:	2.6.12
  304.  Contact:	netdev@vger.kernel.org
  305. @@ -190,7 +206,7 @@ Description:
  306.  		device. See the driver for whether this reports the number of all
  307.  		attempted or successful transmissions.
  308.  
  309. -What:		/sys/class/<iface>/statistics/tx_window_errors
  310. +What:		/sys/class/net/<iface>/statistics/tx_window_errors
  311.  Date:		April 2005
  312.  KernelVersion:	2.6.12
  313.  Contact:	netdev@vger.kernel.org
  314. diff --git Documentation/sound/soc/dapm.rst Documentation/sound/soc/dapm.rst
  315. index 8e44107933ab..c3154ce6e1b2 100644
  316. --- linux-4.14.336/Documentation/sound/soc/dapm.rst
  317. +++ linux-4.14.336/Documentation/sound/soc/dapm.rst
  318. @@ -234,7 +234,7 @@ corresponding soft power control. In this case it is necessary to create
  319.  a virtual widget - a widget with no control bits e.g.
  320.  ::
  321.  
  322. -  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_DAPM_NOPM, 0, 0, NULL, 0),
  323. +  SND_SOC_DAPM_MIXER("AC97 Mixer", SND_SOC_NOPM, 0, 0, NULL, 0),
  324.  
  325.  This can be used to merge to signal paths together in software.
  326.  
  327. diff --git Makefile Makefile
  328. index 3e5a7d98a1e3..0a53d6d980f7 100644
  329. --- linux-4.14.336/Makefile
  330. +++ linux-4.14.336/Makefile
  331. @@ -1,8 +1,8 @@
  332.  # SPDX-License-Identifier: GPL-2.0
  333.  VERSION = 4
  334.  PATCHLEVEL = 14
  335. -SUBLEVEL = 336
  336. -EXTRAVERSION =
  337. +SUBLEVEL = 341
  338. +EXTRAVERSION = -openela
  339.  NAME = Petit Gorille
  340.  
  341.  # *DOCUMENTATION*
  342. diff --git arch/arc/kernel/signal.c arch/arc/kernel/signal.c
  343. index 68901f6f18ba..c36e642eb1a0 100644
  344. --- linux-4.14.336/arch/arc/kernel/signal.c
  345. +++ linux-4.14.336/arch/arc/kernel/signal.c
  346. @@ -64,7 +64,7 @@ struct rt_sigframe {
  347.  	unsigned int sigret_magic;
  348.  };
  349.  
  350. -static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
  351. +static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
  352.  {
  353.  	int err = 0;
  354.  #ifndef CONFIG_ISA_ARCOMPACT
  355. @@ -77,12 +77,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
  356.  #else
  357.  	v2abi.r58 = v2abi.r59 = 0;
  358.  #endif
  359. -	err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi));
  360. +	err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi));
  361.  #endif
  362.  	return err;
  363.  }
  364.  
  365. -static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
  366. +static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
  367.  {
  368.  	int err = 0;
  369.  #ifndef CONFIG_ISA_ARCOMPACT
  370. diff --git arch/arm/boot/dts/imx1-ads.dts arch/arm/boot/dts/imx1-ads.dts
  371. index 5ea28ee07cf4..c2ee0a6b74ac 100644
  372. --- linux-4.14.336/arch/arm/boot/dts/imx1-ads.dts
  373. +++ linux-4.14.336/arch/arm/boot/dts/imx1-ads.dts
  374. @@ -81,7 +81,7 @@
  375.  	pinctrl-0 = <&pinctrl_weim>;
  376.  	status = "okay";
  377.  
  378. -	nor: nor@0,0 {
  379. +	nor: flash@0,0 {
  380.  		compatible = "cfi-flash";
  381.  		reg = <0 0x00000000 0x02000000>;
  382.  		bank-width = <4>;
  383. diff --git arch/arm/boot/dts/imx1-apf9328.dts arch/arm/boot/dts/imx1-apf9328.dts
  384. index e8b4b52c2418..001984de53ff 100644
  385. --- linux-4.14.336/arch/arm/boot/dts/imx1-apf9328.dts
  386. +++ linux-4.14.336/arch/arm/boot/dts/imx1-apf9328.dts
  387. @@ -50,7 +50,7 @@
  388.  	pinctrl-0 = <&pinctrl_weim>;
  389.  	status = "okay";
  390.  
  391. -	nor: nor@0,0 {
  392. +	nor: flash@0,0 {
  393.  		compatible = "cfi-flash";
  394.  		reg = <0 0x00000000 0x02000000>;
  395.  		bank-width = <2>;
  396. diff --git arch/arm/boot/dts/imx1.dtsi arch/arm/boot/dts/imx1.dtsi
  397. index 38d712be5685..65e27c86468a 100644
  398. --- linux-4.14.336/arch/arm/boot/dts/imx1.dtsi
  399. +++ linux-4.14.336/arch/arm/boot/dts/imx1.dtsi
  400. @@ -269,9 +269,12 @@
  401.  			status = "disabled";
  402.  		};
  403.  
  404. -		esram: esram@00300000 {
  405. +		esram: sram@300000 {
  406.  			compatible = "mmio-sram";
  407.  			reg = <0x00300000 0x20000>;
  408. +			ranges = <0 0x00300000 0x20000>;
  409. +			#address-cells = <1>;
  410. +			#size-cells = <1>;
  411.  		};
  412.  	};
  413.  };
  414. diff --git arch/arm/boot/dts/imx23-sansa.dts arch/arm/boot/dts/imx23-sansa.dts
  415. index 221fd55e967e..3e532f4c86a4 100644
  416. --- linux-4.14.336/arch/arm/boot/dts/imx23-sansa.dts
  417. +++ linux-4.14.336/arch/arm/boot/dts/imx23-sansa.dts
  418. @@ -174,10 +174,8 @@
  419.  		#address-cells = <1>;
  420.  		#size-cells = <0>;
  421.  		compatible = "i2c-gpio";
  422. -		gpios = <
  423. -			&gpio1 24 0		/* SDA */
  424. -			&gpio1 22 0		/* SCL */
  425. -		>;
  426. +		sda-gpios = <&gpio1 24 0>;
  427. +		scl-gpios = <&gpio1 22 0>;
  428.  		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
  429.  	};
  430.  
  431. @@ -185,10 +183,8 @@
  432.  		#address-cells = <1>;
  433.  		#size-cells = <0>;
  434.  		compatible = "i2c-gpio";
  435. -		gpios = <
  436. -			&gpio0 31 0		/* SDA */
  437. -			&gpio0 30 0		/* SCL */
  438. -		>;
  439. +		sda-gpios = <&gpio0 31 0>;
  440. +		scl-gpios = <&gpio0 30 0>;
  441.  		i2c-gpio,delay-us = <2>;	/* ~100 kHz */
  442.  
  443.  		touch: touch@20 {
  444. diff --git arch/arm/boot/dts/imx23.dtsi arch/arm/boot/dts/imx23.dtsi
  445. index 10d57f9cbb42..7a1613258e6c 100644
  446. --- linux-4.14.336/arch/arm/boot/dts/imx23.dtsi
  447. +++ linux-4.14.336/arch/arm/boot/dts/imx23.dtsi
  448. @@ -413,7 +413,7 @@
  449.  				status = "disabled";
  450.  			};
  451.  
  452. -			dma_apbx: dma-apbx@80024000 {
  453. +			dma_apbx: dma-controller@80024000 {
  454.  				compatible = "fsl,imx23-dma-apbx";
  455.  				reg = <0x80024000 0x2000>;
  456.  				interrupts = <7 5 9 26
  457. diff --git arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
  458. index d6f27641c0ef..8676a28f8b7a 100644
  459. --- linux-4.14.336/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
  460. +++ linux-4.14.336/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
  461. @@ -34,7 +34,7 @@
  462.  	pinctrl-0 = <&pinctrl_i2c1>;
  463.  	status = "okay";
  464.  
  465. -	pcf8563@51 {
  466. +	rtc@51 {
  467.  		compatible = "nxp,pcf8563";
  468.  		reg = <0x51>;
  469.  	};
  470. diff --git arch/arm/boot/dts/imx27-apf27dev.dts arch/arm/boot/dts/imx27-apf27dev.dts
  471. index 5f84b598e0d0..167f21434fbf 100644
  472. --- linux-4.14.336/arch/arm/boot/dts/imx27-apf27dev.dts
  473. +++ linux-4.14.336/arch/arm/boot/dts/imx27-apf27dev.dts
  474. @@ -53,7 +53,7 @@
  475.  		pinctrl-names = "default";
  476.  		pinctrl-0 = <&pinctrl_gpio_leds>;
  477.  
  478. -		user {
  479. +		led-user {
  480.  			label = "Heartbeat";
  481.  			gpios = <&gpio6 14 GPIO_ACTIVE_HIGH>;
  482.  			linux,default-trigger = "heartbeat";
  483. diff --git arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
  484. index 2cf896c505f9..546b0544f8c9 100644
  485. --- linux-4.14.336/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
  486. +++ linux-4.14.336/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
  487. @@ -45,7 +45,7 @@
  488.  	pinctrl-0 = <&pinctrl_i2c1>;
  489.  	status = "okay";
  490.  
  491. -	pcf8563@51 {
  492. +	rtc@51 {
  493.  		compatible = "nxp,pcf8563";
  494.  		reg = <0x51>;
  495.  	};
  496. @@ -102,7 +102,7 @@
  497.  &weim {
  498.  	status = "okay";
  499.  
  500. -	nor: nor@0,0 {
  501. +	nor: flash@0,0 {
  502.  		#address-cells = <1>;
  503.  		#size-cells = <1>;
  504.  		compatible = "cfi-flash";
  505. diff --git arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
  506. index c973c5d91875..1cd3251d21e1 100644
  507. --- linux-4.14.336/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
  508. +++ linux-4.14.336/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
  509. @@ -326,7 +326,7 @@
  510.  &weim {
  511.  	status = "okay";
  512.  
  513. -	nor: nor@0,0 {
  514. +	nor: flash@0,0 {
  515.  		compatible = "cfi-flash";
  516.  		reg = <0 0x00000000 0x02000000>;
  517.  		bank-width = <2>;
  518. diff --git arch/arm/boot/dts/imx27.dtsi arch/arm/boot/dts/imx27.dtsi
  519. index 15d85f1f85fd..507159b5d1d4 100644
  520. --- linux-4.14.336/arch/arm/boot/dts/imx27.dtsi
  521. +++ linux-4.14.336/arch/arm/boot/dts/imx27.dtsi
  522. @@ -600,6 +600,9 @@
  523.  		iram: iram@ffff4c00 {
  524.  			compatible = "mmio-sram";
  525.  			reg = <0xffff4c00 0xb400>;
  526. +			ranges = <0 0xffff4c00 0xb400>;
  527. +			#address-cells = <1>;
  528. +			#size-cells = <1>;
  529.  		};
  530.  	};
  531.  };
  532. diff --git arch/arm/boot/dts/imx28.dtsi arch/arm/boot/dts/imx28.dtsi
  533. index 2f4ebe0318d3..e489c480f4c0 100644
  534. --- linux-4.14.336/arch/arm/boot/dts/imx28.dtsi
  535. +++ linux-4.14.336/arch/arm/boot/dts/imx28.dtsi
  536. @@ -985,7 +985,7 @@
  537.  				status = "disabled";
  538.  			};
  539.  
  540. -			dma_apbx: dma-apbx@80024000 {
  541. +			dma_apbx: dma-controller@80024000 {
  542.  				compatible = "fsl,imx28-dma-apbx";
  543.  				reg = <0x80024000 0x2000>;
  544.  				interrupts = <78 79 66 0
  545. diff --git arch/arm/boot/dts/imx7s.dtsi arch/arm/boot/dts/imx7s.dtsi
  546. index 836550f2297a..1d158707b5de 100644
  547. --- linux-4.14.336/arch/arm/boot/dts/imx7s.dtsi
  548. +++ linux-4.14.336/arch/arm/boot/dts/imx7s.dtsi
  549. @@ -674,7 +674,7 @@
  550.  			};
  551.  
  552.  			lcdif: lcdif@30730000 {
  553. -				compatible = "fsl,imx7d-lcdif", "fsl,imx28-lcdif";
  554. +				compatible = "fsl,imx7d-lcdif", "fsl,imx6sx-lcdif";
  555.  				reg = <0x30730000 0x10000>;
  556.  				interrupts = <GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>;
  557.  				clocks = <&clks IMX7D_LCDIF_PIXEL_ROOT_CLK>,
  558. @@ -1039,7 +1039,7 @@
  559.  		gpmi: gpmi-nand@33002000{
  560.  			compatible = "fsl,imx7d-gpmi-nand";
  561.  			#address-cells = <1>;
  562. -			#size-cells = <1>;
  563. +			#size-cells = <0>;
  564.  			reg = <0x33002000 0x2000>, <0x33004000 0x4000>;
  565.  			reg-names = "gpmi-nand", "bch";
  566.  			interrupts = <GIC_SPI 14 IRQ_TYPE_LEVEL_HIGH>;
  567. diff --git arch/arm/boot/dts/rk3036.dtsi arch/arm/boot/dts/rk3036.dtsi
  568. index 03cf0c84ac0a..b1ede7a1e8de 100644
  569. --- linux-4.14.336/arch/arm/boot/dts/rk3036.dtsi
  570. +++ linux-4.14.336/arch/arm/boot/dts/rk3036.dtsi
  571. @@ -353,12 +353,20 @@
  572.  		pinctrl-0 = <&hdmi_ctl>;
  573.  		status = "disabled";
  574.  
  575. -		hdmi_in: port {
  576. +		ports {
  577.  			#address-cells = <1>;
  578.  			#size-cells = <0>;
  579. -			hdmi_in_vop: endpoint@0 {
  580. +
  581. +			hdmi_in: port@0 {
  582.  				reg = <0>;
  583. -				remote-endpoint = <&vop_out_hdmi>;
  584. +
  585. +				hdmi_in_vop: endpoint {
  586. +					remote-endpoint = <&vop_out_hdmi>;
  587. +				};
  588. +			};
  589. +
  590. +			hdmi_out: port@1 {
  591. +				reg = <1>;
  592.  			};
  593.  		};
  594.  	};
  595. diff --git arch/mips/alchemy/devboards/db1200.c arch/mips/alchemy/devboards/db1200.c
  596. index ae81e05fcb2c..fe827f98ebf1 100644
  597. --- linux-4.14.336/arch/mips/alchemy/devboards/db1200.c
  598. +++ linux-4.14.336/arch/mips/alchemy/devboards/db1200.c
  599. @@ -858,7 +858,7 @@ int __init db1200_dev_setup(void)
  600.  	i2c_register_board_info(0, db1200_i2c_devs,
  601.  				ARRAY_SIZE(db1200_i2c_devs));
  602.  	spi_register_board_info(db1200_spi_devs,
  603. -				ARRAY_SIZE(db1200_i2c_devs));
  604. +				ARRAY_SIZE(db1200_spi_devs));
  605.  
  606.  	/* SWITCHES:	S6.8 I2C/SPI selector  (OFF=I2C	 ON=SPI)
  607.  	 *		S6.7 AC97/I2S selector (OFF=AC97 ON=I2S)
  608. diff --git arch/mips/alchemy/devboards/db1550.c arch/mips/alchemy/devboards/db1550.c
  609. index 7d3dfaa10231..aaee46fe582f 100644
  610. --- linux-4.14.336/arch/mips/alchemy/devboards/db1550.c
  611. +++ linux-4.14.336/arch/mips/alchemy/devboards/db1550.c
  612. @@ -581,7 +581,7 @@ int __init db1550_dev_setup(void)
  613.  	i2c_register_board_info(0, db1550_i2c_devs,
  614.  				ARRAY_SIZE(db1550_i2c_devs));
  615.  	spi_register_board_info(db1550_spi_devs,
  616. -				ARRAY_SIZE(db1550_i2c_devs));
  617. +				ARRAY_SIZE(db1550_spi_devs));
  618.  
  619.  	c = clk_get(NULL, "psc0_intclk");
  620.  	if (!IS_ERR(c)) {
  621. diff --git arch/mips/include/asm/checksum.h arch/mips/include/asm/checksum.h
  622. index 77cad232a1c6..d7f673a6ef6d 100644
  623. --- linux-4.14.336/arch/mips/include/asm/checksum.h
  624. +++ linux-4.14.336/arch/mips/include/asm/checksum.h
  625. @@ -276,7 +276,8 @@ static __inline__ __sum16 csum_ipv6_magic(const struct in6_addr *saddr,
  626.  	"	.set	pop"
  627.  	: "=&r" (sum), "=&r" (tmp)
  628.  	: "r" (saddr), "r" (daddr),
  629. -	  "0" (htonl(len)), "r" (htonl(proto)), "r" (sum));
  630. +	  "0" (htonl(len)), "r" (htonl(proto)), "r" (sum)
  631. +	: "memory");
  632.  
  633.  	return csum_fold(sum);
  634.  }
  635. diff --git arch/mips/kernel/elf.c arch/mips/kernel/elf.c
  636. index 731325a61a78..d7d0a4872389 100644
  637. --- linux-4.14.336/arch/mips/kernel/elf.c
  638. +++ linux-4.14.336/arch/mips/kernel/elf.c
  639. @@ -15,6 +15,7 @@
  640.  
  641.  #include <asm/cpu-features.h>
  642.  #include <asm/cpu-info.h>
  643. +#include <asm/fpu.h>
  644.  
  645.  /* Whether to accept legacy-NaN and 2008-NaN user binaries.  */
  646.  bool mips_use_nan_legacy;
  647. @@ -311,6 +312,11 @@ void mips_set_personality_nan(struct arch_elf_state *state)
  648.  	struct cpuinfo_mips *c = &boot_cpu_data;
  649.  	struct task_struct *t = current;
  650.  
  651. +	/* Do this early so t->thread.fpu.fcr31 won't be clobbered in case
  652. +	 * we are preempted before the lose_fpu(0) in start_thread.
  653. +	 */
  654. +	lose_fpu(0);
  655. +
  656.  	t->thread.fpu.fcr31 = c->fpu_csr31;
  657.  	switch (state->nan_2008) {
  658.  	case 0:
  659. diff --git arch/parisc/kernel/firmware.c arch/parisc/kernel/firmware.c
  660. index 906b7c882587..82f264621845 100644
  661. --- linux-4.14.336/arch/parisc/kernel/firmware.c
  662. +++ linux-4.14.336/arch/parisc/kernel/firmware.c
  663. @@ -127,10 +127,10 @@ static unsigned long f_extend(unsigned long address)
  664.  #ifdef CONFIG_64BIT
  665.  	if(unlikely(parisc_narrow_firmware)) {
  666.  		if((address & 0xff000000) == 0xf0000000)
  667. -			return 0xf0f0f0f000000000UL | (u32)address;
  668. +			return (0xfffffff0UL << 32) | (u32)address;
  669.  
  670.  		if((address & 0xf0000000) == 0xf0000000)
  671. -			return 0xffffffff00000000UL | (u32)address;
  672. +			return (0xffffffffUL << 32) | (u32)address;
  673.  	}
  674.  #endif
  675.  	return address;
  676. diff --git arch/powerpc/Kconfig arch/powerpc/Kconfig
  677. index 3fcfa8534156..ff7a86090eac 100644
  678. --- linux-4.14.336/arch/powerpc/Kconfig
  679. +++ linux-4.14.336/arch/powerpc/Kconfig
  680. @@ -281,12 +281,10 @@ config ARCH_MAY_HAVE_PC_FDC
  681.  
  682.  config PPC_UDBG_16550
  683.  	bool
  684. -	default n
  685.  
  686.  config GENERIC_TBSYNC
  687.  	bool
  688.  	default y if PPC32 && SMP
  689. -	default n
  690.  
  691.  config AUDIT_ARCH
  692.  	bool
  693. @@ -305,13 +303,11 @@ config EPAPR_BOOT
  694.  	bool
  695.  	help
  696.  	  Used to allow a board to specify it wants an ePAPR compliant wrapper.
  697. -	default n
  698.  
  699.  config DEFAULT_UIMAGE
  700.  	bool
  701.  	help
  702.  	  Used to allow a board to specify it wants a uImage built by default
  703. -	default n
  704.  
  705.  config ARCH_HIBERNATION_POSSIBLE
  706.  	bool
  707. @@ -325,11 +321,9 @@ config ARCH_SUSPEND_POSSIBLE
  708.  
  709.  config PPC_DCR_NATIVE
  710.  	bool
  711. -	default n
  712.  
  713.  config PPC_DCR_MMIO
  714.  	bool
  715. -	default n
  716.  
  717.  config PPC_DCR
  718.  	bool
  719. @@ -340,7 +334,6 @@ config PPC_OF_PLATFORM_PCI
  720.  	bool
  721.  	depends on PCI
  722.  	depends on PPC64 # not supported on 32 bits yet
  723. -	default n
  724.  
  725.  config ARCH_SUPPORTS_DEBUG_PAGEALLOC
  726.  	depends on PPC32 || PPC_STD_MMU_64
  727. @@ -449,14 +442,12 @@ config PPC_TRANSACTIONAL_MEM
  728.         depends on SMP
  729.         select ALTIVEC
  730.         select VSX
  731. -       default n
  732.         ---help---
  733.           Support user-mode Transactional Memory on POWERPC.
  734.  
  735.  config LD_HEAD_STUB_CATCH
  736.  	bool "Reserve 256 bytes to cope with linker stubs in HEAD text" if EXPERT
  737.  	depends on PPC64
  738. -	default n
  739.  	help
  740.  	  Very large kernels can cause linker branch stubs to be generated by
  741.  	  code in head_64.S, which moves the head text sections out of their
  742. @@ -583,7 +574,6 @@ config RELOCATABLE
  743.  config RELOCATABLE_TEST
  744.  	bool "Test relocatable kernel"
  745.  	depends on (PPC64 && RELOCATABLE)
  746. -	default n
  747.  	help
  748.  	  This runs the relocatable kernel at the address it was initially
  749.  	  loaded at, which tends to be non-zero and therefore test the
  750. @@ -797,7 +787,6 @@ config PPC_SUBPAGE_PROT
  751.  
  752.  config PPC_COPRO_BASE
  753.  	bool
  754. -	default n
  755.  
  756.  config SCHED_SMT
  757.  	bool "SMT (Hyperthreading) scheduler support"
  758. @@ -911,7 +900,6 @@ config PPC_INDIRECT_PCI
  759.  	bool
  760.  	depends on PCI
  761.  	default y if 40x || 44x
  762. -	default n
  763.  
  764.  config EISA
  765.  	bool
  766. @@ -1008,7 +996,6 @@ source "drivers/pcmcia/Kconfig"
  767.  
  768.  config HAS_RAPIDIO
  769.  	bool
  770. -	default n
  771.  
  772.  config RAPIDIO
  773.  	tristate "RapidIO support"
  774. @@ -1044,7 +1031,6 @@ endmenu
  775.  
  776.  config NONSTATIC_KERNEL
  777.  	bool
  778. -	default n
  779.  
  780.  menu "Advanced setup"
  781.  	depends on PPC32
  782. diff --git arch/powerpc/Kconfig.debug arch/powerpc/Kconfig.debug
  783. index 6c60cc03a53c..a185e7c3fc9c 100644
  784. --- linux-4.14.336/arch/powerpc/Kconfig.debug
  785. +++ linux-4.14.336/arch/powerpc/Kconfig.debug
  786. @@ -5,7 +5,6 @@ source "lib/Kconfig.debug"
  787.  
  788.  config PPC_DISABLE_WERROR
  789.  	bool "Don't build arch/powerpc code with -Werror"
  790. -	default n
  791.  	help
  792.  	  This option tells the compiler NOT to build the code under
  793.  	  arch/powerpc with the -Werror flag (which means warnings
  794. @@ -59,7 +58,6 @@ config PPC_EMULATED_STATS
  795.  config CODE_PATCHING_SELFTEST
  796.  	bool "Run self-tests of the code-patching code"
  797.  	depends on DEBUG_KERNEL
  798. -	default n
  799.  
  800.  config JUMP_LABEL_FEATURE_CHECKS
  801.  	bool "Enable use of jump label for cpu/mmu_has_feature()"
  802. @@ -73,7 +71,6 @@ config JUMP_LABEL_FEATURE_CHECKS
  803.  config JUMP_LABEL_FEATURE_CHECK_DEBUG
  804.  	bool "Do extra check on feature fixup calls"
  805.  	depends on DEBUG_KERNEL && JUMP_LABEL_FEATURE_CHECKS
  806. -	default n
  807.  	help
  808.  	  This tries to catch incorrect usage of cpu_has_feature() and
  809.  	  mmu_has_feature() in the code.
  810. @@ -83,12 +80,10 @@ config JUMP_LABEL_FEATURE_CHECK_DEBUG
  811.  config FTR_FIXUP_SELFTEST
  812.  	bool "Run self-tests of the feature-fixup code"
  813.  	depends on DEBUG_KERNEL
  814. -	default n
  815.  
  816.  config MSI_BITMAP_SELFTEST
  817.  	bool "Run self-tests of the MSI bitmap code"
  818.  	depends on DEBUG_KERNEL
  819. -	default n
  820.  
  821.  config XMON
  822.  	bool "Include xmon kernel debugger"
  823. diff --git arch/powerpc/include/asm/mmu.h arch/powerpc/include/asm/mmu.h
  824. index 6364f5c2cc3e..2cc99f5dd703 100644
  825. --- linux-4.14.336/arch/powerpc/include/asm/mmu.h
  826. +++ linux-4.14.336/arch/powerpc/include/asm/mmu.h
  827. @@ -332,5 +332,9 @@ static inline void mmu_early_init_devtree(void) { }
  828.  #  include <asm/mmu-8xx.h>
  829.  #endif
  830.  
  831. +#if defined(CONFIG_FA_DUMP) || defined(CONFIG_PRESERVE_FA_DUMP)
  832. +#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
  833. +#endif
  834. +
  835.  #endif /* __KERNEL__ */
  836.  #endif /* _ASM_POWERPC_MMU_H_ */
  837. diff --git arch/powerpc/include/asm/mmzone.h arch/powerpc/include/asm/mmzone.h
  838. index 91c69ff53a8a..50c2198c2c76 100644
  839. --- linux-4.14.336/arch/powerpc/include/asm/mmzone.h
  840. +++ linux-4.14.336/arch/powerpc/include/asm/mmzone.h
  841. @@ -42,9 +42,6 @@ u64 memory_hotplug_max(void);
  842.  #else
  843.  #define memory_hotplug_max() memblock_end_of_DRAM()
  844.  #endif /* CONFIG_NEED_MULTIPLE_NODES */
  845. -#ifdef CONFIG_FA_DUMP
  846. -#define __HAVE_ARCH_RESERVED_KERNEL_PAGES
  847. -#endif
  848.  
  849.  #endif /* __KERNEL__ */
  850.  #endif /* _ASM_MMZONE_H_ */
  851. diff --git arch/powerpc/kernel/traps.c arch/powerpc/kernel/traps.c
  852. index a507a6874d42..f70799febec4 100644
  853. --- linux-4.14.336/arch/powerpc/kernel/traps.c
  854. +++ linux-4.14.336/arch/powerpc/kernel/traps.c
  855. @@ -1070,10 +1070,12 @@ static int emulate_instruction(struct pt_regs *regs)
  856.  	return -EINVAL;
  857.  }
  858.  
  859. +#ifdef CONFIG_GENERIC_BUG
  860.  int is_valid_bugaddr(unsigned long addr)
  861.  {
  862.  	return is_kernel_addr(addr);
  863.  }
  864. +#endif
  865.  
  866.  #ifdef CONFIG_MATH_EMULATION
  867.  static int emulate_math(struct pt_regs *regs)
  868. diff --git arch/powerpc/lib/Makefile arch/powerpc/lib/Makefile
  869. index 00c34be4c604..41491eb517cc 100644
  870. --- linux-4.14.336/arch/powerpc/lib/Makefile
  871. +++ linux-4.14.336/arch/powerpc/lib/Makefile
  872. @@ -21,8 +21,8 @@ obj-$(CONFIG_PPC32)	+= div64.o copy_32.o crtsavres.o
  873.  # 64-bit linker creates .sfpr on demand for final link (vmlinux),
  874.  # so it is only needed for modules, and only for older linkers which
  875.  # do not support --save-restore-funcs
  876. -ifeq ($(call ld-ifversion, -lt, 225000000, y),y)
  877. -extra-$(CONFIG_PPC64)	+= crtsavres.o
  878. +ifeq ($(call ld-ifversion, -lt, 225000000, y)$(CONFIG_PPC64),yy)
  879. +always	+= crtsavres.o
  880.  endif
  881.  
  882.  obj64-y	+= copypage_64.o copyuser_64.o mem_64.o hweight_64.o \
  883. diff --git arch/powerpc/lib/sstep.c arch/powerpc/lib/sstep.c
  884. index e9bfd9751246..331f3d0cbeb2 100644
  885. --- linux-4.14.336/arch/powerpc/lib/sstep.c
  886. +++ linux-4.14.336/arch/powerpc/lib/sstep.c
  887. @@ -471,6 +471,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea,
  888.  	} u;
  889.  
  890.  	nb = GETSIZE(op->type);
  891. +	if (nb > sizeof(u))
  892. +		return -EINVAL;
  893.  	if (!address_ok(regs, ea, nb))
  894.  		return -EFAULT;
  895.  	rn = op->reg;
  896. @@ -521,6 +523,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea,
  897.  	} u;
  898.  
  899.  	nb = GETSIZE(op->type);
  900. +	if (nb > sizeof(u))
  901. +		return -EINVAL;
  902.  	if (!address_ok(regs, ea, nb))
  903.  		return -EFAULT;
  904.  	rn = op->reg;
  905. @@ -565,6 +569,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea,
  906.  		u8 b[sizeof(__vector128)];
  907.  	} u = {};
  908.  
  909. +	if (size > sizeof(u))
  910. +		return -EINVAL;
  911. +
  912.  	if (!address_ok(regs, ea & ~0xfUL, 16))
  913.  		return -EFAULT;
  914.  	/* align to multiple of size */
  915. @@ -592,6 +599,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea,
  916.  		u8 b[sizeof(__vector128)];
  917.  	} u;
  918.  
  919. +	if (size > sizeof(u))
  920. +		return -EINVAL;
  921. +
  922.  	if (!address_ok(regs, ea & ~0xfUL, 16))
  923.  		return -EFAULT;
  924.  	/* align to multiple of size */
  925. diff --git arch/powerpc/mm/init-common.c arch/powerpc/mm/init-common.c
  926. index eb8c6c8c4851..c8515de5292e 100644
  927. --- linux-4.14.336/arch/powerpc/mm/init-common.c
  928. +++ linux-4.14.336/arch/powerpc/mm/init-common.c
  929. @@ -65,7 +65,7 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
  930.  	 * as to leave enough 0 bits in the address to contain it. */
  931.  	unsigned long minalign = max(MAX_PGTABLE_INDEX_SIZE + 1,
  932.  				     HUGEPD_SHIFT_MASK + 1);
  933. -	struct kmem_cache *new;
  934. +	struct kmem_cache *new = NULL;
  935.  
  936.  	/* It would be nice if this was a BUILD_BUG_ON(), but at the
  937.  	 * moment, gcc doesn't seem to recognize is_power_of_2 as a
  938. @@ -78,7 +78,8 @@ void pgtable_cache_add(unsigned shift, void (*ctor)(void *))
  939.  
  940.  	align = max_t(unsigned long, align, minalign);
  941.  	name = kasprintf(GFP_KERNEL, "pgtable-2^%d", shift);
  942. -	new = kmem_cache_create(name, table_size, align, 0, ctor);
  943. +	if (name)
  944. +		new = kmem_cache_create(name, table_size, align, 0, ctor);
  945.  	if (!new)
  946.  		panic("Could not allocate pgtable cache for order %d", shift);
  947.  
  948. diff --git arch/powerpc/perf/imc-pmu.c arch/powerpc/perf/imc-pmu.c
  949. index a0b4c22d963a..0b785c6bdbbf 100644
  950. --- linux-4.14.336/arch/powerpc/perf/imc-pmu.c
  951. +++ linux-4.14.336/arch/powerpc/perf/imc-pmu.c
  952. @@ -246,6 +246,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
  953.  	attr_group->attrs = attrs;
  954.  	do {
  955.  		ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i]->value);
  956. +		if (!ev_val_str)
  957. +			continue;
  958.  		dev_str = device_str_attr_create(pmu->events[i]->name, ev_val_str);
  959.  		if (!dev_str)
  960.  			continue;
  961. @@ -253,6 +255,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
  962.  		attrs[j++] = dev_str;
  963.  		if (pmu->events[i]->scale) {
  964.  			ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale",pmu->events[i]->name);
  965. +			if (!ev_scale_str)
  966. +				continue;
  967.  			dev_str = device_str_attr_create(ev_scale_str, pmu->events[i]->scale);
  968.  			if (!dev_str)
  969.  				continue;
  970. @@ -262,6 +266,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
  971.  
  972.  		if (pmu->events[i]->unit) {
  973.  			ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit",pmu->events[i]->name);
  974. +			if (!ev_unit_str)
  975. +				continue;
  976.  			dev_str = device_str_attr_create(ev_unit_str, pmu->events[i]->unit);
  977.  			if (!dev_str)
  978.  				continue;
  979. diff --git arch/powerpc/platforms/40x/Kconfig arch/powerpc/platforms/40x/Kconfig
  980. index 60254a321a91..2a9d66254ffc 100644
  981. --- linux-4.14.336/arch/powerpc/platforms/40x/Kconfig
  982. +++ linux-4.14.336/arch/powerpc/platforms/40x/Kconfig
  983. @@ -2,7 +2,6 @@
  984.  config ACADIA
  985.  	bool "Acadia"
  986.  	depends on 40x
  987. -	default n
  988.  	select PPC40x_SIMPLE
  989.  	select 405EZ
  990.  	help
  991. @@ -11,7 +10,6 @@ config ACADIA
  992.  config EP405
  993.  	bool "EP405/EP405PC"
  994.  	depends on 40x
  995. -	default n
  996.  	select 405GP
  997.  	select PCI
  998.  	help
  999. @@ -20,7 +18,6 @@ config EP405
  1000.  config HOTFOOT
  1001.          bool "Hotfoot"
  1002.  	depends on 40x
  1003. -	default n
  1004.  	select PPC40x_SIMPLE
  1005.  	select PCI
  1006.          help
  1007. @@ -29,7 +26,6 @@ config HOTFOOT
  1008.  config KILAUEA
  1009.  	bool "Kilauea"
  1010.  	depends on 40x
  1011. -	default n
  1012.  	select 405EX
  1013.  	select PPC40x_SIMPLE
  1014.  	select PPC4xx_PCI_EXPRESS
  1015. @@ -41,7 +37,6 @@ config KILAUEA
  1016.  config MAKALU
  1017.  	bool "Makalu"
  1018.  	depends on 40x
  1019. -	default n
  1020.  	select 405EX
  1021.  	select PCI
  1022.  	select PPC4xx_PCI_EXPRESS
  1023. @@ -62,7 +57,6 @@ config WALNUT
  1024.  config XILINX_VIRTEX_GENERIC_BOARD
  1025.  	bool "Generic Xilinx Virtex board"
  1026.  	depends on 40x
  1027. -	default n
  1028.  	select XILINX_VIRTEX_II_PRO
  1029.  	select XILINX_VIRTEX_4_FX
  1030.  	select XILINX_INTC
  1031. @@ -80,7 +74,6 @@ config XILINX_VIRTEX_GENERIC_BOARD
  1032.  config OBS600
  1033.  	bool "OpenBlockS 600"
  1034.  	depends on 40x
  1035. -	default n
  1036.  	select 405EX
  1037.  	select PPC40x_SIMPLE
  1038.  	help
  1039. @@ -90,7 +83,6 @@ config OBS600
  1040.  config PPC40x_SIMPLE
  1041.  	bool "Simple PowerPC 40x board support"
  1042.  	depends on 40x
  1043. -	default n
  1044.  	help
  1045.  	  This option enables the simple PowerPC 40x platform support.
  1046.  
  1047. @@ -156,7 +148,6 @@ config IBM405_ERR51
  1048.  config APM8018X
  1049.  	bool "APM8018X"
  1050.  	depends on 40x
  1051. -	default n
  1052.  	select PPC40x_SIMPLE
  1053.  	help
  1054.  	  This option enables support for the AppliedMicro APM8018X evaluation
  1055. diff --git arch/powerpc/platforms/44x/Kconfig arch/powerpc/platforms/44x/Kconfig
  1056. index a6011422b861..559577065af2 100644
  1057. --- linux-4.14.336/arch/powerpc/platforms/44x/Kconfig
  1058. +++ linux-4.14.336/arch/powerpc/platforms/44x/Kconfig
  1059. @@ -2,7 +2,6 @@
  1060.  config PPC_47x
  1061.  	bool "Support for 47x variant"
  1062.  	depends on 44x
  1063. -	default n
  1064.  	select MPIC
  1065.  	help
  1066.  	  This option enables support for the 47x family of processors and is
  1067. @@ -11,7 +10,6 @@ config PPC_47x
  1068.  config BAMBOO
  1069.  	bool "Bamboo"
  1070.  	depends on 44x
  1071. -	default n
  1072.  	select PPC44x_SIMPLE
  1073.  	select 440EP
  1074.  	select PCI
  1075. @@ -21,7 +19,6 @@ config BAMBOO
  1076.  config BLUESTONE
  1077.  	bool "Bluestone"
  1078.  	depends on 44x
  1079. -	default n
  1080.  	select PPC44x_SIMPLE
  1081.  	select APM821xx
  1082.  	select PCI_MSI
  1083. @@ -44,7 +41,6 @@ config EBONY
  1084.  config SAM440EP
  1085.          bool "Sam440ep"
  1086.  	depends on 44x
  1087. -        default n
  1088.          select 440EP
  1089.          select PCI
  1090.          help
  1091. @@ -53,7 +49,6 @@ config SAM440EP
  1092.  config SEQUOIA
  1093.  	bool "Sequoia"
  1094.  	depends on 44x
  1095. -	default n
  1096.  	select PPC44x_SIMPLE
  1097.  	select 440EPX
  1098.  	help
  1099. @@ -62,7 +57,6 @@ config SEQUOIA
  1100.  config TAISHAN
  1101.  	bool "Taishan"
  1102.  	depends on 44x
  1103. -	default n
  1104.  	select PPC44x_SIMPLE
  1105.  	select 440GX
  1106.  	select PCI
  1107. @@ -73,7 +67,6 @@ config TAISHAN
  1108.  config KATMAI
  1109.  	bool "Katmai"
  1110.  	depends on 44x
  1111. -	default n
  1112.  	select PPC44x_SIMPLE
  1113.  	select 440SPe
  1114.  	select PCI
  1115. @@ -86,7 +79,6 @@ config KATMAI
  1116.  config RAINIER
  1117.  	bool "Rainier"
  1118.  	depends on 44x
  1119. -	default n
  1120.  	select PPC44x_SIMPLE
  1121.  	select 440GRX
  1122.  	select PCI
  1123. @@ -96,7 +88,6 @@ config RAINIER
  1124.  config WARP
  1125.  	bool "PIKA Warp"
  1126.  	depends on 44x
  1127. -	default n
  1128.  	select 440EP
  1129.  	help
  1130.  	  This option enables support for the PIKA Warp(tm) Appliance. The Warp
  1131. @@ -109,7 +100,6 @@ config WARP
  1132.  config ARCHES
  1133.  	bool "Arches"
  1134.  	depends on 44x
  1135. -	default n
  1136.  	select PPC44x_SIMPLE
  1137.  	select 460EX # Odd since it uses 460GT but the effects are the same
  1138.  	select PCI
  1139. @@ -120,7 +110,6 @@ config ARCHES
  1140.  config CANYONLANDS
  1141.  	bool "Canyonlands"
  1142.  	depends on 44x
  1143. -	default n
  1144.  	select 460EX
  1145.  	select PCI
  1146.  	select PPC4xx_PCI_EXPRESS
  1147. @@ -134,7 +123,6 @@ config CANYONLANDS
  1148.  config GLACIER
  1149.  	bool "Glacier"
  1150.  	depends on 44x
  1151. -	default n
  1152.  	select PPC44x_SIMPLE
  1153.  	select 460EX # Odd since it uses 460GT but the effects are the same
  1154.  	select PCI
  1155. @@ -147,7 +135,6 @@ config GLACIER
  1156.  config REDWOOD
  1157.  	bool "Redwood"
  1158.  	depends on 44x
  1159. -	default n
  1160.  	select PPC44x_SIMPLE
  1161.  	select 460SX
  1162.  	select PCI
  1163. @@ -160,7 +147,6 @@ config REDWOOD
  1164.  config EIGER
  1165.  	bool "Eiger"
  1166.  	depends on 44x
  1167. -	default n
  1168.  	select PPC44x_SIMPLE
  1169.  	select 460SX
  1170.  	select PCI
  1171. @@ -172,7 +158,6 @@ config EIGER
  1172.  config YOSEMITE
  1173.  	bool "Yosemite"
  1174.  	depends on 44x
  1175. -	default n
  1176.  	select PPC44x_SIMPLE
  1177.  	select 440EP
  1178.  	select PCI
  1179. @@ -182,7 +167,6 @@ config YOSEMITE
  1180.  config ISS4xx
  1181.  	bool "ISS 4xx Simulator"
  1182.  	depends on (44x || 40x)
  1183. -	default n
  1184.  	select 405GP if 40x
  1185.  	select 440GP if 44x && !PPC_47x
  1186.  	select PPC_FPU
  1187. @@ -193,7 +177,7 @@ config ISS4xx
  1188.  config CURRITUCK
  1189.  	bool "IBM Currituck (476fpe) Support"
  1190.  	depends on PPC_47x
  1191. -	default n
  1192. +	select I2C
  1193.  	select SWIOTLB
  1194.  	select 476FPE
  1195.  	select PPC4xx_PCI_EXPRESS
  1196. @@ -203,7 +187,6 @@ config CURRITUCK
  1197.  config FSP2
  1198.  	bool "IBM FSP2 (476fpe) Support"
  1199.  	depends on PPC_47x
  1200. -	default n
  1201.  	select 476FPE
  1202.  	select IBM_EMAC_EMAC4 if IBM_EMAC
  1203.  	select IBM_EMAC_RGMII if IBM_EMAC
  1204. @@ -215,7 +198,6 @@ config FSP2
  1205.  config AKEBONO
  1206.  	bool "IBM Akebono (476gtr) Support"
  1207.  	depends on PPC_47x
  1208. -	default n
  1209.  	select SWIOTLB
  1210.  	select 476FPE
  1211.  	select PPC4xx_PCI_EXPRESS
  1212. @@ -241,7 +223,6 @@ config AKEBONO
  1213.  config ICON
  1214.  	bool "Icon"
  1215.  	depends on 44x
  1216. -	default n
  1217.  	select PPC44x_SIMPLE
  1218.  	select 440SPe
  1219.  	select PCI
  1220. @@ -252,7 +233,6 @@ config ICON
  1221.  config XILINX_VIRTEX440_GENERIC_BOARD
  1222.  	bool "Generic Xilinx Virtex 5 FXT board support"
  1223.  	depends on 44x
  1224. -	default n
  1225.  	select XILINX_VIRTEX_5_FXT
  1226.  	select XILINX_INTC
  1227.  	help
  1228. @@ -280,7 +260,6 @@ config XILINX_ML510
  1229.  config PPC44x_SIMPLE
  1230.  	bool "Simple PowerPC 44x board support"
  1231.  	depends on 44x
  1232. -	default n
  1233.  	help
  1234.  	  This option enables the simple PowerPC 44x platform support.
  1235.  
  1236. diff --git arch/powerpc/platforms/82xx/Kconfig arch/powerpc/platforms/82xx/Kconfig
  1237. index 6e04099361b9..1947a88bc69f 100644
  1238. --- linux-4.14.336/arch/powerpc/platforms/82xx/Kconfig
  1239. +++ linux-4.14.336/arch/powerpc/platforms/82xx/Kconfig
  1240. @@ -51,7 +51,6 @@ endif
  1241.  
  1242.  config PQ2ADS
  1243.  	bool
  1244. -	default n
  1245.  
  1246.  config 8260
  1247.  	bool
  1248. diff --git arch/powerpc/platforms/Kconfig arch/powerpc/platforms/Kconfig
  1249. index e06ccba35133..7cf557c1e1b0 100644
  1250. --- linux-4.14.336/arch/powerpc/platforms/Kconfig
  1251. +++ linux-4.14.336/arch/powerpc/platforms/Kconfig
  1252. @@ -23,7 +23,6 @@ source "arch/powerpc/platforms/amigaone/Kconfig"
  1253.  
  1254.  config KVM_GUEST
  1255.  	bool "KVM Guest support"
  1256. -	default n
  1257.  	select EPAPR_PARAVIRT
  1258.  	---help---
  1259.  	  This option enables various optimizations for running under the KVM
  1260. @@ -34,7 +33,6 @@ config KVM_GUEST
  1261.  
  1262.  config EPAPR_PARAVIRT
  1263.  	bool "ePAPR para-virtualization support"
  1264. -	default n
  1265.  	help
  1266.  	  Enables ePAPR para-virtualization support for guests.
  1267.  
  1268. @@ -74,7 +72,6 @@ config PPC_DT_CPU_FTRS
  1269.  config UDBG_RTAS_CONSOLE
  1270.  	bool "RTAS based debug console"
  1271.  	depends on PPC_RTAS
  1272. -	default n
  1273.  
  1274.  config PPC_SMP_MUXED_IPI
  1275.  	bool
  1276. @@ -86,16 +83,13 @@ config PPC_SMP_MUXED_IPI
  1277.  
  1278.  config IPIC
  1279.  	bool
  1280. -	default n
  1281.  
  1282.  config MPIC
  1283.  	bool
  1284. -	default n
  1285.  
  1286.  config MPIC_TIMER
  1287.  	bool "MPIC Global Timer"
  1288.  	depends on MPIC && FSL_SOC
  1289. -	default n
  1290.  	help
  1291.  	  The MPIC global timer is a hardware timer inside the
  1292.  	  Freescale PIC complying with OpenPIC standard. When the
  1293. @@ -107,7 +101,6 @@ config MPIC_TIMER
  1294.  config FSL_MPIC_TIMER_WAKEUP
  1295.  	tristate "Freescale MPIC global timer wakeup driver"
  1296.  	depends on FSL_SOC &&  MPIC_TIMER && PM
  1297. -	default n
  1298.  	help
  1299.  	  The driver provides a way to wake up the system by MPIC
  1300.  	  timer.
  1301. @@ -115,43 +108,35 @@ config FSL_MPIC_TIMER_WAKEUP
  1302.  
  1303.  config PPC_EPAPR_HV_PIC
  1304.  	bool
  1305. -	default n
  1306.  	select EPAPR_PARAVIRT
  1307.  
  1308.  config MPIC_WEIRD
  1309.  	bool
  1310. -	default n
  1311.  
  1312.  config MPIC_MSGR
  1313.  	bool "MPIC message register support"
  1314.  	depends on MPIC
  1315. -	default n
  1316.  	help
  1317.  	  Enables support for the MPIC message registers.  These
  1318.  	  registers are used for inter-processor communication.
  1319.  
  1320.  config PPC_I8259
  1321.  	bool
  1322. -	default n
  1323.  
  1324.  config U3_DART
  1325.  	bool
  1326.  	depends on PPC64
  1327. -	default n
  1328.  
  1329.  config PPC_RTAS
  1330.  	bool
  1331. -	default n
  1332.  
  1333.  config RTAS_ERROR_LOGGING
  1334.  	bool
  1335.  	depends on PPC_RTAS
  1336. -	default n
  1337.  
  1338.  config PPC_RTAS_DAEMON
  1339.  	bool
  1340.  	depends on PPC_RTAS
  1341. -	default n
  1342.  
  1343.  config RTAS_PROC
  1344.  	bool "Proc interface to RTAS"
  1345. @@ -164,11 +149,9 @@ config RTAS_FLASH
  1346.  
  1347.  config MMIO_NVRAM
  1348.  	bool
  1349. -	default n
  1350.  
  1351.  config MPIC_U3_HT_IRQS
  1352.  	bool
  1353. -	default n
  1354.  
  1355.  config MPIC_BROKEN_REGREAD
  1356.  	bool
  1357. @@ -187,15 +170,12 @@ config EEH
  1358.  
  1359.  config PPC_MPC106
  1360.  	bool
  1361. -	default n
  1362.  
  1363.  config PPC_970_NAP
  1364.  	bool
  1365. -	default n
  1366.  
  1367.  config PPC_P7_NAP
  1368.  	bool
  1369. -	default n
  1370.  
  1371.  config PPC_INDIRECT_PIO
  1372.  	bool
  1373. @@ -301,7 +281,6 @@ config AXON_RAM
  1374.  
  1375.  config FSL_ULI1575
  1376.  	bool
  1377. -	default n
  1378.  	select GENERIC_ISA_DMA
  1379.  	help
  1380.  	  Supports for the ULI1575 PCIe south bridge that exists on some
  1381. diff --git arch/powerpc/platforms/Kconfig.cputype arch/powerpc/platforms/Kconfig.cputype
  1382. index 3ce376b42330..267cc8f41cf1 100644
  1383. --- linux-4.14.336/arch/powerpc/platforms/Kconfig.cputype
  1384. +++ linux-4.14.336/arch/powerpc/platforms/Kconfig.cputype
  1385. @@ -1,7 +1,6 @@
  1386.  # SPDX-License-Identifier: GPL-2.0
  1387.  config PPC64
  1388.  	bool "64-bit kernel"
  1389. -	default n
  1390.  	select ZLIB_DEFLATE
  1391.  	help
  1392.  	  This option selects whether a 32-bit or a 64-bit kernel
  1393. @@ -326,7 +325,6 @@ config PPC_MM_SLICES
  1394.  	bool
  1395.  	default y if PPC_STD_MMU_64
  1396.  	default y if PPC_8xx && HUGETLB_PAGE
  1397. -	default n
  1398.  
  1399.  config PPC_HAVE_PMU_SUPPORT
  1400.         bool
  1401. @@ -340,7 +338,6 @@ config PPC_PERF_CTRS
  1402.  config FORCE_SMP
  1403.  	# Allow platforms to force SMP=y by selecting this
  1404.  	bool
  1405. -	default n
  1406.  	select SMP
  1407.  
  1408.  config SMP
  1409. @@ -381,7 +378,6 @@ config CHECK_CACHE_COHERENCY
  1410.  
  1411.  config PPC_DOORBELL
  1412.  	bool
  1413. -	default n
  1414.  
  1415.  endmenu
  1416.  
  1417. diff --git arch/powerpc/platforms/cell/Kconfig arch/powerpc/platforms/cell/Kconfig
  1418. index 741a8fa8a3e6..3ad42075f1f4 100644
  1419. --- linux-4.14.336/arch/powerpc/platforms/cell/Kconfig
  1420. +++ linux-4.14.336/arch/powerpc/platforms/cell/Kconfig
  1421. @@ -1,7 +1,6 @@
  1422.  # SPDX-License-Identifier: GPL-2.0
  1423.  config PPC_CELL
  1424.  	bool
  1425. -	default n
  1426.  
  1427.  config PPC_CELL_COMMON
  1428.  	bool
  1429. @@ -22,7 +21,6 @@ config PPC_CELL_NATIVE
  1430.  	select IBM_EMAC_RGMII if IBM_EMAC
  1431.  	select IBM_EMAC_ZMII if IBM_EMAC #test only
  1432.  	select IBM_EMAC_TAH if IBM_EMAC  #test only
  1433. -	default n
  1434.  
  1435.  config PPC_IBM_CELL_BLADE
  1436.  	bool "IBM Cell Blade"
  1437. @@ -55,7 +53,6 @@ config SPU_FS
  1438.  
  1439.  config SPU_BASE
  1440.  	bool
  1441. -	default n
  1442.  	select PPC_COPRO_BASE
  1443.  
  1444.  config CBE_RAS
  1445. diff --git arch/powerpc/platforms/maple/Kconfig arch/powerpc/platforms/maple/Kconfig
  1446. index 376d0be36b66..2601fac50354 100644
  1447. --- linux-4.14.336/arch/powerpc/platforms/maple/Kconfig
  1448. +++ linux-4.14.336/arch/powerpc/platforms/maple/Kconfig
  1449. @@ -13,7 +13,6 @@ config PPC_MAPLE
  1450.  	select PPC_RTAS
  1451.  	select MMIO_NVRAM
  1452.  	select ATA_NONSTANDARD if ATA
  1453. -	default n
  1454.  	help
  1455.            This option enables support for the Maple 970FX Evaluation Board.
  1456.  	  For more information, refer to <http://www.970eval.com>
  1457. diff --git arch/powerpc/platforms/pasemi/Kconfig arch/powerpc/platforms/pasemi/Kconfig
  1458. index d458a791d35b..98e3bc22bebc 100644
  1459. --- linux-4.14.336/arch/powerpc/platforms/pasemi/Kconfig
  1460. +++ linux-4.14.336/arch/powerpc/platforms/pasemi/Kconfig
  1461. @@ -2,7 +2,6 @@
  1462.  config PPC_PASEMI
  1463.  	depends on PPC64 && PPC_BOOK3S && CPU_BIG_ENDIAN
  1464.  	bool "PA Semi SoC-based platforms"
  1465. -	default n
  1466.  	select MPIC
  1467.  	select PCI
  1468.  	select PPC_UDBG_16550
  1469. diff --git arch/powerpc/platforms/powernv/Kconfig arch/powerpc/platforms/powernv/Kconfig
  1470. index f8dc98d3dc01..05ee7b65d40f 100644
  1471. --- linux-4.14.336/arch/powerpc/platforms/powernv/Kconfig
  1472. +++ linux-4.14.336/arch/powerpc/platforms/powernv/Kconfig
  1473. @@ -35,7 +35,6 @@ config OPAL_PRD
  1474.  config PPC_MEMTRACE
  1475.  	bool "Enable removal of RAM from kernel mappings for tracing"
  1476.  	depends on PPC_POWERNV && MEMORY_HOTREMOVE
  1477. -	default n
  1478.  	help
  1479.  	  Enabling this option allows for the removal of memory (RAM)
  1480.  	  from the kernel mappings to be used for hardware tracing.
  1481. diff --git arch/powerpc/platforms/powernv/opal-irqchip.c arch/powerpc/platforms/powernv/opal-irqchip.c
  1482. index ecdcba9d1220..bd37ff2d7bd2 100644
  1483. --- linux-4.14.336/arch/powerpc/platforms/powernv/opal-irqchip.c
  1484. +++ linux-4.14.336/arch/powerpc/platforms/powernv/opal-irqchip.c
  1485. @@ -253,6 +253,8 @@ int __init opal_event_init(void)
  1486.  		else
  1487.  			name = kasprintf(GFP_KERNEL, "opal");
  1488.  
  1489. +		if (!name)
  1490. +			continue;
  1491.  		/* Install interrupt handler */
  1492.  		rc = request_irq(virq, opal_interrupt, IRQF_TRIGGER_LOW,
  1493.  				 name, NULL);
  1494. diff --git arch/powerpc/platforms/ps3/Kconfig arch/powerpc/platforms/ps3/Kconfig
  1495. index 6f7525555b19..24864b8aaf5d 100644
  1496. --- linux-4.14.336/arch/powerpc/platforms/ps3/Kconfig
  1497. +++ linux-4.14.336/arch/powerpc/platforms/ps3/Kconfig
  1498. @@ -49,7 +49,6 @@ config PS3_HTAB_SIZE
  1499.  config PS3_DYNAMIC_DMA
  1500.  	depends on PPC_PS3
  1501.  	bool "PS3 Platform dynamic DMA page table management"
  1502. -	default n
  1503.  	help
  1504.  	  This option will enable kernel support to take advantage of the
  1505.  	  per device dynamic DMA page table management provided by the Cell
  1506. @@ -89,7 +88,6 @@ config PS3_SYS_MANAGER
  1507.  config PS3_REPOSITORY_WRITE
  1508.  	bool "PS3 Repository write support" if PS3_ADVANCED
  1509.  	depends on PPC_PS3
  1510. -	default n
  1511.  	help
  1512.  	  Enables support for writing to the PS3 System Repository.
  1513.  
  1514. diff --git arch/powerpc/platforms/pseries/Kconfig arch/powerpc/platforms/pseries/Kconfig
  1515. index 0c698fd6d491..39032d9b316c 100644
  1516. --- linux-4.14.336/arch/powerpc/platforms/pseries/Kconfig
  1517. +++ linux-4.14.336/arch/powerpc/platforms/pseries/Kconfig
  1518. @@ -28,7 +28,6 @@ config PPC_PSERIES
  1519.  config PPC_SPLPAR
  1520.  	depends on PPC_PSERIES
  1521.  	bool "Support for shared-processor logical partitions"
  1522. -	default n
  1523.  	help
  1524.  	  Enabling this option will make the kernel run more efficiently
  1525.  	  on logically-partitioned pSeries systems which use shared
  1526. @@ -99,7 +98,6 @@ config PPC_SMLPAR
  1527.  	bool "Support for shared-memory logical partitions"
  1528.  	depends on PPC_PSERIES
  1529.  	select LPARCFG
  1530. -	default n
  1531.  	help
  1532.  	  Select this option to enable shared memory partition support.
  1533.  	  With this option a system running in an LPAR can be given more
  1534. diff --git arch/powerpc/platforms/pseries/hotplug-memory.c arch/powerpc/platforms/pseries/hotplug-memory.c
  1535. index 1a3cffdaa1e8..318772785547 100644
  1536. --- linux-4.14.336/arch/powerpc/platforms/pseries/hotplug-memory.c
  1537. +++ linux-4.14.336/arch/powerpc/platforms/pseries/hotplug-memory.c
  1538. @@ -573,7 +573,7 @@ static int dlpar_memory_remove_by_index(u32 drc_index, struct property *prop)
  1539.  	int lmb_found;
  1540.  	int i, rc;
  1541.  
  1542. -	pr_info("Attempting to hot-remove LMB, drc index %x\n", drc_index);
  1543. +	pr_debug("Attempting to hot-remove LMB, drc index %x\n", drc_index);
  1544.  
  1545.  	p = prop->value;
  1546.  	num_lmbs = *p++;
  1547. @@ -591,14 +591,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index, struct property *prop)
  1548.  		}
  1549.  	}
  1550.  
  1551. -	if (!lmb_found)
  1552. +	if (!lmb_found) {
  1553. +		pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
  1554.  		rc = -EINVAL;
  1555. -
  1556. -	if (rc)
  1557. -		pr_info("Failed to hot-remove memory at %llx\n",
  1558. -			lmbs[i].base_addr);
  1559. -	else
  1560. -		pr_info("Memory at %llx was hot-removed\n", lmbs[i].base_addr);
  1561. +	} else if (rc) {
  1562. +		pr_debug("Failed to hot-remove memory at %llx\n",
  1563. +			 lmbs[i].base_addr);
  1564. +	} else {
  1565. +		pr_debug("Memory at %llx was hot-removed\n", lmbs[i].base_addr);
  1566. +	}
  1567.  
  1568.  	return rc;
  1569.  }
  1570. @@ -875,8 +876,8 @@ static int dlpar_memory_add_by_count(u32 lmbs_to_add, struct property *prop)
  1571.  			if (!lmbs[i].reserved)
  1572.  				continue;
  1573.  
  1574. -			pr_info("Memory at %llx (drc index %x) was hot-added\n",
  1575. -				lmbs[i].base_addr, lmbs[i].drc_index);
  1576. +			pr_debug("Memory at %llx (drc index %x) was hot-added\n",
  1577. +				 lmbs[i].base_addr, lmbs[i].drc_index);
  1578.  			lmbs[i].reserved = 0;
  1579.  		}
  1580.  		rc = 0;
  1581. diff --git arch/powerpc/sysdev/Kconfig arch/powerpc/sysdev/Kconfig
  1582. index bcef2ac56479..e0dbec780fe9 100644
  1583. --- linux-4.14.336/arch/powerpc/sysdev/Kconfig
  1584. +++ linux-4.14.336/arch/powerpc/sysdev/Kconfig
  1585. @@ -6,19 +6,16 @@
  1586.  config PPC4xx_PCI_EXPRESS
  1587.  	bool
  1588.  	depends on PCI && 4xx
  1589. -	default n
  1590.  
  1591.  config PPC4xx_HSTA_MSI
  1592.  	bool
  1593.  	depends on PCI_MSI
  1594.  	depends on PCI && 4xx
  1595. -	default n
  1596.  
  1597.  config PPC4xx_MSI
  1598.  	bool
  1599.  	depends on PCI_MSI
  1600.  	depends on PCI && 4xx
  1601. -	default n
  1602.  
  1603.  config PPC_MSI_BITMAP
  1604.  	bool
  1605. @@ -37,11 +34,9 @@ config PPC_SCOM
  1606.  config SCOM_DEBUGFS
  1607.  	bool "Expose SCOM controllers via debugfs"
  1608.  	depends on PPC_SCOM && DEBUG_FS
  1609. -	default n
  1610.  
  1611.  config GE_FPGA
  1612.  	bool
  1613. -	default n
  1614.  
  1615.  config FSL_CORENET_RCPM
  1616.  	bool
  1617. diff --git arch/powerpc/sysdev/xive/Kconfig arch/powerpc/sysdev/xive/Kconfig
  1618. index 70ee976e1de0..785c292d104b 100644
  1619. --- linux-4.14.336/arch/powerpc/sysdev/xive/Kconfig
  1620. +++ linux-4.14.336/arch/powerpc/sysdev/xive/Kconfig
  1621. @@ -1,17 +1,14 @@
  1622.  # SPDX-License-Identifier: GPL-2.0
  1623.  config PPC_XIVE
  1624.  	bool
  1625. -	default n
  1626.  	select PPC_SMP_MUXED_IPI
  1627.  	select HARDIRQS_SW_RESEND
  1628.  
  1629.  config PPC_XIVE_NATIVE
  1630.  	bool
  1631. -	default n
  1632.  	select PPC_XIVE
  1633.  	depends on PPC_POWERNV
  1634.  
  1635.  config PPC_XIVE_SPAPR
  1636.  	bool
  1637. -	default n
  1638.  	select PPC_XIVE
  1639. diff --git arch/s390/kernel/ptrace.c arch/s390/kernel/ptrace.c
  1640. index 7c635e4328b8..60050ba8fa1d 100644
  1641. --- linux-4.14.336/arch/s390/kernel/ptrace.c
  1642. +++ linux-4.14.336/arch/s390/kernel/ptrace.c
  1643. @@ -411,6 +411,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
  1644.  		/*
  1645.  		 * floating point control reg. is in the thread structure
  1646.  		 */
  1647. +		save_fpu_regs();
  1648.  		if ((unsigned int) data != 0 ||
  1649.  		    test_fp_ctl(data >> (BITS_PER_LONG - 32)))
  1650.  			return -EINVAL;
  1651. @@ -771,6 +772,7 @@ static int __poke_user_compat(struct task_struct *child,
  1652.  		/*
  1653.  		 * floating point control reg. is in the thread structure
  1654.  		 */
  1655. +		save_fpu_regs();
  1656.  		if (test_fp_ctl(tmp))
  1657.  			return -EINVAL;
  1658.  		child->thread.fpu.fpc = data;
  1659. @@ -999,9 +1001,7 @@ static int s390_fpregs_set(struct task_struct *target,
  1660.  	int rc = 0;
  1661.  	freg_t fprs[__NUM_FPRS];
  1662.  
  1663. -	if (target == current)
  1664. -		save_fpu_regs();
  1665. -
  1666. +	save_fpu_regs();
  1667.  	if (MACHINE_HAS_VX)
  1668.  		convert_vx_to_fp(fprs, target->thread.fpu.vxrs);
  1669.  	else
  1670. diff --git arch/s390/kvm/kvm-s390.c arch/s390/kvm/kvm-s390.c
  1671. index 05bd51752845..ee822b451eb2 100644
  1672. --- linux-4.14.336/arch/s390/kvm/kvm-s390.c
  1673. +++ linux-4.14.336/arch/s390/kvm/kvm-s390.c
  1674. @@ -2788,8 +2788,6 @@ int kvm_arch_vcpu_ioctl_get_sregs(struct kvm_vcpu *vcpu,
  1675.  
  1676.  int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
  1677.  {
  1678. -	if (test_fp_ctl(fpu->fpc))
  1679. -		return -EINVAL;
  1680.  	vcpu->run->s.regs.fpc = fpu->fpc;
  1681.  	if (MACHINE_HAS_VX)
  1682.  		convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
  1683. diff --git arch/s390/pci/pci.c arch/s390/pci/pci.c
  1684. index 960c4a362d8c..cf6a0af76c8f 100644
  1685. --- linux-4.14.336/arch/s390/pci/pci.c
  1686. +++ linux-4.14.336/arch/s390/pci/pci.c
  1687. @@ -272,7 +272,7 @@ resource_size_t pcibios_align_resource(void *data, const struct resource *res,
  1688.  /* combine single writes by using store-block insn */
  1689.  void __iowrite64_copy(void __iomem *to, const void *from, size_t count)
  1690.  {
  1691. -       zpci_memcpy_toio(to, from, count);
  1692. +	zpci_memcpy_toio(to, from, count * 8);
  1693.  }
  1694.  
  1695.  /* Create a virtual mapping cookie for a PCI BAR */
  1696. diff --git arch/um/drivers/net_kern.c arch/um/drivers/net_kern.c
  1697. index 1669240c7a25..f107c9598127 100644
  1698. --- linux-4.14.336/arch/um/drivers/net_kern.c
  1699. +++ linux-4.14.336/arch/um/drivers/net_kern.c
  1700. @@ -207,7 +207,7 @@ static int uml_net_close(struct net_device *dev)
  1701.  	return 0;
  1702.  }
  1703.  
  1704. -static int uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
  1705. +static netdev_tx_t uml_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
  1706.  {
  1707.  	struct uml_net_private *lp = netdev_priv(dev);
  1708.  	unsigned long flags;
  1709. diff --git arch/um/include/shared/kern_util.h arch/um/include/shared/kern_util.h
  1710. index 35ab97e4bb9b..f2da8347d5f5 100644
  1711. --- linux-4.14.336/arch/um/include/shared/kern_util.h
  1712. +++ linux-4.14.336/arch/um/include/shared/kern_util.h
  1713. @@ -49,7 +49,7 @@ extern void do_uml_exitcalls(void);
  1714.   * Are we disallowed to sleep? Used to choose between GFP_KERNEL and
  1715.   * GFP_ATOMIC.
  1716.   */
  1717. -extern int __cant_sleep(void);
  1718. +extern int __uml_cant_sleep(void);
  1719.  extern int get_current_pid(void);
  1720.  extern int copy_from_user_proc(void *to, void *from, int size);
  1721.  extern int cpu(void);
  1722. diff --git arch/um/kernel/process.c arch/um/kernel/process.c
  1723. index 691b83b10649..c9d09d04d19d 100644
  1724. --- linux-4.14.336/arch/um/kernel/process.c
  1725. +++ linux-4.14.336/arch/um/kernel/process.c
  1726. @@ -210,7 +210,7 @@ void arch_cpu_idle(void)
  1727.  	local_irq_enable();
  1728.  }
  1729.  
  1730. -int __cant_sleep(void) {
  1731. +int __uml_cant_sleep(void) {
  1732.  	return in_atomic() || irqs_disabled() || in_interrupt();
  1733.  	/* Is in_interrupt() really needed? */
  1734.  }
  1735. diff --git arch/um/os-Linux/helper.c arch/um/os-Linux/helper.c
  1736. index 3f02d4232812..53d450e4a53a 100644
  1737. --- linux-4.14.336/arch/um/os-Linux/helper.c
  1738. +++ linux-4.14.336/arch/um/os-Linux/helper.c
  1739. @@ -45,7 +45,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
  1740.  	unsigned long stack, sp;
  1741.  	int pid, fds[2], ret, n;
  1742.  
  1743. -	stack = alloc_stack(0, __cant_sleep());
  1744. +	stack = alloc_stack(0, __uml_cant_sleep());
  1745.  	if (stack == 0)
  1746.  		return -ENOMEM;
  1747.  
  1748. @@ -69,7 +69,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv)
  1749.  	data.pre_data = pre_data;
  1750.  	data.argv = argv;
  1751.  	data.fd = fds[1];
  1752. -	data.buf = __cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
  1753. +	data.buf = __uml_cant_sleep() ? uml_kmalloc(PATH_MAX, UM_GFP_ATOMIC) :
  1754.  					uml_kmalloc(PATH_MAX, UM_GFP_KERNEL);
  1755.  	pid = clone(helper_child, (void *) sp, CLONE_VM, &data);
  1756.  	if (pid < 0) {
  1757. @@ -116,7 +116,7 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
  1758.  	unsigned long stack, sp;
  1759.  	int pid, status, err;
  1760.  
  1761. -	stack = alloc_stack(0, __cant_sleep());
  1762. +	stack = alloc_stack(0, __uml_cant_sleep());
  1763.  	if (stack == 0)
  1764.  		return -ENOMEM;
  1765.  
  1766. diff --git arch/um/os-Linux/util.c arch/um/os-Linux/util.c
  1767. index 8cc8b2617a67..0436cc9537e0 100644
  1768. --- linux-4.14.336/arch/um/os-Linux/util.c
  1769. +++ linux-4.14.336/arch/um/os-Linux/util.c
  1770. @@ -166,23 +166,38 @@ __uml_setup("quiet", quiet_cmd_param,
  1771.  "quiet\n"
  1772.  "    Turns off information messages during boot.\n\n");
  1773.  
  1774. +/*
  1775. + * The os_info/os_warn functions will be called by helper threads. These
  1776. + * have a very limited stack size and using the libc formatting functions
  1777. + * may overflow the stack.
  1778. + * So pull in the kernel vscnprintf and use that instead with a fixed
  1779. + * on-stack buffer.
  1780. + */
  1781. +int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
  1782. +
  1783.  void os_info(const char *fmt, ...)
  1784.  {
  1785. +	char buf[256];
  1786.  	va_list list;
  1787. +	int len;
  1788.  
  1789.  	if (quiet_info)
  1790.  		return;
  1791.  
  1792.  	va_start(list, fmt);
  1793. -	vfprintf(stderr, fmt, list);
  1794. +	len = vscnprintf(buf, sizeof(buf), fmt, list);
  1795. +	fwrite(buf, len, 1, stderr);
  1796.  	va_end(list);
  1797.  }
  1798.  
  1799.  void os_warn(const char *fmt, ...)
  1800.  {
  1801. +	char buf[256];
  1802.  	va_list list;
  1803. +	int len;
  1804.  
  1805.  	va_start(list, fmt);
  1806. -	vfprintf(stderr, fmt, list);
  1807. +	len = vscnprintf(buf, sizeof(buf), fmt, list);
  1808. +	fwrite(buf, len, 1, stderr);
  1809.  	va_end(list);
  1810.  }
  1811. diff --git arch/x86/kernel/cpu/amd.c arch/x86/kernel/cpu/amd.c
  1812. index 96305270c435..9ffb0cc5aa01 100644
  1813. --- linux-4.14.336/arch/x86/kernel/cpu/amd.c
  1814. +++ linux-4.14.336/arch/x86/kernel/cpu/amd.c
  1815. @@ -198,15 +198,6 @@ static void init_amd_k6(struct cpuinfo_x86 *c)
  1816.  		return;
  1817.  	}
  1818.  #endif
  1819. -	/*
  1820. -	 * Work around Erratum 1386.  The XSAVES instruction malfunctions in
  1821. -	 * certain circumstances on Zen1/2 uarch, and not all parts have had
  1822. -	 * updated microcode at the time of writing (March 2023).
  1823. -	 *
  1824. -	 * Affected parts all have no supervisor XSAVE states, meaning that
  1825. -	 * the XSAVEC instruction (which works fine) is equivalent.
  1826. -	 */
  1827. -	clear_cpu_cap(c, X86_FEATURE_XSAVES);
  1828.  }
  1829.  
  1830.  static void init_amd_k7(struct cpuinfo_x86 *c)
  1831. @@ -880,6 +871,17 @@ static void init_amd_zn(struct cpuinfo_x86 *c)
  1832.  		if (c->x86 == 0x19 && !cpu_has(c, X86_FEATURE_BTC_NO))
  1833.  			set_cpu_cap(c, X86_FEATURE_BTC_NO);
  1834.  	}
  1835. +
  1836. +	/*
  1837. +	 * Work around Erratum 1386.  The XSAVES instruction malfunctions in
  1838. +	 * certain circumstances on Zen1/2 uarch, and not all parts have had
  1839. +	 * updated microcode at the time of writing (March 2023).
  1840. +	 *
  1841. +	 * Affected parts all have no supervisor XSAVE states, meaning that
  1842. +	 * the XSAVEC instruction (which works fine) is equivalent.
  1843. +	 */
  1844. +	if (c->x86 == 0x17)
  1845. +		clear_cpu_cap(c, X86_FEATURE_XSAVES);
  1846.  }
  1847.  
  1848.  static void init_amd(struct cpuinfo_x86 *c)
  1849. diff --git arch/x86/lib/misc.c arch/x86/lib/misc.c
  1850. index a018ec4fba53..c97be9a1430a 100644
  1851. --- linux-4.14.336/arch/x86/lib/misc.c
  1852. +++ linux-4.14.336/arch/x86/lib/misc.c
  1853. @@ -6,7 +6,7 @@
  1854.   */
  1855.  int num_digits(int val)
  1856.  {
  1857. -	int m = 10;
  1858. +	long long m = 10;
  1859.  	int d = 1;
  1860.  
  1861.  	if (val < 0) {
  1862. diff --git arch/x86/mm/ident_map.c arch/x86/mm/ident_map.c
  1863. index 407fa1df470e..50c537a4554b 100644
  1864. --- linux-4.14.336/arch/x86/mm/ident_map.c
  1865. +++ linux-4.14.336/arch/x86/mm/ident_map.c
  1866. @@ -26,18 +26,31 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
  1867.  	for (; addr < end; addr = next) {
  1868.  		pud_t *pud = pud_page + pud_index(addr);
  1869.  		pmd_t *pmd;
  1870. +		bool use_gbpage;
  1871.  
  1872.  		next = (addr & PUD_MASK) + PUD_SIZE;
  1873.  		if (next > end)
  1874.  			next = end;
  1875.  
  1876. -		if (info->direct_gbpages) {
  1877. -			pud_t pudval;
  1878. +		/* if this is already a gbpage, this portion is already mapped */
  1879. +		if (pud_large(*pud))
  1880. +			continue;
  1881. +
  1882. +		/* Is using a gbpage allowed? */
  1883. +		use_gbpage = info->direct_gbpages;
  1884.  
  1885. -			if (pud_present(*pud))
  1886. -				continue;
  1887. +		/* Don't use gbpage if it maps more than the requested region. */
  1888. +		/* at the begining: */
  1889. +		use_gbpage &= ((addr & ~PUD_MASK) == 0);
  1890. +		/* ... or at the end: */
  1891. +		use_gbpage &= ((next & ~PUD_MASK) == 0);
  1892. +
  1893. +		/* Never overwrite existing mappings */
  1894. +		use_gbpage &= !pud_present(*pud);
  1895. +
  1896. +		if (use_gbpage) {
  1897. +			pud_t pudval;
  1898.  
  1899. -			addr &= PUD_MASK;
  1900.  			pudval = __pud((addr - info->offset) | info->page_flag);
  1901.  			set_pud(pud, pudval);
  1902.  			continue;
  1903. diff --git block/bio.c block/bio.c
  1904. index 1eaf31976702..28e288243266 100644
  1905. --- linux-4.14.336/block/bio.c
  1906. +++ linux-4.14.336/block/bio.c
  1907. @@ -1723,7 +1723,7 @@ void bio_set_pages_dirty(struct bio *bio)
  1908.  	bio_for_each_segment_all(bvec, bio, i) {
  1909.  		struct page *page = bvec->bv_page;
  1910.  
  1911. -		if (page && !PageCompound(page))
  1912. +		if (page)
  1913.  			set_page_dirty_lock(page);
  1914.  	}
  1915.  }
  1916. @@ -1790,7 +1790,7 @@ void bio_check_pages_dirty(struct bio *bio)
  1917.  	bio_for_each_segment_all(bvec, bio, i) {
  1918.  		struct page *page = bvec->bv_page;
  1919.  
  1920. -		if (PageDirty(page) || PageCompound(page)) {
  1921. +		if (PageDirty(page)) {
  1922.  			put_page(page);
  1923.  			bvec->bv_page = NULL;
  1924.  		} else {
  1925. diff --git crypto/af_alg.c crypto/af_alg.c
  1926. index da000a256e91..24de37ac9d27 100644
  1927. --- linux-4.14.336/crypto/af_alg.c
  1928. +++ linux-4.14.336/crypto/af_alg.c
  1929. @@ -1060,9 +1060,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);
  1930.  void af_alg_free_resources(struct af_alg_async_req *areq)
  1931.  {
  1932.  	struct sock *sk = areq->sk;
  1933. +	struct af_alg_ctx *ctx;
  1934.  
  1935.  	af_alg_free_areq_sgls(areq);
  1936.  	sock_kfree_s(sk, areq, areq->areqlen);
  1937. +
  1938. +	ctx = alg_sk(sk)->private;
  1939. +	ctx->inflight = false;
  1940.  }
  1941.  EXPORT_SYMBOL_GPL(af_alg_free_resources);
  1942.  
  1943. @@ -1126,11 +1130,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);
  1944.  struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
  1945.  					   unsigned int areqlen)
  1946.  {
  1947. -	struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
  1948. +	struct af_alg_ctx *ctx = alg_sk(sk)->private;
  1949. +	struct af_alg_async_req *areq;
  1950. +
  1951. +	/* Only one AIO request can be in flight. */
  1952. +	if (ctx->inflight)
  1953. +		return ERR_PTR(-EBUSY);
  1954.  
  1955. +	areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
  1956.  	if (unlikely(!areq))
  1957.  		return ERR_PTR(-ENOMEM);
  1958.  
  1959. +	ctx->inflight = true;
  1960. +
  1961.  	areq->areqlen = areqlen;
  1962.  	areq->sk = sk;
  1963.  	areq->last_rsgl = NULL;
  1964. diff --git crypto/algapi.c crypto/algapi.c
  1965. index 603d2d637209..8557aff7fb35 100644
  1966. --- linux-4.14.336/crypto/algapi.c
  1967. +++ linux-4.14.336/crypto/algapi.c
  1968. @@ -222,6 +222,7 @@ static struct crypto_larval *__crypto_register_alg(struct crypto_alg *alg)
  1969.  		}
  1970.  
  1971.  		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
  1972. +		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
  1973.  		    !strcmp(q->cra_name, alg->cra_driver_name))
  1974.  			goto err;
  1975.  	}
  1976. diff --git crypto/scompress.c crypto/scompress.c
  1977. index 2075e2c4e7df..9baaf49f16bb 100644
  1978. --- linux-4.14.336/crypto/scompress.c
  1979. +++ linux-4.14.336/crypto/scompress.c
  1980. @@ -29,9 +29,17 @@
  1981.  #include <crypto/internal/scompress.h>
  1982.  #include "internal.h"
  1983.  
  1984. +struct scomp_scratch {
  1985. +	spinlock_t	lock;
  1986. +	void		*src;
  1987. +	void		*dst;
  1988. +};
  1989. +
  1990. +static DEFINE_PER_CPU(struct scomp_scratch, scomp_scratch) = {
  1991. +	.lock = __SPIN_LOCK_UNLOCKED(scomp_scratch.lock),
  1992. +};
  1993. +
  1994.  static const struct crypto_type crypto_scomp_type;
  1995. -static void * __percpu *scomp_src_scratches;
  1996. -static void * __percpu *scomp_dst_scratches;
  1997.  static int scomp_scratch_users;
  1998.  static DEFINE_MUTEX(scomp_lock);
  1999.  
  2000. @@ -65,76 +73,53 @@ static void crypto_scomp_show(struct seq_file *m, struct crypto_alg *alg)
  2001.  	seq_puts(m, "type         : scomp\n");
  2002.  }
  2003.  
  2004. -static void crypto_scomp_free_scratches(void * __percpu *scratches)
  2005. +static void crypto_scomp_free_scratches(void)
  2006.  {
  2007. +	struct scomp_scratch *scratch;
  2008.  	int i;
  2009.  
  2010. -	if (!scratches)
  2011. -		return;
  2012. -
  2013. -	for_each_possible_cpu(i)
  2014. -		vfree(*per_cpu_ptr(scratches, i));
  2015. +	for_each_possible_cpu(i) {
  2016. +		scratch = per_cpu_ptr(&scomp_scratch, i);
  2017.  
  2018. -	free_percpu(scratches);
  2019. +		vfree(scratch->src);
  2020. +		vfree(scratch->dst);
  2021. +		scratch->src = NULL;
  2022. +		scratch->dst = NULL;
  2023. +	}
  2024.  }
  2025.  
  2026. -static void * __percpu *crypto_scomp_alloc_scratches(void)
  2027. +static int crypto_scomp_alloc_scratches(void)
  2028.  {
  2029. -	void * __percpu *scratches;
  2030. +	struct scomp_scratch *scratch;
  2031.  	int i;
  2032.  
  2033. -	scratches = alloc_percpu(void *);
  2034. -	if (!scratches)
  2035. -		return NULL;
  2036. -
  2037.  	for_each_possible_cpu(i) {
  2038. -		void *scratch;
  2039. -
  2040. -		scratch = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
  2041. -		if (!scratch)
  2042. -			goto error;
  2043. -		*per_cpu_ptr(scratches, i) = scratch;
  2044. -	}
  2045. +		void *mem;
  2046.  
  2047. -	return scratches;
  2048. +		scratch = per_cpu_ptr(&scomp_scratch, i);
  2049.  
  2050. -error:
  2051. -	crypto_scomp_free_scratches(scratches);
  2052. -	return NULL;
  2053. -}
  2054. -
  2055. -static void crypto_scomp_free_all_scratches(void)
  2056. -{
  2057. -	if (!--scomp_scratch_users) {
  2058. -		crypto_scomp_free_scratches(scomp_src_scratches);
  2059. -		crypto_scomp_free_scratches(scomp_dst_scratches);
  2060. -		scomp_src_scratches = NULL;
  2061. -		scomp_dst_scratches = NULL;
  2062. -	}
  2063. -}
  2064. -
  2065. -static int crypto_scomp_alloc_all_scratches(void)
  2066. -{
  2067. -	if (!scomp_scratch_users++) {
  2068. -		scomp_src_scratches = crypto_scomp_alloc_scratches();
  2069. -		if (!scomp_src_scratches)
  2070. -			return -ENOMEM;
  2071. -		scomp_dst_scratches = crypto_scomp_alloc_scratches();
  2072. -		if (!scomp_dst_scratches) {
  2073. -			crypto_scomp_free_scratches(scomp_src_scratches);
  2074. -			scomp_src_scratches = NULL;
  2075. -			return -ENOMEM;
  2076. -		}
  2077. +		mem = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
  2078. +		if (!mem)
  2079. +			goto error;
  2080. +		scratch->src = mem;
  2081. +		mem = vmalloc_node(SCOMP_SCRATCH_SIZE, cpu_to_node(i));
  2082. +		if (!mem)
  2083. +			goto error;
  2084. +		scratch->dst = mem;
  2085.  	}
  2086.  	return 0;
  2087. +error:
  2088. +	crypto_scomp_free_scratches();
  2089. +	return -ENOMEM;
  2090.  }
  2091.  
  2092.  static int crypto_scomp_init_tfm(struct crypto_tfm *tfm)
  2093.  {
  2094. -	int ret;
  2095. +	int ret = 0;
  2096.  
  2097.  	mutex_lock(&scomp_lock);
  2098. -	ret = crypto_scomp_alloc_all_scratches();
  2099. +	if (!scomp_scratch_users++)
  2100. +		ret = crypto_scomp_alloc_scratches();
  2101.  	mutex_unlock(&scomp_lock);
  2102.  
  2103.  	return ret;
  2104. @@ -193,42 +178,47 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
  2105.  	void **tfm_ctx = acomp_tfm_ctx(tfm);
  2106.  	struct crypto_scomp *scomp = *tfm_ctx;
  2107.  	void **ctx = acomp_request_ctx(req);
  2108. -	const int cpu = get_cpu();
  2109. -	u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu);
  2110. -	u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu);
  2111. +	struct scomp_scratch *scratch;
  2112. +	unsigned int dlen;
  2113.  	int ret;
  2114.  
  2115. -	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) {
  2116. -		ret = -EINVAL;
  2117. -		goto out;
  2118. -	}
  2119. +	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
  2120. +		return -EINVAL;
  2121.  
  2122. -	if (req->dst && !req->dlen) {
  2123. -		ret = -EINVAL;
  2124. -		goto out;
  2125. -	}
  2126. +	if (req->dst && !req->dlen)
  2127. +		return -EINVAL;
  2128.  
  2129.  	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)
  2130.  		req->dlen = SCOMP_SCRATCH_SIZE;
  2131.  
  2132. -	scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0);
  2133. +	dlen = req->dlen;
  2134. +
  2135. +	scratch = raw_cpu_ptr(&scomp_scratch);
  2136. +	spin_lock(&scratch->lock);
  2137. +
  2138. +	scatterwalk_map_and_copy(scratch->src, req->src, 0, req->slen, 0);
  2139.  	if (dir)
  2140. -		ret = crypto_scomp_compress(scomp, scratch_src, req->slen,
  2141. -					    scratch_dst, &req->dlen, *ctx);
  2142. +		ret = crypto_scomp_compress(scomp, scratch->src, req->slen,
  2143. +					    scratch->dst, &req->dlen, *ctx);
  2144.  	else
  2145. -		ret = crypto_scomp_decompress(scomp, scratch_src, req->slen,
  2146. -					      scratch_dst, &req->dlen, *ctx);
  2147. +		ret = crypto_scomp_decompress(scomp, scratch->src, req->slen,
  2148. +					      scratch->dst, &req->dlen, *ctx);
  2149.  	if (!ret) {
  2150.  		if (!req->dst) {
  2151.  			req->dst = crypto_scomp_sg_alloc(req->dlen, GFP_ATOMIC);
  2152. -			if (!req->dst)
  2153. +			if (!req->dst) {
  2154. +				ret = -ENOMEM;
  2155.  				goto out;
  2156. +			}
  2157. +		} else if (req->dlen > dlen) {
  2158. +			ret = -ENOSPC;
  2159. +			goto out;
  2160.  		}
  2161. -		scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen,
  2162. +		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,
  2163.  					 1);
  2164.  	}
  2165.  out:
  2166. -	put_cpu();
  2167. +	spin_unlock(&scratch->lock);
  2168.  	return ret;
  2169.  }
  2170.  
  2171. @@ -249,7 +239,8 @@ static void crypto_exit_scomp_ops_async(struct crypto_tfm *tfm)
  2172.  	crypto_free_scomp(*ctx);
  2173.  
  2174.  	mutex_lock(&scomp_lock);
  2175. -	crypto_scomp_free_all_scratches();
  2176. +	if (!--scomp_scratch_users)
  2177. +		crypto_scomp_free_scratches();
  2178.  	mutex_unlock(&scomp_lock);
  2179.  }
  2180.  
  2181. diff --git drivers/acpi/acpi_extlog.c drivers/acpi/acpi_extlog.c
  2182. index e05309bc41cc..e148b0a28ec9 100644
  2183. --- linux-4.14.336/drivers/acpi/acpi_extlog.c
  2184. +++ linux-4.14.336/drivers/acpi/acpi_extlog.c
  2185. @@ -317,9 +317,10 @@ static void __exit extlog_exit(void)
  2186.  {
  2187.  	edac_set_report_status(old_edac_report_status);
  2188.  	mce_unregister_decode_chain(&extlog_mce_dec);
  2189. -	((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
  2190. -	if (extlog_l1_addr)
  2191. +	if (extlog_l1_addr) {
  2192. +		((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
  2193.  		acpi_os_unmap_iomem(extlog_l1_addr, l1_size);
  2194. +	}
  2195.  	if (elog_addr)
  2196.  		acpi_os_unmap_iomem(elog_addr, elog_size);
  2197.  	release_mem_region(elog_base, elog_size);
  2198. diff --git drivers/acpi/acpi_video.c drivers/acpi/acpi_video.c
  2199. index cc228e5ad2b3..d426ece23a70 100644
  2200. --- linux-4.14.336/drivers/acpi/acpi_video.c
  2201. +++ linux-4.14.336/drivers/acpi/acpi_video.c
  2202. @@ -581,6 +581,15 @@ static const struct dmi_system_id video_dmi_table[] = {
  2203.  		DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"),
  2204.  		},
  2205.  	},
  2206. +	{
  2207. +	 .callback = video_set_report_key_events,
  2208. +	 .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS),
  2209. +	 .ident = "COLORFUL X15 AT 23",
  2210. +	 .matches = {
  2211. +		DMI_MATCH(DMI_SYS_VENDOR, "COLORFUL"),
  2212. +		DMI_MATCH(DMI_PRODUCT_NAME, "X15 AT 23"),
  2213. +		},
  2214. +	},
  2215.  	/*
  2216.  	 * Some machines change the brightness themselves when a brightness
  2217.  	 * hotkey gets pressed, despite us telling them not to. In this case
  2218. @@ -1796,12 +1805,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
  2219.  		return;
  2220.  	count++;
  2221.  
  2222. -	acpi_get_parent(device->dev->handle, &acpi_parent);
  2223. -
  2224. -	pdev = acpi_get_pci_dev(acpi_parent);
  2225. -	if (pdev) {
  2226. -		parent = &pdev->dev;
  2227. -		pci_dev_put(pdev);
  2228. +	if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) {
  2229. +		pdev = acpi_get_pci_dev(acpi_parent);
  2230. +		if (pdev) {
  2231. +			parent = &pdev->dev;
  2232. +			pci_dev_put(pdev);
  2233. +		}
  2234.  	}
  2235.  
  2236.  	memset(&props, 0, sizeof(struct backlight_properties));
  2237. diff --git drivers/android/binder_alloc.c drivers/android/binder_alloc.c
  2238. index f7f0b71c9f68..08f31fa30648 100644
  2239. --- linux-4.14.336/drivers/android/binder_alloc.c
  2240. +++ linux-4.14.336/drivers/android/binder_alloc.c
  2241. @@ -284,7 +284,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
  2242.  	}
  2243.  	if (mm) {
  2244.  		up_write(&mm->mmap_sem);
  2245. -		mmput(mm);
  2246. +		mmput_async(mm);
  2247.  	}
  2248.  	return 0;
  2249.  
  2250. @@ -319,7 +319,7 @@ err_page_ptr_cleared:
  2251.  err_no_vma:
  2252.  	if (mm) {
  2253.  		up_write(&mm->mmap_sem);
  2254. -		mmput(mm);
  2255. +		mmput_async(mm);
  2256.  	}
  2257.  	return vma ? -ENOMEM : -ESRCH;
  2258.  }
  2259. @@ -389,17 +389,17 @@ struct binder_buffer *binder_alloc_new_buf_locked(struct binder_alloc *alloc,
  2260.  				alloc->pid, extra_buffers_size);
  2261.  		return ERR_PTR(-EINVAL);
  2262.  	}
  2263. -	if (is_async &&
  2264. -	    alloc->free_async_space < size + sizeof(struct binder_buffer)) {
  2265. +
  2266. +	/* Pad 0-size buffers so they get assigned unique addresses */
  2267. +	size = max(size, sizeof(void *));
  2268. +
  2269. +	if (is_async && alloc->free_async_space < size) {
  2270.  		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
  2271.  			     "%d: binder_alloc_buf size %zd failed, no async space left\n",
  2272.  			      alloc->pid, size);
  2273.  		return ERR_PTR(-ENOSPC);
  2274.  	}
  2275.  
  2276. -	/* Pad 0-size buffers so they get assigned unique addresses */
  2277. -	size = max(size, sizeof(void *));
  2278. -
  2279.  	while (n) {
  2280.  		buffer = rb_entry(n, struct binder_buffer, rb_node);
  2281.  		BUG_ON(!buffer->free);
  2282. @@ -496,7 +496,7 @@ struct binder_buffer *binder_alloc_new_buf_locked(struct binder_alloc *alloc,
  2283.  	buffer->async_transaction = is_async;
  2284.  	buffer->extra_buffers_size = extra_buffers_size;
  2285.  	if (is_async) {
  2286. -		alloc->free_async_space -= size + sizeof(struct binder_buffer);
  2287. +		alloc->free_async_space -= size;
  2288.  		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
  2289.  			     "%d: binder_alloc_buf size %zd async free %zd\n",
  2290.  			      alloc->pid, size, alloc->free_async_space);
  2291. @@ -523,7 +523,7 @@ err_alloc_buf_struct_failed:
  2292.   * is the sum of the three given sizes (each rounded up to
  2293.   * pointer-sized boundary)
  2294.   *
  2295. - * Return:	The allocated buffer or %NULL if error
  2296. + * Return:	The allocated buffer or %ERR_PTR(-errno) if error
  2297.   */
  2298.  struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
  2299.  					   size_t data_size,
  2300. @@ -619,8 +619,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
  2301.  	BUG_ON(buffer->data > alloc->buffer + alloc->buffer_size);
  2302.  
  2303.  	if (buffer->async_transaction) {
  2304. -		alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
  2305. -
  2306. +		alloc->free_async_space += buffer_size;
  2307.  		binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
  2308.  			     "%d: binder_free_buf size %zd async free %zd\n",
  2309.  			      alloc->pid, size, alloc->free_async_space);
  2310. diff --git drivers/ata/ahci.c drivers/ata/ahci.c
  2311. index 5b810a290b93..c2e5ef709acb 100644
  2312. --- linux-4.14.336/drivers/ata/ahci.c
  2313. +++ linux-4.14.336/drivers/ata/ahci.c
  2314. @@ -605,6 +605,11 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
  2315.  static void ahci_pci_save_initial_config(struct pci_dev *pdev,
  2316.  					 struct ahci_host_priv *hpriv)
  2317.  {
  2318. +	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && pdev->device == 0x1166) {
  2319. +		dev_info(&pdev->dev, "ASM1166 has only six ports\n");
  2320. +		hpriv->saved_port_map = 0x3f;
  2321. +	}
  2322. +
  2323.  	if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
  2324.  		dev_info(&pdev->dev, "JMB361 has only one port\n");
  2325.  		hpriv->force_port_map = 1;
  2326. diff --git drivers/atm/idt77252.c drivers/atm/idt77252.c
  2327. index e7a6b4903f9c..c777973f0ff3 100644
  2328. --- linux-4.14.336/drivers/atm/idt77252.c
  2329. +++ linux-4.14.336/drivers/atm/idt77252.c
  2330. @@ -2933,6 +2933,8 @@ open_card_ubr0(struct idt77252_dev *card)
  2331.  	vc->scq = alloc_scq(card, vc->class);
  2332.  	if (!vc->scq) {
  2333.  		printk("%s: can't get SCQ.\n", card->name);
  2334. +		kfree(card->vcs[0]);
  2335. +		card->vcs[0] = NULL;
  2336.  		return -ENOMEM;
  2337.  	}
  2338.  
  2339. diff --git drivers/base/core.c drivers/base/core.c
  2340. index e834087448a4..4f1ac622df06 100644
  2341. --- linux-4.14.336/drivers/base/core.c
  2342. +++ linux-4.14.336/drivers/base/core.c
  2343. @@ -3075,6 +3075,50 @@ define_dev_printk_level(_dev_info, KERN_INFO);
  2344.  
  2345.  #endif
  2346.  
  2347. +/**
  2348. + * dev_err_probe - probe error check and log helper
  2349. + * @dev: the pointer to the struct device
  2350. + * @err: error value to test
  2351. + * @fmt: printf-style format string
  2352. + * @...: arguments as specified in the format string
  2353. + *
  2354. + * This helper implements common pattern present in probe functions for error
  2355. + * checking: print debug or error message depending if the error value is
  2356. + * -EPROBE_DEFER and propagate error upwards.
  2357. + * It replaces code sequence::
  2358. + * 	if (err != -EPROBE_DEFER)
  2359. + * 		dev_err(dev, ...);
  2360. + * 	else
  2361. + * 		dev_dbg(dev, ...);
  2362. + * 	return err;
  2363. + *
  2364. + * with::
  2365. + *
  2366. + * 	return dev_err_probe(dev, err, ...);
  2367. + *
  2368. + * Returns @err.
  2369. + *
  2370. + */
  2371. +int dev_err_probe(const struct device *dev, int err, const char *fmt, ...)
  2372. +{
  2373. +	struct va_format vaf;
  2374. +	va_list args;
  2375. +
  2376. +	va_start(args, fmt);
  2377. +	vaf.fmt = fmt;
  2378. +	vaf.va = &args;
  2379. +
  2380. +	if (err != -EPROBE_DEFER)
  2381. +		dev_err(dev, "error %pe: %pV", ERR_PTR(err), &vaf);
  2382. +	else
  2383. +		dev_dbg(dev, "error %pe: %pV", ERR_PTR(err), &vaf);
  2384. +
  2385. +	va_end(args);
  2386. +
  2387. +	return err;
  2388. +}
  2389. +EXPORT_SYMBOL_GPL(dev_err_probe);
  2390. +
  2391.  static inline bool fwnode_is_primary(struct fwnode_handle *fwnode)
  2392.  {
  2393.  	return fwnode && !IS_ERR(fwnode->secondary);
  2394. diff --git drivers/base/power/domain.c drivers/base/power/domain.c
  2395. index 0f38df5856e1..a469fb4badf2 100644
  2396. --- linux-4.14.336/drivers/base/power/domain.c
  2397. +++ linux-4.14.336/drivers/base/power/domain.c
  2398. @@ -749,7 +749,7 @@ static int __init genpd_power_off_unused(void)
  2399.  
  2400.  	return 0;
  2401.  }
  2402. -late_initcall(genpd_power_off_unused);
  2403. +late_initcall_sync(genpd_power_off_unused);
  2404.  
  2405.  #if defined(CONFIG_PM_SLEEP) || defined(CONFIG_PM_GENERIC_DOMAINS_OF)
  2406.  
  2407. diff --git drivers/block/virtio_blk.c drivers/block/virtio_blk.c
  2408. index 7e8f58c2f65b..2d3484a83fd7 100644
  2409. --- linux-4.14.336/drivers/block/virtio_blk.c
  2410. +++ linux-4.14.336/drivers/block/virtio_blk.c
  2411. @@ -930,14 +930,15 @@ static int virtblk_freeze(struct virtio_device *vdev)
  2412.  {
  2413.  	struct virtio_blk *vblk = vdev->priv;
  2414.  
  2415. +	/* Ensure no requests in virtqueues before deleting vqs. */
  2416. +	blk_mq_freeze_queue(vblk->disk->queue);
  2417. +
  2418.  	/* Ensure we don't receive any more interrupts */
  2419.  	vdev->config->reset(vdev);
  2420.  
  2421.  	/* Make sure no work handler is accessing the device. */
  2422.  	flush_work(&vblk->config_work);
  2423.  
  2424. -	blk_mq_quiesce_queue(vblk->disk->queue);
  2425. -
  2426.  	vdev->config->del_vqs(vdev);
  2427.  	kfree(vblk->vqs);
  2428.  
  2429. @@ -955,7 +956,7 @@ static int virtblk_restore(struct virtio_device *vdev)
  2430.  
  2431.  	virtio_device_ready(vdev);
  2432.  
  2433. -	blk_mq_unquiesce_queue(vblk->disk->queue);
  2434. +	blk_mq_unfreeze_queue(vblk->disk->queue);
  2435.  	return 0;
  2436.  }
  2437.  #endif
  2438. diff --git drivers/char/hw_random/core.c drivers/char/hw_random/core.c
  2439. index 303fd55f9be0..a12561fdd2f0 100644
  2440. --- linux-4.14.336/drivers/char/hw_random/core.c
  2441. +++ linux-4.14.336/drivers/char/hw_random/core.c
  2442. @@ -24,10 +24,13 @@
  2443.  #include <linux/random.h>
  2444.  #include <linux/sched.h>
  2445.  #include <linux/slab.h>
  2446. +#include <linux/string.h>
  2447.  #include <linux/uaccess.h>
  2448.  
  2449.  #define RNG_MODULE_NAME		"hw_random"
  2450.  
  2451. +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES)
  2452. +
  2453.  static struct hwrng *current_rng;
  2454.  /* the current rng has been explicitly chosen by user via sysfs */
  2455.  static int cur_rng_set_by_user;
  2456. @@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
  2457.  
  2458.  static size_t rng_buffer_size(void)
  2459.  {
  2460. -	return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
  2461. +	return RNG_BUFFER_SIZE;
  2462.  }
  2463.  
  2464.  static void add_early_randomness(struct hwrng *rng)
  2465. @@ -202,6 +205,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size,
  2466.  static ssize_t rng_dev_read(struct file *filp, char __user *buf,
  2467.  			    size_t size, loff_t *offp)
  2468.  {
  2469. +	u8 buffer[RNG_BUFFER_SIZE];
  2470.  	ssize_t ret = 0;
  2471.  	int err = 0;
  2472.  	int bytes_read, len;
  2473. @@ -229,34 +233,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
  2474.  			if (bytes_read < 0) {
  2475.  				err = bytes_read;
  2476.  				goto out_unlock_reading;
  2477. +			} else if (bytes_read == 0 &&
  2478. +				   (filp->f_flags & O_NONBLOCK)) {
  2479. +				err = -EAGAIN;
  2480. +				goto out_unlock_reading;
  2481.  			}
  2482. +
  2483.  			data_avail = bytes_read;
  2484.  		}
  2485.  
  2486. -		if (!data_avail) {
  2487. -			if (filp->f_flags & O_NONBLOCK) {
  2488. -				err = -EAGAIN;
  2489. -				goto out_unlock_reading;
  2490. -			}
  2491. -		} else {
  2492. -			len = data_avail;
  2493. +		len = data_avail;
  2494. +		if (len) {
  2495.  			if (len > size)
  2496.  				len = size;
  2497.  
  2498.  			data_avail -= len;
  2499.  
  2500. -			if (copy_to_user(buf + ret, rng_buffer + data_avail,
  2501. -								len)) {
  2502. +			memcpy(buffer, rng_buffer + data_avail, len);
  2503. +		}
  2504. +		mutex_unlock(&reading_mutex);
  2505. +		put_rng(rng);
  2506. +
  2507. +		if (len) {
  2508. +			if (copy_to_user(buf + ret, buffer, len)) {
  2509.  				err = -EFAULT;
  2510. -				goto out_unlock_reading;
  2511. +				goto out;
  2512.  			}
  2513.  
  2514.  			size -= len;
  2515.  			ret += len;
  2516.  		}
  2517.  
  2518. -		mutex_unlock(&reading_mutex);
  2519. -		put_rng(rng);
  2520.  
  2521.  		if (need_resched())
  2522.  			schedule_timeout_interruptible(1);
  2523. @@ -267,6 +274,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
  2524.  		}
  2525.  	}
  2526.  out:
  2527. +	memzero_explicit(buffer, sizeof(buffer));
  2528.  	return ret ? : err;
  2529.  
  2530.  out_unlock_reading:
  2531. diff --git drivers/clk/hisilicon/clk-hi3620.c drivers/clk/hisilicon/clk-hi3620.c
  2532. index fa0fba653898..7f49c7067028 100644
  2533. --- linux-4.14.336/drivers/clk/hisilicon/clk-hi3620.c
  2534. +++ linux-4.14.336/drivers/clk/hisilicon/clk-hi3620.c
  2535. @@ -481,8 +481,10 @@ static void __init hi3620_mmc_clk_init(struct device_node *node)
  2536.  		return;
  2537.  
  2538.  	clk_data->clks = kcalloc(num, sizeof(*clk_data->clks), GFP_KERNEL);
  2539. -	if (!clk_data->clks)
  2540. +	if (!clk_data->clks) {
  2541. +		kfree(clk_data);
  2542.  		return;
  2543. +	}
  2544.  
  2545.  	for (i = 0; i < num; i++) {
  2546.  		struct hisi_mmc_clock *mmc_clk = &hi3620_mmc_clks[i];
  2547. diff --git drivers/clk/mmp/clk-of-pxa168.c drivers/clk/mmp/clk-of-pxa168.c
  2548. index f110c02e83cb..9674c6c06dca 100644
  2549. --- linux-4.14.336/drivers/clk/mmp/clk-of-pxa168.c
  2550. +++ linux-4.14.336/drivers/clk/mmp/clk-of-pxa168.c
  2551. @@ -258,18 +258,21 @@ static void __init pxa168_clk_init(struct device_node *np)
  2552.  	pxa_unit->mpmu_base = of_iomap(np, 0);
  2553.  	if (!pxa_unit->mpmu_base) {
  2554.  		pr_err("failed to map mpmu registers\n");
  2555. +		kfree(pxa_unit);
  2556.  		return;
  2557.  	}
  2558.  
  2559.  	pxa_unit->apmu_base = of_iomap(np, 1);
  2560.  	if (!pxa_unit->apmu_base) {
  2561.  		pr_err("failed to map apmu registers\n");
  2562. +		kfree(pxa_unit);
  2563.  		return;
  2564.  	}
  2565.  
  2566.  	pxa_unit->apbc_base = of_iomap(np, 2);
  2567.  	if (!pxa_unit->apbc_base) {
  2568.  		pr_err("failed to map apbc registers\n");
  2569. +		kfree(pxa_unit);
  2570.  		return;
  2571.  	}
  2572.  
  2573. diff --git drivers/clk/rockchip/clk-rk3128.c drivers/clk/rockchip/clk-rk3128.c
  2574. index 5970a50671b9..83c7eb18321f 100644
  2575. --- linux-4.14.336/drivers/clk/rockchip/clk-rk3128.c
  2576. +++ linux-4.14.336/drivers/clk/rockchip/clk-rk3128.c
  2577. @@ -497,7 +497,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
  2578.  	GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS),
  2579.  	GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS),
  2580.  	GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS),
  2581. -	GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS),
  2582. +	GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS),
  2583.  	GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS),
  2584.  	GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS),
  2585.  	GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS),
  2586. diff --git drivers/crypto/ccp/ccp-ops.c drivers/crypto/ccp/ccp-ops.c
  2587. index 453d27d2a4ff..56c571370486 100644
  2588. --- linux-4.14.336/drivers/crypto/ccp/ccp-ops.c
  2589. +++ linux-4.14.336/drivers/crypto/ccp/ccp-ops.c
  2590. @@ -183,8 +183,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa,
  2591.  
  2592.  		wa->dma.address = dma_map_single(wa->dev, wa->address, len,
  2593.  						 dir);
  2594. -		if (dma_mapping_error(wa->dev, wa->dma.address))
  2595. +		if (dma_mapping_error(wa->dev, wa->dma.address)) {
  2596. +			kfree(wa->address);
  2597. +			wa->address = NULL;
  2598.  			return -ENOMEM;
  2599. +		}
  2600.  
  2601.  		wa->dma.length = len;
  2602.  	}
  2603. diff --git drivers/crypto/sahara.c drivers/crypto/sahara.c
  2604. index 085c229eab1d..fdc9db6c0d5e 100644
  2605. --- linux-4.14.336/drivers/crypto/sahara.c
  2606. +++ linux-4.14.336/drivers/crypto/sahara.c
  2607. @@ -46,7 +46,6 @@
  2608.  #define FLAGS_MODE_MASK		0x000f
  2609.  #define FLAGS_ENCRYPT		BIT(0)
  2610.  #define FLAGS_CBC		BIT(1)
  2611. -#define FLAGS_NEW_KEY		BIT(3)
  2612.  
  2613.  #define SAHARA_HDR_BASE			0x00800000
  2614.  #define SAHARA_HDR_SKHA_ALG_AES	0
  2615. @@ -144,8 +143,6 @@ struct sahara_hw_link {
  2616.  };
  2617.  
  2618.  struct sahara_ctx {
  2619. -	unsigned long flags;
  2620. -
  2621.  	/* AES-specific context */
  2622.  	int keylen;
  2623.  	u8 key[AES_KEYSIZE_128];
  2624. @@ -448,27 +445,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
  2625.  	int ret;
  2626.  	int i, j;
  2627.  	int idx = 0;
  2628. +	u32 len;
  2629.  
  2630. -	/* Copy new key if necessary */
  2631. -	if (ctx->flags & FLAGS_NEW_KEY) {
  2632. -		memcpy(dev->key_base, ctx->key, ctx->keylen);
  2633. -		ctx->flags &= ~FLAGS_NEW_KEY;
  2634. +	memcpy(dev->key_base, ctx->key, ctx->keylen);
  2635.  
  2636. -		if (dev->flags & FLAGS_CBC) {
  2637. -			dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
  2638. -			dev->hw_desc[idx]->p1 = dev->iv_phys_base;
  2639. -		} else {
  2640. -			dev->hw_desc[idx]->len1 = 0;
  2641. -			dev->hw_desc[idx]->p1 = 0;
  2642. -		}
  2643. -		dev->hw_desc[idx]->len2 = ctx->keylen;
  2644. -		dev->hw_desc[idx]->p2 = dev->key_phys_base;
  2645. -		dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
  2646. +	if (dev->flags & FLAGS_CBC) {
  2647. +		dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
  2648. +		dev->hw_desc[idx]->p1 = dev->iv_phys_base;
  2649. +	} else {
  2650. +		dev->hw_desc[idx]->len1 = 0;
  2651. +		dev->hw_desc[idx]->p1 = 0;
  2652. +	}
  2653. +	dev->hw_desc[idx]->len2 = ctx->keylen;
  2654. +	dev->hw_desc[idx]->p2 = dev->key_phys_base;
  2655. +	dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
  2656. +	dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
  2657.  
  2658. -		dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
  2659. +	idx++;
  2660.  
  2661. -		idx++;
  2662. -	}
  2663.  
  2664.  	dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total);
  2665.  	if (dev->nb_in_sg < 0) {
  2666. @@ -490,24 +484,27 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
  2667.  			 DMA_TO_DEVICE);
  2668.  	if (ret != dev->nb_in_sg) {
  2669.  		dev_err(dev->device, "couldn't map in sg\n");
  2670. -		goto unmap_in;
  2671. +		return -EINVAL;
  2672.  	}
  2673. +
  2674.  	ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg,
  2675.  			 DMA_FROM_DEVICE);
  2676.  	if (ret != dev->nb_out_sg) {
  2677.  		dev_err(dev->device, "couldn't map out sg\n");
  2678. -		goto unmap_out;
  2679. +		goto unmap_in;
  2680.  	}
  2681.  
  2682.  	/* Create input links */
  2683.  	dev->hw_desc[idx]->p1 = dev->hw_phys_link[0];
  2684.  	sg = dev->in_sg;
  2685. +	len = dev->total;
  2686.  	for (i = 0; i < dev->nb_in_sg; i++) {
  2687. -		dev->hw_link[i]->len = sg->length;
  2688. +		dev->hw_link[i]->len = min(len, sg->length);
  2689.  		dev->hw_link[i]->p = sg->dma_address;
  2690.  		if (i == (dev->nb_in_sg - 1)) {
  2691.  			dev->hw_link[i]->next = 0;
  2692.  		} else {
  2693. +			len -= min(len, sg->length);
  2694.  			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
  2695.  			sg = sg_next(sg);
  2696.  		}
  2697. @@ -516,12 +513,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
  2698.  	/* Create output links */
  2699.  	dev->hw_desc[idx]->p2 = dev->hw_phys_link[i];
  2700.  	sg = dev->out_sg;
  2701. +	len = dev->total;
  2702.  	for (j = i; j < dev->nb_out_sg + i; j++) {
  2703. -		dev->hw_link[j]->len = sg->length;
  2704. +		dev->hw_link[j]->len = min(len, sg->length);
  2705.  		dev->hw_link[j]->p = sg->dma_address;
  2706.  		if (j == (dev->nb_out_sg + i - 1)) {
  2707.  			dev->hw_link[j]->next = 0;
  2708.  		} else {
  2709. +			len -= min(len, sg->length);
  2710.  			dev->hw_link[j]->next = dev->hw_phys_link[j + 1];
  2711.  			sg = sg_next(sg);
  2712.  		}
  2713. @@ -540,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
  2714.  
  2715.  	return 0;
  2716.  
  2717. -unmap_out:
  2718. -	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
  2719. -		DMA_FROM_DEVICE);
  2720.  unmap_in:
  2721.  	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
  2722.  		DMA_TO_DEVICE);
  2723. @@ -587,16 +583,17 @@ static int sahara_aes_process(struct ablkcipher_request *req)
  2724.  
  2725.  	timeout = wait_for_completion_timeout(&dev->dma_completion,
  2726.  				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
  2727. -	if (!timeout) {
  2728. -		dev_err(dev->device, "AES timeout\n");
  2729. -		return -ETIMEDOUT;
  2730. -	}
  2731.  
  2732.  	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
  2733.  		DMA_FROM_DEVICE);
  2734.  	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
  2735.  		DMA_TO_DEVICE);
  2736.  
  2737. +	if (!timeout) {
  2738. +		dev_err(dev->device, "AES timeout\n");
  2739. +		return -ETIMEDOUT;
  2740. +	}
  2741. +
  2742.  	return 0;
  2743.  }
  2744.  
  2745. @@ -611,7 +608,6 @@ static int sahara_aes_setkey(struct crypto_ablkcipher *tfm, const u8 *key,
  2746.  	/* SAHARA only supports 128bit keys */
  2747.  	if (keylen == AES_KEYSIZE_128) {
  2748.  		memcpy(ctx->key, key, keylen);
  2749. -		ctx->flags |= FLAGS_NEW_KEY;
  2750.  		return 0;
  2751.  	}
  2752.  
  2753. @@ -800,6 +796,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
  2754.  				       int start)
  2755.  {
  2756.  	struct scatterlist *sg;
  2757. +	unsigned int len;
  2758.  	unsigned int i;
  2759.  	int ret;
  2760.  
  2761. @@ -821,12 +818,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
  2762.  	if (!ret)
  2763.  		return -EFAULT;
  2764.  
  2765. +	len = rctx->total;
  2766.  	for (i = start; i < dev->nb_in_sg + start; i++) {
  2767. -		dev->hw_link[i]->len = sg->length;
  2768. +		dev->hw_link[i]->len = min(len, sg->length);
  2769.  		dev->hw_link[i]->p = sg->dma_address;
  2770.  		if (i == (dev->nb_in_sg + start - 1)) {
  2771.  			dev->hw_link[i]->next = 0;
  2772.  		} else {
  2773. +			len -= min(len, sg->length);
  2774.  			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
  2775.  			sg = sg_next(sg);
  2776.  		}
  2777. @@ -907,24 +906,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,
  2778.  	return 0;
  2779.  }
  2780.  
  2781. -static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes)
  2782. -{
  2783. -	if (!sg || !sg->length)
  2784. -		return nbytes;
  2785. -
  2786. -	while (nbytes && sg) {
  2787. -		if (nbytes <= sg->length) {
  2788. -			sg->length = nbytes;
  2789. -			sg_mark_end(sg);
  2790. -			break;
  2791. -		}
  2792. -		nbytes -= sg->length;
  2793. -		sg = sg_next(sg);
  2794. -	}
  2795. -
  2796. -	return nbytes;
  2797. -}
  2798. -
  2799.  static int sahara_sha_prepare_request(struct ahash_request *req)
  2800.  {
  2801.  	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
  2802. @@ -961,36 +942,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req)
  2803.  					hash_later, 0);
  2804.  	}
  2805.  
  2806. -	/* nbytes should now be multiple of blocksize */
  2807. -	req->nbytes = req->nbytes - hash_later;
  2808. -
  2809. -	sahara_walk_and_recalc(req->src, req->nbytes);
  2810. -
  2811. +	rctx->total = len - hash_later;
  2812.  	/* have data from previous operation and current */
  2813.  	if (rctx->buf_cnt && req->nbytes) {
  2814.  		sg_init_table(rctx->in_sg_chain, 2);
  2815.  		sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt);
  2816. -
  2817.  		sg_chain(rctx->in_sg_chain, 2, req->src);
  2818. -
  2819. -		rctx->total = req->nbytes + rctx->buf_cnt;
  2820.  		rctx->in_sg = rctx->in_sg_chain;
  2821. -
  2822. -		req->src = rctx->in_sg_chain;
  2823.  	/* only data from previous operation */
  2824.  	} else if (rctx->buf_cnt) {
  2825. -		if (req->src)
  2826. -			rctx->in_sg = req->src;
  2827. -		else
  2828. -			rctx->in_sg = rctx->in_sg_chain;
  2829. -		/* buf was copied into rembuf above */
  2830. +		rctx->in_sg = rctx->in_sg_chain;
  2831.  		sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt);
  2832. -		rctx->total = rctx->buf_cnt;
  2833.  	/* no data from previous operation */
  2834.  	} else {
  2835.  		rctx->in_sg = req->src;
  2836. -		rctx->total = req->nbytes;
  2837. -		req->src = rctx->in_sg;
  2838.  	}
  2839.  
  2840.  	/* on next call, we only have the remaining data in the buffer */
  2841. @@ -1011,7 +976,10 @@ static int sahara_sha_process(struct ahash_request *req)
  2842.  		return ret;
  2843.  
  2844.  	if (rctx->first) {
  2845. -		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
  2846. +		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
  2847. +		if (ret)
  2848. +			return ret;
  2849. +
  2850.  		dev->hw_desc[0]->next = 0;
  2851.  		rctx->first = 0;
  2852.  	} else {
  2853. @@ -1019,7 +987,10 @@ static int sahara_sha_process(struct ahash_request *req)
  2854.  
  2855.  		sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0);
  2856.  		dev->hw_desc[0]->next = dev->hw_phys_desc[1];
  2857. -		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
  2858. +		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
  2859. +		if (ret)
  2860. +			return ret;
  2861. +
  2862.  		dev->hw_desc[1]->next = 0;
  2863.  	}
  2864.  
  2865. @@ -1032,18 +1003,19 @@ static int sahara_sha_process(struct ahash_request *req)
  2866.  
  2867.  	timeout = wait_for_completion_timeout(&dev->dma_completion,
  2868.  				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
  2869. -	if (!timeout) {
  2870. -		dev_err(dev->device, "SHA timeout\n");
  2871. -		return -ETIMEDOUT;
  2872. -	}
  2873.  
  2874.  	if (rctx->sg_in_idx)
  2875.  		dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
  2876.  			     DMA_TO_DEVICE);
  2877.  
  2878. +	if (!timeout) {
  2879. +		dev_err(dev->device, "SHA timeout\n");
  2880. +		return -ETIMEDOUT;
  2881. +	}
  2882. +
  2883.  	memcpy(rctx->context, dev->context_base, rctx->context_size);
  2884.  
  2885. -	if (req->result)
  2886. +	if (req->result && rctx->last)
  2887.  		memcpy(req->result, rctx->context, rctx->digest_size);
  2888.  
  2889.  	return 0;
  2890. @@ -1187,8 +1159,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)
  2891.  static int sahara_sha_cra_init(struct crypto_tfm *tfm)
  2892.  {
  2893.  	crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
  2894. -				 sizeof(struct sahara_sha_reqctx) +
  2895. -				 SHA_BUFFER_LEN + SHA256_BLOCK_SIZE);
  2896. +				 sizeof(struct sahara_sha_reqctx));
  2897.  
  2898.  	return 0;
  2899.  }
  2900. diff --git drivers/crypto/virtio/virtio_crypto_common.h drivers/crypto/virtio/virtio_crypto_common.h
  2901. index e976539a05d9..d8be210a07ec 100644
  2902. --- linux-4.14.336/drivers/crypto/virtio/virtio_crypto_common.h
  2903. +++ linux-4.14.336/drivers/crypto/virtio/virtio_crypto_common.h
  2904. @@ -22,6 +22,7 @@
  2905.  #include <linux/virtio.h>
  2906.  #include <linux/crypto.h>
  2907.  #include <linux/spinlock.h>
  2908. +#include <linux/interrupt.h>
  2909.  #include <crypto/aead.h>
  2910.  #include <crypto/aes.h>
  2911.  #include <crypto/authenc.h>
  2912. @@ -40,6 +41,7 @@ struct data_queue {
  2913.  	char name[32];
  2914.  
  2915.  	struct crypto_engine *engine;
  2916. +	struct tasklet_struct done_task;
  2917.  };
  2918.  
  2919.  struct virtio_crypto {
  2920. diff --git drivers/crypto/virtio/virtio_crypto_core.c drivers/crypto/virtio/virtio_crypto_core.c
  2921. index ff1410a32c2b..e21dd216989f 100644
  2922. --- linux-4.14.336/drivers/crypto/virtio/virtio_crypto_core.c
  2923. +++ linux-4.14.336/drivers/crypto/virtio/virtio_crypto_core.c
  2924. @@ -34,27 +34,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req)
  2925.  	}
  2926.  }
  2927.  
  2928. -static void virtcrypto_dataq_callback(struct virtqueue *vq)
  2929. +static void virtcrypto_done_task(unsigned long data)
  2930.  {
  2931. -	struct virtio_crypto *vcrypto = vq->vdev->priv;
  2932. +	struct data_queue *data_vq = (struct data_queue *)data;
  2933. +	struct virtqueue *vq = data_vq->vq;
  2934.  	struct virtio_crypto_request *vc_req;
  2935. -	unsigned long flags;
  2936.  	unsigned int len;
  2937. -	unsigned int qid = vq->index;
  2938.  
  2939. -	spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags);
  2940.  	do {
  2941.  		virtqueue_disable_cb(vq);
  2942.  		while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
  2943. -			spin_unlock_irqrestore(
  2944. -				&vcrypto->data_vq[qid].lock, flags);
  2945.  			if (vc_req->alg_cb)
  2946.  				vc_req->alg_cb(vc_req, len);
  2947. -			spin_lock_irqsave(
  2948. -				&vcrypto->data_vq[qid].lock, flags);
  2949.  		}
  2950.  	} while (!virtqueue_enable_cb(vq));
  2951. -	spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags);
  2952. +}
  2953. +
  2954. +static void virtcrypto_dataq_callback(struct virtqueue *vq)
  2955. +{
  2956. +	struct virtio_crypto *vcrypto = vq->vdev->priv;
  2957. +	struct data_queue *dq = &vcrypto->data_vq[vq->index];
  2958. +
  2959. +	tasklet_schedule(&dq->done_task);
  2960.  }
  2961.  
  2962.  static int virtcrypto_find_vqs(struct virtio_crypto *vi)
  2963. @@ -114,6 +115,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
  2964.  
  2965.  		vi->data_vq[i].engine->cipher_one_request =
  2966.  			virtio_crypto_ablkcipher_crypt_req;
  2967. +		tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task,
  2968. +				(unsigned long)&vi->data_vq[i]);
  2969.  	}
  2970.  
  2971.  	kfree(names);
  2972. @@ -417,11 +420,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)
  2973.  static void virtcrypto_remove(struct virtio_device *vdev)
  2974.  {
  2975.  	struct virtio_crypto *vcrypto = vdev->priv;
  2976. +	int i;
  2977.  
  2978.  	dev_info(&vdev->dev, "Start virtcrypto_remove.\n");
  2979.  
  2980.  	if (virtcrypto_dev_started(vcrypto))
  2981.  		virtcrypto_dev_stop(vcrypto);
  2982. +	for (i = 0; i < vcrypto->max_data_queues; i++)
  2983. +		tasklet_kill(&vcrypto->data_vq[i].done_task);
  2984.  	vdev->config->reset(vdev);
  2985.  	virtcrypto_free_unused_reqs(vcrypto);
  2986.  	virtcrypto_clear_crypto_engines(vcrypto);
  2987. diff --git drivers/dma/sh/shdma.h drivers/dma/sh/shdma.h
  2988. index 2c0a969adc9f..35987a35a848 100644
  2989. --- linux-4.14.336/drivers/dma/sh/shdma.h
  2990. +++ linux-4.14.336/drivers/dma/sh/shdma.h
  2991. @@ -29,7 +29,7 @@ struct sh_dmae_chan {
  2992.  	const struct sh_dmae_slave_config *config; /* Slave DMA configuration */
  2993.  	int xmit_shift;			/* log_2(bytes_per_xfer) */
  2994.  	void __iomem *base;
  2995. -	char dev_id[16];		/* unique name per DMAC of channel */
  2996. +	char dev_id[32];		/* unique name per DMAC of channel */
  2997.  	int pm_error;
  2998.  	dma_addr_t slave_addr;
  2999.  };
  3000. diff --git drivers/edac/thunderx_edac.c drivers/edac/thunderx_edac.c
  3001. index dfefa39e9351..bc9ecc6c0573 100644
  3002. --- linux-4.14.336/drivers/edac/thunderx_edac.c
  3003. +++ linux-4.14.336/drivers/edac/thunderx_edac.c
  3004. @@ -1154,7 +1154,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
  3005.  		decode_register(other, OCX_OTHER_SIZE,
  3006.  				ocx_com_errors, ctx->reg_com_int);
  3007.  
  3008. -		strncat(msg, other, OCX_MESSAGE_SIZE);
  3009. +		strlcat(msg, other, OCX_MESSAGE_SIZE);
  3010.  
  3011.  		for (lane = 0; lane < OCX_RX_LANES; lane++)
  3012.  			if (ctx->reg_com_int & BIT(lane)) {
  3013. @@ -1163,12 +1163,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
  3014.  					 lane, ctx->reg_lane_int[lane],
  3015.  					 lane, ctx->reg_lane_stat11[lane]);
  3016.  
  3017. -				strncat(msg, other, OCX_MESSAGE_SIZE);
  3018. +				strlcat(msg, other, OCX_MESSAGE_SIZE);
  3019.  
  3020.  				decode_register(other, OCX_OTHER_SIZE,
  3021.  						ocx_lane_errors,
  3022.  						ctx->reg_lane_int[lane]);
  3023. -				strncat(msg, other, OCX_MESSAGE_SIZE);
  3024. +				strlcat(msg, other, OCX_MESSAGE_SIZE);
  3025.  			}
  3026.  
  3027.  		if (ctx->reg_com_int & OCX_COM_INT_CE)
  3028. @@ -1238,7 +1238,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
  3029.  		decode_register(other, OCX_OTHER_SIZE,
  3030.  				ocx_com_link_errors, ctx->reg_com_link_int);
  3031.  
  3032. -		strncat(msg, other, OCX_MESSAGE_SIZE);
  3033. +		strlcat(msg, other, OCX_MESSAGE_SIZE);
  3034.  
  3035.  		if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
  3036.  			edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
  3037. @@ -1917,7 +1917,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
  3038.  
  3039.  		decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);
  3040.  
  3041. -		strncat(msg, other, L2C_MESSAGE_SIZE);
  3042. +		strlcat(msg, other, L2C_MESSAGE_SIZE);
  3043.  
  3044.  		if (ctx->reg_int & mask_ue)
  3045.  			edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);
  3046. diff --git drivers/firewire/core-card.c drivers/firewire/core-card.c
  3047. index 11c634125c7d..0e6f96c0e395 100644
  3048. --- linux-4.14.336/drivers/firewire/core-card.c
  3049. +++ linux-4.14.336/drivers/firewire/core-card.c
  3050. @@ -442,7 +442,23 @@ static void bm_work(struct work_struct *work)
  3051.  	 */
  3052.  	card->bm_generation = generation;
  3053.  
  3054. -	if (root_device == NULL) {
  3055. +	if (card->gap_count == 0) {
  3056. +		/*
  3057. +		 * If self IDs have inconsistent gap counts, do a
  3058. +		 * bus reset ASAP. The config rom read might never
  3059. +		 * complete, so don't wait for it. However, still
  3060. +		 * send a PHY configuration packet prior to the
  3061. +		 * bus reset. The PHY configuration packet might
  3062. +		 * fail, but 1394-2008 8.4.5.2 explicitly permits
  3063. +		 * it in this case, so it should be safe to try.
  3064. +		 */
  3065. +		new_root_id = local_id;
  3066. +		/*
  3067. +		 * We must always send a bus reset if the gap count
  3068. +		 * is inconsistent, so bypass the 5-reset limit.
  3069. +		 */
  3070. +		card->bm_retries = 0;
  3071. +	} else if (root_device == NULL) {
  3072.  		/*
  3073.  		 * Either link_on is false, or we failed to read the
  3074.  		 * config rom.  In either case, pick another root.
  3075. diff --git drivers/firewire/core-device.c drivers/firewire/core-device.c
  3076. index a293b39fd4ce..25c5de074525 100644
  3077. --- linux-4.14.336/drivers/firewire/core-device.c
  3078. +++ linux-4.14.336/drivers/firewire/core-device.c
  3079. @@ -113,10 +113,9 @@ static int textual_leaf_to_string(const u32 *block, char *buf, size_t size)
  3080.   * @buf:	where to put the string
  3081.   * @size:	size of @buf, in bytes
  3082.   *
  3083. - * The string is taken from a minimal ASCII text descriptor leaf after
  3084. - * the immediate entry with @key.  The string is zero-terminated.
  3085. - * An overlong string is silently truncated such that it and the
  3086. - * zero byte fit into @size.
  3087. + * The string is taken from a minimal ASCII text descriptor leaf just after the entry with the
  3088. + * @key. The string is zero-terminated. An overlong string is silently truncated such that it
  3089. + * and the zero byte fit into @size.
  3090.   *
  3091.   * Returns strlen(buf) or a negative error code.
  3092.   */
  3093. diff --git drivers/firmware/efi/capsule-loader.c drivers/firmware/efi/capsule-loader.c
  3094. index 539825a17959..fa36bbdb9ca7 100644
  3095. --- linux-4.14.336/drivers/firmware/efi/capsule-loader.c
  3096. +++ linux-4.14.336/drivers/firmware/efi/capsule-loader.c
  3097. @@ -287,7 +287,7 @@ static int efi_capsule_open(struct inode *inode, struct file *file)
  3098.  		return -ENOMEM;
  3099.  	}
  3100.  
  3101. -	cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL);
  3102. +	cap_info->phys = kzalloc(sizeof(phys_addr_t), GFP_KERNEL);
  3103.  	if (!cap_info->phys) {
  3104.  		kfree(cap_info->pages);
  3105.  		kfree(cap_info);
  3106. diff --git drivers/firmware/ti_sci.c drivers/firmware/ti_sci.c
  3107. index dd677fc4578a..7ac5a8bd05c4 100644
  3108. --- linux-4.14.336/drivers/firmware/ti_sci.c
  3109. +++ linux-4.14.336/drivers/firmware/ti_sci.c
  3110. @@ -184,7 +184,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
  3111.  {
  3112.  	struct device *dev = &pdev->dev;
  3113.  	struct resource *res;
  3114. -	char debug_name[50] = "ti_sci_debug@";
  3115. +	char debug_name[50];
  3116.  
  3117.  	/* Debug region is optional */
  3118.  	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
  3119. @@ -201,10 +201,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
  3120.  	/* Setup NULL termination */
  3121.  	info->debug_buffer[info->debug_region_size] = 0;
  3122.  
  3123. -	info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
  3124. -					      sizeof(debug_name) -
  3125. -					      sizeof("ti_sci_debug@")),
  3126. -				      0444, NULL, info, &ti_sci_debug_fops);
  3127. +	snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s",
  3128. +		 dev_name(dev));
  3129. +	info->d = debugfs_create_file(debug_name, 0444, NULL, info,
  3130. +				      &ti_sci_debug_fops);
  3131.  	if (IS_ERR(info->d))
  3132.  		return PTR_ERR(info->d);
  3133.  
  3134. diff --git drivers/gpio/gpio-74x164.c drivers/gpio/gpio-74x164.c
  3135. index 15a1f4b348c4..4043fe0c8247 100644
  3136. --- linux-4.14.336/drivers/gpio/gpio-74x164.c
  3137. +++ linux-4.14.336/drivers/gpio/gpio-74x164.c
  3138. @@ -133,8 +133,6 @@ static int gen_74x164_probe(struct spi_device *spi)
  3139.  	if (IS_ERR(chip->gpiod_oe))
  3140.  		return PTR_ERR(chip->gpiod_oe);
  3141.  
  3142. -	gpiod_set_value_cansleep(chip->gpiod_oe, 1);
  3143. -
  3144.  	spi_set_drvdata(spi, chip);
  3145.  
  3146.  	chip->gpio_chip.label = spi->modalias;
  3147. @@ -159,6 +157,8 @@ static int gen_74x164_probe(struct spi_device *spi)
  3148.  		goto exit_destroy;
  3149.  	}
  3150.  
  3151. +	gpiod_set_value_cansleep(chip->gpiod_oe, 1);
  3152. +
  3153.  	ret = gpiochip_add_data(&chip->gpio_chip, chip);
  3154.  	if (!ret)
  3155.  		return 0;
  3156. diff --git drivers/gpio/gpiolib-acpi.c drivers/gpio/gpiolib-acpi.c
  3157. index 713dc43024c9..a2d00b1ff117 100644
  3158. --- linux-4.14.336/drivers/gpio/gpiolib-acpi.c
  3159. +++ linux-4.14.336/drivers/gpio/gpiolib-acpi.c
  3160. @@ -1476,6 +1476,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] = {
  3161.  			.ignore_wake = "INT33FF:01@0",
  3162.  		},
  3163.  	},
  3164. +	{
  3165. +		/*
  3166. +		 * Spurious wakeups from TP_ATTN# pin
  3167. +		 * Found in BIOS 0.35
  3168. +		 * https://gitlab.freedesktop.org/drm/amd/-/issues/3073
  3169. +		 */
  3170. +		.matches = {
  3171. +			DMI_MATCH(DMI_SYS_VENDOR, "GPD"),
  3172. +			DMI_MATCH(DMI_PRODUCT_NAME, "G1619-04"),
  3173. +		},
  3174. +		.driver_data = &(struct acpi_gpiolib_dmi_quirk) {
  3175. +			.ignore_wake = "PNP0C50:00@8",
  3176. +		},
  3177. +	},
  3178.  	{} /* Terminating entry */
  3179.  };
  3180.  
  3181. diff --git drivers/gpu/drm/amd/amdgpu/amdgpu_device.c drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
  3182. index 076b22c44122..d7192b2a980c 100644
  3183. --- linux-4.14.336/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
  3184. +++ linux-4.14.336/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
  3185. @@ -701,6 +701,7 @@ static bool amdgpu_vpost_needed(struct amdgpu_device *adev)
  3186.  				return true;
  3187.  
  3188.  			fw_ver = *((uint32_t *)adev->pm.fw->data + 69);
  3189. +			release_firmware(adev->pm.fw);
  3190.  			if (fw_ver < 0x00160e00)
  3191.  				return true;
  3192.  		}
  3193. diff --git drivers/gpu/drm/amd/amdgpu/kv_dpm.c drivers/gpu/drm/amd/amdgpu/kv_dpm.c
  3194. index d99fb88341f4..a4c9a326e9f5 100644
  3195. --- linux-4.14.336/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
  3196. +++ linux-4.14.336/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
  3197. @@ -2718,10 +2718,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
  3198.  		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
  3199.  			&non_clock_info_array->nonClockInfo[non_clock_array_index];
  3200.  		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
  3201. -		if (ps == NULL) {
  3202. -			kfree(adev->pm.dpm.ps);
  3203. +		if (ps == NULL)
  3204.  			return -ENOMEM;
  3205. -		}
  3206.  		adev->pm.dpm.ps[i].ps_priv = ps;
  3207.  		k = 0;
  3208.  		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
  3209. diff --git drivers/gpu/drm/amd/amdgpu/si_dpm.c drivers/gpu/drm/amd/amdgpu/si_dpm.c
  3210. index 288ac692f536..5f80f44f5f67 100644
  3211. --- linux-4.14.336/drivers/gpu/drm/amd/amdgpu/si_dpm.c
  3212. +++ linux-4.14.336/drivers/gpu/drm/amd/amdgpu/si_dpm.c
  3213. @@ -7336,10 +7336,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
  3214.  
  3215.  	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries =
  3216.  		kzalloc(4 * sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL);
  3217. -	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
  3218. -		amdgpu_free_extended_power_table(adev);
  3219. +	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)
  3220.  		return -ENOMEM;
  3221. -	}
  3222. +
  3223.  	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4;
  3224.  	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0;
  3225.  	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;
  3226. diff --git drivers/gpu/drm/bridge/nxp-ptn3460.c drivers/gpu/drm/bridge/nxp-ptn3460.c
  3227. index d64a3283822a..4ea809891f64 100644
  3228. --- linux-4.14.336/drivers/gpu/drm/bridge/nxp-ptn3460.c
  3229. +++ linux-4.14.336/drivers/gpu/drm/bridge/nxp-ptn3460.c
  3230. @@ -64,13 +64,13 @@ static int ptn3460_read_bytes(struct ptn3460_bridge *ptn_bridge, char addr,
  3231.  	int ret;
  3232.  
  3233.  	ret = i2c_master_send(ptn_bridge->client, &addr, 1);
  3234. -	if (ret <= 0) {
  3235. +	if (ret < 0) {
  3236.  		DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
  3237.  		return ret;
  3238.  	}
  3239.  
  3240.  	ret = i2c_master_recv(ptn_bridge->client, buf, len);
  3241. -	if (ret <= 0) {
  3242. +	if (ret < 0) {
  3243.  		DRM_ERROR("Failed to recv i2c data, ret=%d\n", ret);
  3244.  		return ret;
  3245.  	}
  3246. @@ -88,7 +88,7 @@ static int ptn3460_write_byte(struct ptn3460_bridge *ptn_bridge, char addr,
  3247.  	buf[1] = val;
  3248.  
  3249.  	ret = i2c_master_send(ptn_bridge->client, buf, ARRAY_SIZE(buf));
  3250. -	if (ret <= 0) {
  3251. +	if (ret < 0) {
  3252.  		DRM_ERROR("Failed to send i2c command, ret=%d\n", ret);
  3253.  		return ret;
  3254.  	}
  3255. diff --git drivers/gpu/drm/drm_crtc.c drivers/gpu/drm/drm_crtc.c
  3256. index 5af25ce5bf7c..7e37b439ecae 100644
  3257. --- linux-4.14.336/drivers/gpu/drm/drm_crtc.c
  3258. +++ linux-4.14.336/drivers/gpu/drm/drm_crtc.c
  3259. @@ -556,8 +556,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
  3260.  	struct drm_mode_set set;
  3261.  	uint32_t __user *set_connectors_ptr;
  3262.  	struct drm_modeset_acquire_ctx ctx;
  3263. -	int ret;
  3264. -	int i;
  3265. +	int ret, i, num_connectors = 0;
  3266.  
  3267.  	if (!drm_core_check_feature(dev, DRIVER_MODESET))
  3268.  		return -EINVAL;
  3269. @@ -692,6 +691,7 @@ retry:
  3270.  					connector->name);
  3271.  
  3272.  			connector_set[i] = connector;
  3273. +			num_connectors++;
  3274.  		}
  3275.  	}
  3276.  
  3277. @@ -700,7 +700,7 @@ retry:
  3278.  	set.y = crtc_req->y;
  3279.  	set.mode = mode;
  3280.  	set.connectors = connector_set;
  3281. -	set.num_connectors = crtc_req->count_connectors;
  3282. +	set.num_connectors = num_connectors;
  3283.  	set.fb = fb;
  3284.  	ret = __drm_mode_set_config_internal(&set, &ctx);
  3285.  
  3286. @@ -709,7 +709,7 @@ out:
  3287.  		drm_framebuffer_put(fb);
  3288.  
  3289.  	if (connector_set) {
  3290. -		for (i = 0; i < crtc_req->count_connectors; i++) {
  3291. +		for (i = 0; i < num_connectors; i++) {
  3292.  			if (connector_set[i])
  3293.  				drm_connector_put(connector_set[i]);
  3294.  		}
  3295. diff --git drivers/gpu/drm/drm_drv.c drivers/gpu/drm/drm_drv.c
  3296. index 340440febf9a..384a060aa8a1 100644
  3297. --- linux-4.14.336/drivers/gpu/drm/drm_drv.c
  3298. +++ linux-4.14.336/drivers/gpu/drm/drm_drv.c
  3299. @@ -812,8 +812,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
  3300.  			goto err_minors;
  3301.  	}
  3302.  
  3303. -	if (drm_core_check_feature(dev, DRIVER_MODESET))
  3304. -		drm_modeset_register_all(dev);
  3305. +	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
  3306. +		ret = drm_modeset_register_all(dev);
  3307. +		if (ret)
  3308. +			goto err_unload;
  3309. +	}
  3310.  
  3311.  	ret = 0;
  3312.  
  3313. @@ -825,6 +828,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
  3314.  
  3315.  	goto out_unlock;
  3316.  
  3317. +err_unload:
  3318. +	if (dev->driver->unload)
  3319. +		dev->driver->unload(dev);
  3320.  err_minors:
  3321.  	remove_compat_control_link(dev);
  3322.  	drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
  3323. diff --git drivers/gpu/drm/drm_file.c drivers/gpu/drm/drm_file.c
  3324. index 3cf07f5063ff..8705060c72b4 100644
  3325. --- linux-4.14.336/drivers/gpu/drm/drm_file.c
  3326. +++ linux-4.14.336/drivers/gpu/drm/drm_file.c
  3327. @@ -138,7 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
  3328.  {
  3329.  	struct drm_device *dev;
  3330.  	struct drm_minor *minor;
  3331. -	int retcode;
  3332. +	int retcode = 0;
  3333.  	int need_setup = 0;
  3334.  
  3335.  	minor = drm_minor_acquire(iminor(inode));
  3336. diff --git drivers/gpu/drm/drm_framebuffer.c drivers/gpu/drm/drm_framebuffer.c
  3337. index af40189cdb60..d6476223a941 100644
  3338. --- linux-4.14.336/drivers/gpu/drm/drm_framebuffer.c
  3339. +++ linux-4.14.336/drivers/gpu/drm/drm_framebuffer.c
  3340. @@ -521,7 +521,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
  3341.  	struct drm_framebuffer *fb;
  3342.  	unsigned flags;
  3343.  	int num_clips;
  3344. -	int ret;
  3345. +	int ret = 0;
  3346.  
  3347.  	if (!drm_core_check_feature(dev, DRIVER_MODESET))
  3348.  		return -EINVAL;
  3349. diff --git drivers/gpu/drm/drm_mipi_dsi.c drivers/gpu/drm/drm_mipi_dsi.c
  3350. index 6995bee5ad0f..488e8e35c722 100644
  3351. --- linux-4.14.336/drivers/gpu/drm/drm_mipi_dsi.c
  3352. +++ linux-4.14.336/drivers/gpu/drm/drm_mipi_dsi.c
  3353. @@ -305,7 +305,8 @@ static int mipi_dsi_remove_device_fn(struct device *dev, void *priv)
  3354.  {
  3355.  	struct mipi_dsi_device *dsi = to_mipi_dsi_device(dev);
  3356.  
  3357. -	mipi_dsi_detach(dsi);
  3358. +	if (dsi->attached)
  3359. +		mipi_dsi_detach(dsi);
  3360.  	mipi_dsi_device_unregister(dsi);
  3361.  
  3362.  	return 0;
  3363. @@ -328,11 +329,18 @@ EXPORT_SYMBOL(mipi_dsi_host_unregister);
  3364.  int mipi_dsi_attach(struct mipi_dsi_device *dsi)
  3365.  {
  3366.  	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
  3367. +	int ret;
  3368.  
  3369.  	if (!ops || !ops->attach)
  3370.  		return -ENOSYS;
  3371.  
  3372. -	return ops->attach(dsi->host, dsi);
  3373. +	ret = ops->attach(dsi->host, dsi);
  3374. +	if (ret)
  3375. +		return ret;
  3376. +
  3377. +	dsi->attached = true;
  3378. +
  3379. +	return 0;
  3380.  }
  3381.  EXPORT_SYMBOL(mipi_dsi_attach);
  3382.  
  3383. @@ -344,9 +352,14 @@ int mipi_dsi_detach(struct mipi_dsi_device *dsi)
  3384.  {
  3385.  	const struct mipi_dsi_host_ops *ops = dsi->host->ops;
  3386.  
  3387. +	if (WARN_ON(!dsi->attached))
  3388. +		return -EINVAL;
  3389. +
  3390.  	if (!ops || !ops->detach)
  3391.  		return -ENOSYS;
  3392.  
  3393. +	dsi->attached = false;
  3394. +
  3395.  	return ops->detach(dsi->host, dsi);
  3396.  }
  3397.  EXPORT_SYMBOL(mipi_dsi_detach);
  3398. diff --git drivers/gpu/drm/drm_plane.c drivers/gpu/drm/drm_plane.c
  3399. index 71186bf90760..5354dedaa608 100644
  3400. --- linux-4.14.336/drivers/gpu/drm/drm_plane.c
  3401. +++ linux-4.14.336/drivers/gpu/drm/drm_plane.c
  3402. @@ -1072,6 +1072,7 @@ retry:
  3403.  out:
  3404.  	if (fb)
  3405.  		drm_framebuffer_put(fb);
  3406. +	fb = NULL;
  3407.  	if (crtc->primary->old_fb)
  3408.  		drm_framebuffer_put(crtc->primary->old_fb);
  3409.  	crtc->primary->old_fb = NULL;
  3410. diff --git drivers/gpu/drm/exynos/exynos_drm_drv.c drivers/gpu/drm/exynos/exynos_drm_drv.c
  3411. index 82b72425a42f..707b4fdd94a7 100644
  3412. --- linux-4.14.336/drivers/gpu/drm/exynos/exynos_drm_drv.c
  3413. +++ linux-4.14.336/drivers/gpu/drm/exynos/exynos_drm_drv.c
  3414. @@ -407,6 +407,7 @@ err_mode_config_cleanup:
  3415.  	drm_release_iommu_mapping(drm);
  3416.  err_free_private:
  3417.  	kfree(private);
  3418. +	dev_set_drvdata(dev, NULL);
  3419.  err_free_drm:
  3420.  	drm_dev_unref(drm);
  3421.  
  3422. @@ -423,6 +424,7 @@ static void exynos_drm_unbind(struct device *dev)
  3423.  
  3424.  	exynos_drm_fbdev_fini(drm);
  3425.  	drm_kms_helper_poll_fini(drm);
  3426. +	drm_atomic_helper_shutdown(drm);
  3427.  
  3428.  	component_unbind_all(drm->dev, drm);
  3429.  	drm_mode_config_cleanup(drm);
  3430. @@ -460,9 +462,18 @@ static int exynos_drm_platform_remove(struct platform_device *pdev)
  3431.  	return 0;
  3432.  }
  3433.  
  3434. +static void exynos_drm_platform_shutdown(struct platform_device *pdev)
  3435. +{
  3436. +	struct drm_device *drm = platform_get_drvdata(pdev);
  3437. +
  3438. +	if (drm)
  3439. +		drm_atomic_helper_shutdown(drm);
  3440. +}
  3441. +
  3442.  static struct platform_driver exynos_drm_platform_driver = {
  3443.  	.probe	= exynos_drm_platform_probe,
  3444.  	.remove	= exynos_drm_platform_remove,
  3445. +	.shutdown = exynos_drm_platform_shutdown,
  3446.  	.driver	= {
  3447.  		.name	= "exynos-drm",
  3448.  		.pm	= &exynos_drm_pm_ops,
  3449. diff --git drivers/gpu/drm/exynos/exynos_hdmi.c drivers/gpu/drm/exynos/exynos_hdmi.c
  3450. index 0109ff40b1db..3d79a7af8c86 100644
  3451. --- linux-4.14.336/drivers/gpu/drm/exynos/exynos_hdmi.c
  3452. +++ linux-4.14.336/drivers/gpu/drm/exynos/exynos_hdmi.c
  3453. @@ -1722,6 +1722,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
  3454.  		return ret;
  3455.  
  3456.  	crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI);
  3457. +	if (IS_ERR(crtc))
  3458. +		return PTR_ERR(crtc);
  3459.  	crtc->pipe_clk = &hdata->phy_clk;
  3460.  
  3461.  	ret = hdmi_create_connector(encoder);
  3462. diff --git drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
  3463. index 47fa2aba1983..de0dac7b5d85 100644
  3464. --- linux-4.14.336/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
  3465. +++ linux-4.14.336/drivers/gpu/drm/msm/mdp/mdp4/mdp4_crtc.c
  3466. @@ -284,6 +284,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
  3467.  {
  3468.  	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
  3469.  	struct mdp4_kms *mdp4_kms = get_kms(crtc);
  3470. +	unsigned long flags;
  3471.  
  3472.  	DBG("%s", mdp4_crtc->name);
  3473.  
  3474. @@ -293,6 +294,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
  3475.  	mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
  3476.  	mdp4_disable(mdp4_kms);
  3477.  
  3478. +	if (crtc->state->event && !crtc->state->active) {
  3479. +		WARN_ON(mdp4_crtc->event);
  3480. +		spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
  3481. +		drm_crtc_send_vblank_event(crtc, crtc->state->event);
  3482. +		crtc->state->event = NULL;
  3483. +		spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
  3484. +	}
  3485. +
  3486.  	mdp4_crtc->enabled = false;
  3487.  }
  3488.  
  3489. diff --git drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
  3490. index 4b571cc6bc70..6597def18627 100644
  3491. --- linux-4.14.336/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
  3492. +++ linux-4.14.336/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
  3493. @@ -154,11 +154,17 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)
  3494.  	return (void *)fw;
  3495.  }
  3496.  
  3497. +static void
  3498. +shadow_fw_release(void *fw)
  3499. +{
  3500. +	release_firmware(fw);
  3501. +}
  3502. +
  3503.  static const struct nvbios_source
  3504.  shadow_fw = {
  3505.  	.name = "firmware",
  3506.  	.init = shadow_fw_init,
  3507. -	.fini = (void(*)(void *))release_firmware,
  3508. +	.fini = shadow_fw_release,
  3509.  	.read = shadow_fw_read,
  3510.  	.rw = false,
  3511.  };
  3512. diff --git drivers/gpu/drm/radeon/r100.c drivers/gpu/drm/radeon/r100.c
  3513. index a4929372090d..56e13bdd4bd0 100644
  3514. --- linux-4.14.336/drivers/gpu/drm/radeon/r100.c
  3515. +++ linux-4.14.336/drivers/gpu/drm/radeon/r100.c
  3516. @@ -2307,7 +2307,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
  3517.  	switch (prim_walk) {
  3518.  	case 1:
  3519.  		for (i = 0; i < track->num_arrays; i++) {
  3520. -			size = track->arrays[i].esize * track->max_indx * 4;
  3521. +			size = track->arrays[i].esize * track->max_indx * 4UL;
  3522.  			if (track->arrays[i].robj == NULL) {
  3523.  				DRM_ERROR("(PW %u) Vertex array %u no buffer "
  3524.  					  "bound\n", prim_walk, i);
  3525. @@ -2326,7 +2326,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
  3526.  		break;
  3527.  	case 2:
  3528.  		for (i = 0; i < track->num_arrays; i++) {
  3529. -			size = track->arrays[i].esize * (nverts - 1) * 4;
  3530. +			size = track->arrays[i].esize * (nverts - 1) * 4UL;
  3531.  			if (track->arrays[i].robj == NULL) {
  3532.  				DRM_ERROR("(PW %u) Vertex array %u no buffer "
  3533.  					  "bound\n", prim_walk, i);
  3534. diff --git drivers/gpu/drm/radeon/r600_cs.c drivers/gpu/drm/radeon/r600_cs.c
  3535. index 97fd58e97043..f478d88aea8f 100644
  3536. --- linux-4.14.336/drivers/gpu/drm/radeon/r600_cs.c
  3537. +++ linux-4.14.336/drivers/gpu/drm/radeon/r600_cs.c
  3538. @@ -1278,7 +1278,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
  3539.  			return -EINVAL;
  3540.  		}
  3541.  		tmp = (reg - CB_COLOR0_BASE) / 4;
  3542. -		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
  3543. +		track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8;
  3544.  		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
  3545.  		track->cb_color_base_last[tmp] = ib[idx];
  3546.  		track->cb_color_bo[tmp] = reloc->robj;
  3547. @@ -1305,7 +1305,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
  3548.  					"0x%04X\n", reg);
  3549.  			return -EINVAL;
  3550.  		}
  3551. -		track->htile_offset = radeon_get_ib_value(p, idx) << 8;
  3552. +		track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8;
  3553.  		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
  3554.  		track->htile_bo = reloc->robj;
  3555.  		track->db_dirty = true;
  3556. diff --git drivers/gpu/drm/radeon/radeon_display.c drivers/gpu/drm/radeon/radeon_display.c
  3557. index 173439a8c881..620f301737a4 100644
  3558. --- linux-4.14.336/drivers/gpu/drm/radeon/radeon_display.c
  3559. +++ linux-4.14.336/drivers/gpu/drm/radeon/radeon_display.c
  3560. @@ -678,11 +678,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
  3561.  	if (radeon_crtc == NULL)
  3562.  		return;
  3563.  
  3564. +	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
  3565. +	if (!radeon_crtc->flip_queue) {
  3566. +		kfree(radeon_crtc);
  3567. +		return;
  3568. +	}
  3569. +
  3570.  	drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
  3571.  
  3572.  	drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
  3573.  	radeon_crtc->crtc_id = index;
  3574. -	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
  3575.  	rdev->mode_info.crtcs[index] = radeon_crtc;
  3576.  
  3577.  	if (rdev->family >= CHIP_BONAIRE) {
  3578. diff --git drivers/gpu/drm/radeon/radeon_vm.c drivers/gpu/drm/radeon/radeon_vm.c
  3579. index e5c0e635e371..6f2133ff7c2c 100644
  3580. --- linux-4.14.336/drivers/gpu/drm/radeon/radeon_vm.c
  3581. +++ linux-4.14.336/drivers/gpu/drm/radeon/radeon_vm.c
  3582. @@ -1205,13 +1205,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
  3583.  	r = radeon_bo_create(rdev, pd_size, align, true,
  3584.  			     RADEON_GEM_DOMAIN_VRAM, 0, NULL,
  3585.  			     NULL, &vm->page_directory);
  3586. -	if (r)
  3587. +	if (r) {
  3588. +		kfree(vm->page_tables);
  3589. +		vm->page_tables = NULL;
  3590.  		return r;
  3591. -
  3592. +	}
  3593.  	r = radeon_vm_clear_bo(rdev, vm->page_directory);
  3594.  	if (r) {
  3595.  		radeon_bo_unref(&vm->page_directory);
  3596.  		vm->page_directory = NULL;
  3597. +		kfree(vm->page_tables);
  3598. +		vm->page_tables = NULL;
  3599.  		return r;
  3600.  	}
  3601.  
  3602. diff --git drivers/gpu/drm/radeon/si.c drivers/gpu/drm/radeon/si.c
  3603. index 1144cafea9ac..6dc20e790556 100644
  3604. --- linux-4.14.336/drivers/gpu/drm/radeon/si.c
  3605. +++ linux-4.14.336/drivers/gpu/drm/radeon/si.c
  3606. @@ -3612,6 +3612,10 @@ static int si_cp_start(struct radeon_device *rdev)
  3607.  	for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
  3608.  		ring = &rdev->ring[i];
  3609.  		r = radeon_ring_lock(rdev, ring, 2);
  3610. +		if (r) {
  3611. +			DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
  3612. +			return r;
  3613. +		}
  3614.  
  3615.  		/* clear the compute context state */
  3616.  		radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));
  3617. diff --git drivers/gpu/drm/radeon/sumo_dpm.c drivers/gpu/drm/radeon/sumo_dpm.c
  3618. index fd4804829e46..258cca4ae59b 100644
  3619. --- linux-4.14.336/drivers/gpu/drm/radeon/sumo_dpm.c
  3620. +++ linux-4.14.336/drivers/gpu/drm/radeon/sumo_dpm.c
  3621. @@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
  3622.  		non_clock_array_index = power_state->v2.nonClockInfoIndex;
  3623.  		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
  3624.  			&non_clock_info_array->nonClockInfo[non_clock_array_index];
  3625. -		if (!rdev->pm.power_state[i].clock_info)
  3626. +		if (!rdev->pm.power_state[i].clock_info) {
  3627. +			kfree(rdev->pm.dpm.ps);
  3628.  			return -EINVAL;
  3629. +		}
  3630.  		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
  3631.  		if (ps == NULL) {
  3632.  			kfree(rdev->pm.dpm.ps);
  3633. diff --git drivers/gpu/drm/radeon/trinity_dpm.c drivers/gpu/drm/radeon/trinity_dpm.c
  3634. index 2ef7c4e5e495..8fcb7466bf8c 100644
  3635. --- linux-4.14.336/drivers/gpu/drm/radeon/trinity_dpm.c
  3636. +++ linux-4.14.336/drivers/gpu/drm/radeon/trinity_dpm.c
  3637. @@ -1768,8 +1768,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
  3638.  		non_clock_array_index = power_state->v2.nonClockInfoIndex;
  3639.  		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
  3640.  			&non_clock_info_array->nonClockInfo[non_clock_array_index];
  3641. -		if (!rdev->pm.power_state[i].clock_info)
  3642. +		if (!rdev->pm.power_state[i].clock_info) {
  3643. +			kfree(rdev->pm.dpm.ps);
  3644.  			return -EINVAL;
  3645. +		}
  3646.  		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
  3647.  		if (ps == NULL) {
  3648.  			kfree(rdev->pm.dpm.ps);
  3649. diff --git drivers/hid/hid-apple.c drivers/hid/hid-apple.c
  3650. index 80ecbf14d3c8..8ba8f76c92c0 100644
  3651. --- linux-4.14.336/drivers/hid/hid-apple.c
  3652. +++ linux-4.14.336/drivers/hid/hid-apple.c
  3653. @@ -54,6 +54,12 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
  3654.  		"(For people who want to keep Windows PC keyboard muscle memory. "
  3655.  		"[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
  3656.  
  3657. +static unsigned int swap_fn_leftctrl;
  3658. +module_param(swap_fn_leftctrl, uint, 0644);
  3659. +MODULE_PARM_DESC(swap_fn_leftctrl, "Swap the Fn and left Control keys. "
  3660. +		"(For people who want to keep PC keyboard muscle memory. "
  3661. +		"[0] = as-is, Mac layout, 1 = swapped, PC layout)");
  3662. +
  3663.  struct apple_sc {
  3664.  	unsigned long quirks;
  3665.  	unsigned int fn_on;
  3666. @@ -67,6 +73,28 @@ struct apple_key_translation {
  3667.  	u8 flags;
  3668.  };
  3669.  
  3670. +static const struct apple_key_translation apple2021_fn_keys[] = {
  3671. +	{ KEY_BACKSPACE, KEY_DELETE },
  3672. +	{ KEY_ENTER,	KEY_INSERT },
  3673. +	{ KEY_F1,	KEY_BRIGHTNESSDOWN, APPLE_FLAG_FKEY },
  3674. +	{ KEY_F2,	KEY_BRIGHTNESSUP,   APPLE_FLAG_FKEY },
  3675. +	{ KEY_F3,	KEY_SCALE,          APPLE_FLAG_FKEY },
  3676. +	{ KEY_F4,	KEY_SEARCH,         APPLE_FLAG_FKEY },
  3677. +	{ KEY_F5,	KEY_MICMUTE,        APPLE_FLAG_FKEY },
  3678. +	{ KEY_F6,	KEY_SLEEP,          APPLE_FLAG_FKEY },
  3679. +	{ KEY_F7,	KEY_PREVIOUSSONG,   APPLE_FLAG_FKEY },
  3680. +	{ KEY_F8,	KEY_PLAYPAUSE,      APPLE_FLAG_FKEY },
  3681. +	{ KEY_F9,	KEY_NEXTSONG,       APPLE_FLAG_FKEY },
  3682. +	{ KEY_F10,	KEY_MUTE,           APPLE_FLAG_FKEY },
  3683. +	{ KEY_F11,	KEY_VOLUMEDOWN,     APPLE_FLAG_FKEY },
  3684. +	{ KEY_F12,	KEY_VOLUMEUP,       APPLE_FLAG_FKEY },
  3685. +	{ KEY_UP,	KEY_PAGEUP },
  3686. +	{ KEY_DOWN,	KEY_PAGEDOWN },
  3687. +	{ KEY_LEFT,	KEY_HOME },
  3688. +	{ KEY_RIGHT,	KEY_END },
  3689. +	{ }
  3690. +};
  3691. +
  3692.  static const struct apple_key_translation macbookair_fn_keys[] = {
  3693.  	{ KEY_BACKSPACE, KEY_DELETE },
  3694.  	{ KEY_ENTER,	KEY_INSERT },
  3695. @@ -166,6 +194,11 @@ static const struct apple_key_translation swapped_option_cmd_keys[] = {
  3696.  	{ }
  3697.  };
  3698.  
  3699. +static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
  3700. +	{ KEY_FN, KEY_LEFTCTRL },
  3701. +	{ }
  3702. +};
  3703. +
  3704.  static const struct apple_key_translation *apple_find_translation(
  3705.  		const struct apple_key_translation *table, u16 from)
  3706.  {
  3707. @@ -187,14 +220,18 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
  3708.  	bool do_translate;
  3709.  	u16 code = 0;
  3710.  
  3711. -	if (usage->code == KEY_FN) {
  3712. +	u16 fn_keycode = (swap_fn_leftctrl) ? (KEY_LEFTCTRL) : (KEY_FN);
  3713. +
  3714. +	if (usage->code == fn_keycode) {
  3715.  		asc->fn_on = !!value;
  3716. -		input_event(input, usage->type, usage->code, value);
  3717. +		input_event(input, usage->type, KEY_FN, value);
  3718.  		return 1;
  3719.  	}
  3720.  
  3721.  	if (fnmode) {
  3722. -		if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
  3723. +		if (hid->product == USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021)
  3724. +			table = apple2021_fn_keys;
  3725. +		else if (hid->product >= USB_DEVICE_ID_APPLE_WELLSPRING4_ANSI &&
  3726.  				hid->product <= USB_DEVICE_ID_APPLE_WELLSPRING4A_JIS)
  3727.  			table = macbookair_fn_keys;
  3728.  		else if (hid->product < 0x21d || hid->product >= 0x300)
  3729. @@ -274,6 +311,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
  3730.  		}
  3731.  	}
  3732.  
  3733. +	if (swap_fn_leftctrl) {
  3734. +		trans = apple_find_translation(swapped_fn_leftctrl_keys, usage->code);
  3735. +		if (trans) {
  3736. +			input_event(input, usage->type, trans->to, value);
  3737. +			return 1;
  3738. +		}
  3739. +	}
  3740. +
  3741.  	return 0;
  3742.  }
  3743.  
  3744. @@ -344,6 +389,14 @@ static void apple_setup_input(struct input_dev *input)
  3745.  
  3746.  	for (trans = apple_iso_keyboard; trans->from; trans++)
  3747.  		set_bit(trans->to, input->keybit);
  3748. +
  3749. +	for (trans = apple2021_fn_keys; trans->from; trans++)
  3750. +		set_bit(trans->to, input->keybit);
  3751. +
  3752. +	if (swap_fn_leftctrl) {
  3753. +		for (trans = swapped_fn_leftctrl_keys; trans->from; trans++)
  3754. +			set_bit(trans->to, input->keybit);
  3755. +	}
  3756.  }
  3757.  
  3758.  static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
  3759. @@ -599,6 +652,10 @@ static const struct hid_device_id apple_devices[] = {
  3760.  		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
  3761.  	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY),
  3762.  		.driver_data = APPLE_NUMLOCK_EMULATION | APPLE_HAS_FN },
  3763. +	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
  3764. +		.driver_data = APPLE_HAS_FN },
  3765. +	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021),
  3766. +		.driver_data = APPLE_HAS_FN },
  3767.  
  3768.  	{ }
  3769.  };
  3770. diff --git drivers/hid/hid-core.c drivers/hid/hid-core.c
  3771. index fe3824a6af5c..9bfae325a410 100644
  3772. --- linux-4.14.336/drivers/hid/hid-core.c
  3773. +++ linux-4.14.336/drivers/hid/hid-core.c
  3774. @@ -2063,6 +2063,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
  3775.  	{ HID_BLUETOOTH_DEVICE(BT_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_NUMPAD_ANSI) },
  3776.  	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
  3777.  	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
  3778. +	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021) },
  3779.  #endif
  3780.  #if IS_ENABLED(CONFIG_HID_APPLEIR)
  3781.  	{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_IRCONTROL) },
  3782. diff --git drivers/hid/hid-ids.h drivers/hid/hid-ids.h
  3783. index 26db838be5a2..1b89c9185c14 100644
  3784. --- linux-4.14.336/drivers/hid/hid-ids.h
  3785. +++ linux-4.14.336/drivers/hid/hid-ids.h
  3786. @@ -172,6 +172,7 @@
  3787.  #define USB_DEVICE_ID_APPLE_IRCONTROL3	0x8241
  3788.  #define USB_DEVICE_ID_APPLE_IRCONTROL4	0x8242
  3789.  #define USB_DEVICE_ID_APPLE_IRCONTROL5	0x8243
  3790. +#define USB_DEVICE_ID_APPLE_MAGIC_KEYBOARD_2021   0x029c
  3791.  
  3792.  #define USB_VENDOR_ID_ASUS		0x0486
  3793.  #define USB_DEVICE_ID_ASUS_T91MT	0x0185
  3794. diff --git drivers/hid/wacom_sys.c drivers/hid/wacom_sys.c
  3795. index 3ca50505c78c..b4c25afb3a36 100644
  3796. --- linux-4.14.336/drivers/hid/wacom_sys.c
  3797. +++ linux-4.14.336/drivers/hid/wacom_sys.c
  3798. @@ -1920,7 +1920,7 @@ static int wacom_allocate_inputs(struct wacom *wacom)
  3799.  	return 0;
  3800.  }
  3801.  
  3802. -static int wacom_register_inputs(struct wacom *wacom)
  3803. +static int wacom_setup_inputs(struct wacom *wacom)
  3804.  {
  3805.  	struct input_dev *pen_input_dev, *touch_input_dev, *pad_input_dev;
  3806.  	struct wacom_wac *wacom_wac = &(wacom->wacom_wac);
  3807. @@ -1939,10 +1939,6 @@ static int wacom_register_inputs(struct wacom *wacom)
  3808.  		input_free_device(pen_input_dev);
  3809.  		wacom_wac->pen_input = NULL;
  3810.  		pen_input_dev = NULL;
  3811. -	} else {
  3812. -		error = input_register_device(pen_input_dev);
  3813. -		if (error)
  3814. -			goto fail;
  3815.  	}
  3816.  
  3817.  	error = wacom_setup_touch_input_capabilities(touch_input_dev, wacom_wac);
  3818. @@ -1951,10 +1947,6 @@ static int wacom_register_inputs(struct wacom *wacom)
  3819.  		input_free_device(touch_input_dev);
  3820.  		wacom_wac->touch_input = NULL;
  3821.  		touch_input_dev = NULL;
  3822. -	} else {
  3823. -		error = input_register_device(touch_input_dev);
  3824. -		if (error)
  3825. -			goto fail;
  3826.  	}
  3827.  
  3828.  	error = wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac);
  3829. @@ -1963,7 +1955,34 @@ static int wacom_register_inputs(struct wacom *wacom)
  3830.  		input_free_device(pad_input_dev);
  3831.  		wacom_wac->pad_input = NULL;
  3832.  		pad_input_dev = NULL;
  3833. -	} else {
  3834. +	}
  3835. +
  3836. +	return 0;
  3837. +}
  3838. +
  3839. +static int wacom_register_inputs(struct wacom *wacom)
  3840. +{
  3841. +	struct input_dev *pen_input_dev, *touch_input_dev, *pad_input_dev;
  3842. +	struct wacom_wac *wacom_wac = &(wacom->wacom_wac);
  3843. +	int error = 0;
  3844. +
  3845. +	pen_input_dev = wacom_wac->pen_input;
  3846. +	touch_input_dev = wacom_wac->touch_input;
  3847. +	pad_input_dev = wacom_wac->pad_input;
  3848. +
  3849. +	if (pen_input_dev) {
  3850. +		error = input_register_device(pen_input_dev);
  3851. +		if (error)
  3852. +			goto fail;
  3853. +	}
  3854. +
  3855. +	if (touch_input_dev) {
  3856. +		error = input_register_device(touch_input_dev);
  3857. +		if (error)
  3858. +			goto fail;
  3859. +	}
  3860. +
  3861. +	if (pad_input_dev) {
  3862.  		error = input_register_device(pad_input_dev);
  3863.  		if (error)
  3864.  			goto fail;
  3865. @@ -2213,6 +2232,20 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
  3866.  			goto fail;
  3867.  	}
  3868.  
  3869. +	error = wacom_setup_inputs(wacom);
  3870. +	if (error)
  3871. +		goto fail;
  3872. +
  3873. +	if (features->type == HID_GENERIC)
  3874. +		connect_mask |= HID_CONNECT_DRIVER;
  3875. +
  3876. +	/* Regular HID work starts now */
  3877. +	error = hid_hw_start(hdev, connect_mask);
  3878. +	if (error) {
  3879. +		hid_err(hdev, "hw start failed\n");
  3880. +		goto fail;
  3881. +	}
  3882. +
  3883.  	error = wacom_register_inputs(wacom);
  3884.  	if (error)
  3885.  		goto fail;
  3886. @@ -2227,16 +2260,6 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless)
  3887.  			goto fail;
  3888.  	}
  3889.  
  3890. -	if (features->type == HID_GENERIC)
  3891. -		connect_mask |= HID_CONNECT_DRIVER;
  3892. -
  3893. -	/* Regular HID work starts now */
  3894. -	error = hid_hw_start(hdev, connect_mask);
  3895. -	if (error) {
  3896. -		hid_err(hdev, "hw start failed\n");
  3897. -		goto fail;
  3898. -	}
  3899. -
  3900.  	if (!wireless) {
  3901.  		/* Note that if query fails it is not a hard failure */
  3902.  		wacom_query_tablet_data(wacom);
  3903. diff --git drivers/hid/wacom_wac.c drivers/hid/wacom_wac.c
  3904. index 19a798eb395c..eb39c88b5eac 100644
  3905. --- linux-4.14.336/drivers/hid/wacom_wac.c
  3906. +++ linux-4.14.336/drivers/hid/wacom_wac.c
  3907. @@ -2317,7 +2317,14 @@ static void wacom_wac_pen_report(struct hid_device *hdev,
  3908.  				wacom_wac->hid_data.tipswitch);
  3909.  		input_report_key(input, wacom_wac->tool[0], prox);
  3910.  		if (wacom_wac->serial[0]) {
  3911. -			input_event(input, EV_MSC, MSC_SERIAL, wacom_wac->serial[0]);
  3912. +			/*
  3913. +			 * xf86-input-wacom does not accept a serial number
  3914. +			 * of '0'. Report the low 32 bits if possible, but
  3915. +			 * if they are zero, report the upper ones instead.
  3916. +			 */
  3917. +			__u32 serial_lo = wacom_wac->serial[0] & 0xFFFFFFFFu;
  3918. +			__u32 serial_hi = wacom_wac->serial[0] >> 32;
  3919. +			input_event(input, EV_MSC, MSC_SERIAL, (int)(serial_lo ? serial_lo : serial_hi));
  3920.  			input_report_abs(input, ABS_MISC, prox ? id : 0);
  3921.  		}
  3922.  
  3923. @@ -2389,8 +2396,8 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
  3924.  {
  3925.  	struct hid_data *hid_data = &wacom_wac->hid_data;
  3926.  	bool mt = wacom_wac->features.touch_max > 1;
  3927. -	bool prox = hid_data->tipswitch &&
  3928. -		    report_touch_events(wacom_wac);
  3929. +	bool touch_down = hid_data->tipswitch && hid_data->confidence;
  3930. +	bool prox = touch_down && report_touch_events(wacom_wac);
  3931.  
  3932.  	if (wacom_wac->shared->has_mute_touch_switch &&
  3933.  	    !wacom_wac->shared->is_touch_on) {
  3934. @@ -2429,24 +2436,6 @@ static void wacom_wac_finger_slot(struct wacom_wac *wacom_wac,
  3935.  	}
  3936.  }
  3937.  
  3938. -static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
  3939. -{
  3940. -	struct input_mt *mt = dev->mt;
  3941. -	struct input_mt_slot *s;
  3942. -
  3943. -	if (!mt)
  3944. -		return false;
  3945. -
  3946. -	for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
  3947. -		if (s->key == key &&
  3948. -			input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
  3949. -			return true;
  3950. -		}
  3951. -	}
  3952. -
  3953. -	return false;
  3954. -}
  3955. -
  3956.  static void wacom_wac_finger_event(struct hid_device *hdev,
  3957.  		struct hid_field *field, struct hid_usage *usage, __s32 value)
  3958.  {
  3959. @@ -2489,14 +2478,8 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
  3960.  
  3961.  
  3962.  	if (usage->usage_index + 1 == field->report_count) {
  3963. -		if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
  3964. -			bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
  3965. -				wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
  3966. -
  3967. -			if (wacom_wac->hid_data.confidence || touch_removed) {
  3968. -				wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
  3969. -			}
  3970. -		}
  3971. +		if (equivalent_usage == wacom_wac->hid_data.last_slot_field)
  3972. +			wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
  3973.  	}
  3974.  }
  3975.  
  3976. diff --git drivers/hwmon/aspeed-pwm-tacho.c drivers/hwmon/aspeed-pwm-tacho.c
  3977. index e4337e9dda44..922c5930373b 100644
  3978. --- linux-4.14.336/drivers/hwmon/aspeed-pwm-tacho.c
  3979. +++ linux-4.14.336/drivers/hwmon/aspeed-pwm-tacho.c
  3980. @@ -195,6 +195,8 @@ struct aspeed_pwm_tacho_data {
  3981.  	u8 fan_tach_ch_source[16];
  3982.  	struct aspeed_cooling_device *cdev[8];
  3983.  	const struct attribute_group *groups[3];
  3984. +	/* protects access to shared ASPEED_PTCR_RESULT */
  3985. +	struct mutex tach_lock;
  3986.  };
  3987.  
  3988.  enum type { TYPEM, TYPEN, TYPEO };
  3989. @@ -529,6 +531,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
  3990.  	u8 fan_tach_ch_source, type, mode, both;
  3991.  	int ret;
  3992.  
  3993. +	mutex_lock(&priv->tach_lock);
  3994. +
  3995.  	regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0);
  3996.  	regmap_write(priv->regmap, ASPEED_PTCR_TRIGGER, 0x1 << fan_tach_ch);
  3997.  
  3998. @@ -546,6 +550,8 @@ static int aspeed_get_fan_tach_ch_rpm(struct aspeed_pwm_tacho_data *priv,
  3999.  		ASPEED_RPM_STATUS_SLEEP_USEC,
  4000.  		usec);
  4001.  
  4002. +	mutex_unlock(&priv->tach_lock);
  4003. +
  4004.  	/* return -ETIMEDOUT if we didn't get an answer. */
  4005.  	if (ret)
  4006.  		return ret;
  4007. @@ -929,6 +935,7 @@ static int aspeed_pwm_tacho_probe(struct platform_device *pdev)
  4008.  	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
  4009.  	if (!priv)
  4010.  		return -ENOMEM;
  4011. +	mutex_init(&priv->tach_lock);
  4012.  	priv->regmap = devm_regmap_init(dev, NULL, (__force void *)regs,
  4013.  			&aspeed_pwm_tacho_regmap_config);
  4014.  	if (IS_ERR(priv->regmap))
  4015. diff --git drivers/hwmon/coretemp.c drivers/hwmon/coretemp.c
  4016. index 770bf76a5348..532cc7286cf0 100644
  4017. --- linux-4.14.336/drivers/hwmon/coretemp.c
  4018. +++ linux-4.14.336/drivers/hwmon/coretemp.c
  4019. @@ -53,7 +53,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
  4020.  
  4021.  #define PKG_SYSFS_ATTR_NO	1	/* Sysfs attribute for package temp */
  4022.  #define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
  4023. -#define NUM_REAL_CORES		128	/* Number of Real cores per cpu */
  4024. +#define NUM_REAL_CORES		512	/* Number of Real cores per cpu */
  4025.  #define CORETEMP_NAME_LENGTH	19	/* String Length of attrs */
  4026.  #define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
  4027.  #define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
  4028. diff --git drivers/hwtracing/coresight/coresight-etm4x.h drivers/hwtracing/coresight/coresight-etm4x.h
  4029. index b3b5ea7b7fb3..d48c40d8fc28 100644
  4030. --- linux-4.14.336/drivers/hwtracing/coresight/coresight-etm4x.h
  4031. +++ linux-4.14.336/drivers/hwtracing/coresight/coresight-etm4x.h
  4032. @@ -373,7 +373,7 @@ struct etmv4_drvdata {
  4033.  	u8				ctxid_size;
  4034.  	u8				vmid_size;
  4035.  	u8				ccsize;
  4036. -	u8				ccitmin;
  4037. +	u16				ccitmin;
  4038.  	u8				s_ex_level;
  4039.  	u8				ns_ex_level;
  4040.  	u8				q_support;
  4041. diff --git drivers/i2c/busses/i2c-s3c2410.c drivers/i2c/busses/i2c-s3c2410.c
  4042. index 911f8628128e..299d8f388d62 100644
  4043. --- linux-4.14.336/drivers/i2c/busses/i2c-s3c2410.c
  4044. +++ linux-4.14.336/drivers/i2c/busses/i2c-s3c2410.c
  4045. @@ -235,8 +235,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c)
  4046.  	int tries;
  4047.  
  4048.  	for (tries = 50; tries; --tries) {
  4049. -		if (readl(i2c->regs + S3C2410_IICCON)
  4050. -			& S3C2410_IICCON_IRQPEND) {
  4051. +		unsigned long tmp = readl(i2c->regs + S3C2410_IICCON);
  4052. +
  4053. +		if (!(tmp & S3C2410_IICCON_ACKEN)) {
  4054. +			/*
  4055. +			 * Wait a bit for the bus to stabilize,
  4056. +			 * delay estimated experimentally.
  4057. +			 */
  4058. +			usleep_range(100, 200);
  4059. +			return true;
  4060. +		}
  4061. +		if (tmp & S3C2410_IICCON_IRQPEND) {
  4062.  			if (!(readl(i2c->regs + S3C2410_IICSTAT)
  4063.  				& S3C2410_IICSTAT_LASTBIT))
  4064.  				return true;
  4065. @@ -289,16 +298,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c,
  4066.  
  4067.  	stat |= S3C2410_IICSTAT_START;
  4068.  	writel(stat, i2c->regs + S3C2410_IICSTAT);
  4069. -
  4070. -	if (i2c->quirks & QUIRK_POLL) {
  4071. -		while ((i2c->msg_num != 0) && is_ack(i2c)) {
  4072. -			i2c_s3c_irq_nextbyte(i2c, stat);
  4073. -			stat = readl(i2c->regs + S3C2410_IICSTAT);
  4074. -
  4075. -			if (stat & S3C2410_IICSTAT_ARBITR)
  4076. -				dev_err(i2c->dev, "deal with arbitration loss\n");
  4077. -		}
  4078. -	}
  4079.  }
  4080.  
  4081.  static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret)
  4082. @@ -705,7 +704,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c)
  4083.  static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
  4084.  			      struct i2c_msg *msgs, int num)
  4085.  {
  4086. -	unsigned long timeout;
  4087. +	unsigned long timeout = 0;
  4088.  	int ret;
  4089.  
  4090.  	if (i2c->suspended)
  4091. @@ -728,16 +727,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
  4092.  	s3c24xx_i2c_message_start(i2c, msgs);
  4093.  
  4094.  	if (i2c->quirks & QUIRK_POLL) {
  4095. -		ret = i2c->msg_idx;
  4096. +		while ((i2c->msg_num != 0) && is_ack(i2c)) {
  4097. +			unsigned long stat = readl(i2c->regs + S3C2410_IICSTAT);
  4098.  
  4099. -		if (ret != num)
  4100. -			dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret);
  4101. +			i2c_s3c_irq_nextbyte(i2c, stat);
  4102.  
  4103. -		goto out;
  4104. +			stat = readl(i2c->regs + S3C2410_IICSTAT);
  4105. +			if (stat & S3C2410_IICSTAT_ARBITR)
  4106. +				dev_err(i2c->dev, "deal with arbitration loss\n");
  4107. +		}
  4108. +	} else {
  4109. +		timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
  4110.  	}
  4111.  
  4112. -	timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
  4113. -
  4114.  	ret = i2c->msg_idx;
  4115.  
  4116.  	/*
  4117. diff --git drivers/infiniband/hw/hfi1/pio.c drivers/infiniband/hw/hfi1/pio.c
  4118. index 07bf282fd8aa..162f4cb4851a 100644
  4119. --- linux-4.14.336/drivers/infiniband/hw/hfi1/pio.c
  4120. +++ linux-4.14.336/drivers/infiniband/hw/hfi1/pio.c
  4121. @@ -2133,7 +2133,7 @@ int init_credit_return(struct hfi1_devdata *dd)
  4122.  				   "Unable to allocate credit return DMA range for NUMA %d\n",
  4123.  				   i);
  4124.  			ret = -ENOMEM;
  4125. -			goto done;
  4126. +			goto free_cr_base;
  4127.  		}
  4128.  	}
  4129.  	set_dev_node(&dd->pcidev->dev, dd->node);
  4130. @@ -2141,6 +2141,10 @@ int init_credit_return(struct hfi1_devdata *dd)
  4131.  	ret = 0;
  4132.  done:
  4133.  	return ret;
  4134. +
  4135. +free_cr_base:
  4136. +	free_credit_return(dd);
  4137. +	goto done;
  4138.  }
  4139.  
  4140.  void free_credit_return(struct hfi1_devdata *dd)
  4141. diff --git drivers/infiniband/hw/mthca/mthca_cmd.c drivers/infiniband/hw/mthca/mthca_cmd.c
  4142. index 419a2a20c047..7df5155cdb48 100644
  4143. --- linux-4.14.336/drivers/infiniband/hw/mthca/mthca_cmd.c
  4144. +++ linux-4.14.336/drivers/infiniband/hw/mthca/mthca_cmd.c
  4145. @@ -641,7 +641,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)
  4146.  
  4147.  int mthca_SYS_EN(struct mthca_dev *dev)
  4148.  {
  4149. -	u64 out;
  4150. +	u64 out = 0;
  4151.  	int ret;
  4152.  
  4153.  	ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
  4154. @@ -1961,7 +1961,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,
  4155.  int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
  4156.  		    u16 *hash)
  4157.  {
  4158. -	u64 imm;
  4159. +	u64 imm = 0;
  4160.  	int err;
  4161.  
  4162.  	err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,
  4163. diff --git drivers/infiniband/hw/mthca/mthca_main.c drivers/infiniband/hw/mthca/mthca_main.c
  4164. index ccf50dafce9c..66a85f757a2f 100644
  4165. --- linux-4.14.336/drivers/infiniband/hw/mthca/mthca_main.c
  4166. +++ linux-4.14.336/drivers/infiniband/hw/mthca/mthca_main.c
  4167. @@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
  4168.  			  struct mthca_init_hca_param *init_hca,
  4169.  			  u64 icm_size)
  4170.  {
  4171. -	u64 aux_pages;
  4172. +	u64 aux_pages = 0;
  4173.  	int err;
  4174.  
  4175.  	err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages);
  4176. diff --git drivers/infiniband/ulp/ipoib/ipoib_multicast.c drivers/infiniband/ulp/ipoib/ipoib_multicast.c
  4177. index 9b3f47ae2016..25d7d9219591 100644
  4178. --- linux-4.14.336/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
  4179. +++ linux-4.14.336/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
  4180. @@ -543,21 +543,18 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
  4181.  			/* SM supports sendonly-fullmember, otherwise fallback to full-member */
  4182.  			rec.join_state = SENDONLY_FULLMEMBER_JOIN;
  4183.  	}
  4184. -	spin_unlock_irq(&priv->lock);
  4185.  
  4186.  	multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
  4187. -					 &rec, comp_mask, GFP_KERNEL,
  4188. +					 &rec, comp_mask, GFP_ATOMIC,
  4189.  					 ipoib_mcast_join_complete, mcast);
  4190. -	spin_lock_irq(&priv->lock);
  4191.  	if (IS_ERR(multicast)) {
  4192.  		ret = PTR_ERR(multicast);
  4193.  		ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
  4194.  		/* Requeue this join task with a backoff delay */
  4195.  		__ipoib_mcast_schedule_join_thread(priv, mcast, 1);
  4196.  		clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
  4197. -		spin_unlock_irq(&priv->lock);
  4198.  		complete(&mcast->done);
  4199. -		spin_lock_irq(&priv->lock);
  4200. +		return ret;
  4201.  	}
  4202.  	return 0;
  4203.  }
  4204. diff --git drivers/infiniband/ulp/srpt/ib_srpt.c drivers/infiniband/ulp/srpt/ib_srpt.c
  4205. index 1446e1cc69ae..08343e6116d2 100644
  4206. --- linux-4.14.336/drivers/infiniband/ulp/srpt/ib_srpt.c
  4207. +++ linux-4.14.336/drivers/infiniband/ulp/srpt/ib_srpt.c
  4208. @@ -80,12 +80,16 @@ module_param(srpt_srq_size, int, 0444);
  4209.  MODULE_PARM_DESC(srpt_srq_size,
  4210.  		 "Shared receive queue (SRQ) size.");
  4211.  
  4212. +static int srpt_set_u64_x(const char *buffer, struct kernel_param *kp)
  4213. +{
  4214. +	return kstrtou64(buffer, 16, (u64 *)kp->arg);
  4215. +}
  4216.  static int srpt_get_u64_x(char *buffer, struct kernel_param *kp)
  4217.  {
  4218.  	return sprintf(buffer, "0x%016llx", *(u64 *)kp->arg);
  4219.  }
  4220. -module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid,
  4221. -		  0444);
  4222. +module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x,
  4223. +		  &srpt_service_guid, 0444);
  4224.  MODULE_PARM_DESC(srpt_service_guid,
  4225.  		 "Using this value for ioc_guid, id_ext, and cm_listen_id"
  4226.  		 " instead of using the node_guid of the first HCA.");
  4227. @@ -196,8 +200,10 @@ static const char *get_ch_state_name(enum rdma_ch_state s)
  4228.  /**
  4229.   * srpt_qp_event() - QP event callback function.
  4230.   */
  4231. -static void srpt_qp_event(struct ib_event *event, struct srpt_rdma_ch *ch)
  4232. +static void srpt_qp_event(struct ib_event *event, void *ptr)
  4233.  {
  4234. +	struct srpt_rdma_ch *ch = ptr;
  4235. +
  4236.  	pr_debug("QP event %d on cm_id=%p sess_name=%s state=%d\n",
  4237.  		 event->event, ch->cm_id, ch->sess_name, ch->state);
  4238.  
  4239. @@ -1663,8 +1669,7 @@ retry:
  4240.  	}
  4241.  
  4242.  	qp_init->qp_context = (void *)ch;
  4243. -	qp_init->event_handler
  4244. -		= (void(*)(struct ib_event *, void*))srpt_qp_event;
  4245. +	qp_init->event_handler = srpt_qp_event;
  4246.  	qp_init->send_cq = ch->cq;
  4247.  	qp_init->recv_cq = ch->cq;
  4248.  	qp_init->srq = sdev->srq;
  4249. diff --git drivers/input/joystick/xpad.c drivers/input/joystick/xpad.c
  4250. index 1dbe30335458..3fedc3688e8f 100644
  4251. --- linux-4.14.336/drivers/input/joystick/xpad.c
  4252. +++ linux-4.14.336/drivers/input/joystick/xpad.c
  4253. @@ -282,6 +282,7 @@ static const struct xpad_device {
  4254.  	{ 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
  4255.  	{ 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
  4256.  	{ 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
  4257. +	{ 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
  4258.  	{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
  4259.  	{ 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
  4260.  	{ 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
  4261. diff --git drivers/input/keyboard/atkbd.c drivers/input/keyboard/atkbd.c
  4262. index 7e75835e220f..585bf7392539 100644
  4263. --- linux-4.14.336/drivers/input/keyboard/atkbd.c
  4264. +++ linux-4.14.336/drivers/input/keyboard/atkbd.c
  4265. @@ -717,6 +717,44 @@ static void atkbd_deactivate(struct atkbd *atkbd)
  4266.  			ps2dev->serio->phys);
  4267.  }
  4268.  
  4269. +#ifdef CONFIG_X86
  4270. +static bool atkbd_is_portable_device(void)
  4271. +{
  4272. +	static const char * const chassis_types[] = {
  4273. +		"8",	/* Portable */
  4274. +		"9",	/* Laptop */
  4275. +		"10",	/* Notebook */
  4276. +		"14",	/* Sub-Notebook */
  4277. +		"31",	/* Convertible */
  4278. +		"32",	/* Detachable */
  4279. +	};
  4280. +	int i;
  4281. +
  4282. +	for (i = 0; i < ARRAY_SIZE(chassis_types); i++)
  4283. +		if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i]))
  4284. +			return true;
  4285. +
  4286. +	return false;
  4287. +}
  4288. +
  4289. +/*
  4290. + * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops
  4291. + * the controller is always in translated mode. In this mode mice/touchpads will
  4292. + * not work. So in this case simply assume a keyboard is connected to avoid
  4293. + * confusing some laptop keyboards.
  4294. + *
  4295. + * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard
  4296. + * 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id
  4297. + * and in translated mode that is a no-op.
  4298. + */
  4299. +static bool atkbd_skip_getid(struct atkbd *atkbd)
  4300. +{
  4301. +	return atkbd->translated && atkbd_is_portable_device();
  4302. +}
  4303. +#else
  4304. +static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; }
  4305. +#endif
  4306. +
  4307.  /*
  4308.   * atkbd_probe() probes for an AT keyboard on a serio port.
  4309.   */
  4310. @@ -738,6 +776,11 @@ static int atkbd_probe(struct atkbd *atkbd)
  4311.  				 "keyboard reset failed on %s\n",
  4312.  				 ps2dev->serio->phys);
  4313.  
  4314. +	if (atkbd_skip_getid(atkbd)) {
  4315. +		atkbd->id = 0xab83;
  4316. +		return 0;
  4317. +	}
  4318. +
  4319.  /*
  4320.   * Then we check the keyboard ID. We should get 0xab83 under normal conditions.
  4321.   * Some keyboards report different values, but the first byte is always 0xab or
  4322. @@ -749,9 +792,9 @@ static int atkbd_probe(struct atkbd *atkbd)
  4323.  	if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
  4324.  
  4325.  /*
  4326. - * If the get ID command failed, we check if we can at least set the LEDs on
  4327. - * the keyboard. This should work on every keyboard out there. It also turns
  4328. - * the LEDs off, which we want anyway.
  4329. + * If the get ID command failed, we check if we can at least set
  4330. + * the LEDs on the keyboard. This should work on every keyboard out there.
  4331. + * It also turns the LEDs off, which we want anyway.
  4332.   */
  4333.  		param[0] = 0;
  4334.  		if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS))
  4335. diff --git drivers/irqchip/irq-brcmstb-l2.c drivers/irqchip/irq-brcmstb-l2.c
  4336. index b009b916a292..da8a426e9def 100644
  4337. --- linux-4.14.336/drivers/irqchip/irq-brcmstb-l2.c
  4338. +++ linux-4.14.336/drivers/irqchip/irq-brcmstb-l2.c
  4339. @@ -76,6 +76,9 @@ static void brcmstb_l2_intc_irq_handle(struct irq_desc *desc)
  4340.  		generic_handle_irq(irq_find_mapping(b->domain, irq));
  4341.  	} while (status);
  4342.  out:
  4343. +	/* Don't ack parent before all device writes are done */
  4344. +	wmb();
  4345. +
  4346.  	chained_irq_exit(chip, desc);
  4347.  }
  4348.  
  4349. diff --git drivers/leds/trigger/ledtrig-panic.c drivers/leds/trigger/ledtrig-panic.c
  4350. index d735526b9db4..2fc04418a87e 100644
  4351. --- linux-4.14.336/drivers/leds/trigger/ledtrig-panic.c
  4352. +++ linux-4.14.336/drivers/leds/trigger/ledtrig-panic.c
  4353. @@ -67,10 +67,13 @@ static long led_panic_blink(int state)
  4354.  
  4355.  static int __init ledtrig_panic_init(void)
  4356.  {
  4357. +	led_trigger_register_simple("panic", &trigger);
  4358. +	if (!trigger)
  4359. +		return -ENOMEM;
  4360. +
  4361.  	atomic_notifier_chain_register(&panic_notifier_list,
  4362.  				       &led_trigger_panic_nb);
  4363.  
  4364. -	led_trigger_register_simple("panic", &trigger);
  4365.  	panic_blink = led_panic_blink;
  4366.  	return 0;
  4367.  }
  4368. diff --git drivers/md/dm-crypt.c drivers/md/dm-crypt.c
  4369. index 7cc4281d5a79..966fb898f4b8 100644
  4370. --- linux-4.14.336/drivers/md/dm-crypt.c
  4371. +++ linux-4.14.336/drivers/md/dm-crypt.c
  4372. @@ -1742,6 +1742,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io)
  4373.  	io->ctx.bio_out = clone;
  4374.  	io->ctx.iter_out = clone->bi_iter;
  4375.  
  4376. +	if (crypt_integrity_aead(cc)) {
  4377. +		bio_copy_data(clone, io->base_bio);
  4378. +		io->ctx.bio_in = clone;
  4379. +		io->ctx.iter_in = clone->bi_iter;
  4380. +	}
  4381. +
  4382.  	sector += bio_sectors(clone);
  4383.  
  4384.  	crypt_inc_pending(io);
  4385. diff --git drivers/md/md.c drivers/md/md.c
  4386. index 3c2364d0d88f..07da8d7569b5 100644
  4387. --- linux-4.14.336/drivers/md/md.c
  4388. +++ linux-4.14.336/drivers/md/md.c
  4389. @@ -1018,6 +1018,7 @@ struct super_type  {
  4390.  					  struct md_rdev *refdev,
  4391.  					  int minor_version);
  4392.  	int		    (*validate_super)(struct mddev *mddev,
  4393. +					      struct md_rdev *freshest,
  4394.  					      struct md_rdev *rdev);
  4395.  	void		    (*sync_super)(struct mddev *mddev,
  4396.  					  struct md_rdev *rdev);
  4397. @@ -1144,8 +1145,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
  4398.  
  4399.  /*
  4400.   * validate_super for 0.90.0
  4401. + * note: we are not using "freshest" for 0.9 superblock
  4402.   */
  4403. -static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
  4404. +static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
  4405.  {
  4406.  	mdp_disk_t *desc;
  4407.  	mdp_super_t *sb = page_address(rdev->sb_page);
  4408. @@ -1649,7 +1651,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
  4409.  	return ret;
  4410.  }
  4411.  
  4412. -static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
  4413. +static int super_1_validate(struct mddev *mddev, struct md_rdev *freshest, struct md_rdev *rdev)
  4414.  {
  4415.  	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
  4416.  	__u64 ev1 = le64_to_cpu(sb->events);
  4417. @@ -1745,13 +1747,15 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
  4418.  		}
  4419.  	} else if (mddev->pers == NULL) {
  4420.  		/* Insist of good event counter while assembling, except for
  4421. -		 * spares (which don't need an event count) */
  4422. -		++ev1;
  4423. +		 * spares (which don't need an event count).
  4424. +		 * Similar to mdadm, we allow event counter difference of 1
  4425. +		 * from the freshest device.
  4426. +		 */
  4427.  		if (rdev->desc_nr >= 0 &&
  4428.  		    rdev->desc_nr < le32_to_cpu(sb->max_dev) &&
  4429.  		    (le16_to_cpu(sb->dev_roles[rdev->desc_nr]) < MD_DISK_ROLE_MAX ||
  4430.  		     le16_to_cpu(sb->dev_roles[rdev->desc_nr]) == MD_DISK_ROLE_JOURNAL))
  4431. -			if (ev1 < mddev->events)
  4432. +			if (ev1 + 1 < mddev->events)
  4433.  				return -EINVAL;
  4434.  	} else if (mddev->bitmap) {
  4435.  		/* If adding to array with a bitmap, then we can accept an
  4436. @@ -1772,8 +1776,38 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
  4437.  		    rdev->desc_nr >= le32_to_cpu(sb->max_dev)) {
  4438.  			role = MD_DISK_ROLE_SPARE;
  4439.  			rdev->desc_nr = -1;
  4440. -		} else
  4441. +		} else if (mddev->pers == NULL && freshest && ev1 < mddev->events) {
  4442. +			/*
  4443. +			 * If we are assembling, and our event counter is smaller than the
  4444. +			 * highest event counter, we cannot trust our superblock about the role.
  4445. +			 * It could happen that our rdev was marked as Faulty, and all other
  4446. +			 * superblocks were updated with +1 event counter.
  4447. +			 * Then, before the next superblock update, which typically happens when
  4448. +			 * remove_and_add_spares() removes the device from the array, there was
  4449. +			 * a crash or reboot.
  4450. +			 * If we allow current rdev without consulting the freshest superblock,
  4451. +			 * we could cause data corruption.
  4452. +			 * Note that in this case our event counter is smaller by 1 than the
  4453. +			 * highest, otherwise, this rdev would not be allowed into array;
  4454. +			 * both kernel and mdadm allow event counter difference of 1.
  4455. +			 */
  4456. +			struct mdp_superblock_1 *freshest_sb = page_address(freshest->sb_page);
  4457. +			u32 freshest_max_dev = le32_to_cpu(freshest_sb->max_dev);
  4458. +
  4459. +			if (rdev->desc_nr >= freshest_max_dev) {
  4460. +				/* this is unexpected, better not proceed */
  4461. +				pr_warn("md: %s: rdev[%pg]: desc_nr(%d) >= freshest(%pg)->sb->max_dev(%u)\n",
  4462. +						mdname(mddev), rdev->bdev, rdev->desc_nr,
  4463. +						freshest->bdev, freshest_max_dev);
  4464. +				return -EUCLEAN;
  4465. +			}
  4466. +
  4467. +			role = le16_to_cpu(freshest_sb->dev_roles[rdev->desc_nr]);
  4468. +			pr_debug("md: %s: rdev[%pg]: role=%d(0x%x) according to freshest %pg\n",
  4469. +				     mdname(mddev), rdev->bdev, role, role, freshest->bdev);
  4470. +		} else {
  4471.  			role = le16_to_cpu(sb->dev_roles[rdev->desc_nr]);
  4472. +		}
  4473.  		switch(role) {
  4474.  		case MD_DISK_ROLE_SPARE: /* spare */
  4475.  			break;
  4476. @@ -2667,7 +2701,7 @@ static int add_bound_rdev(struct md_rdev *rdev)
  4477.  		 * and should be added immediately.
  4478.  		 */
  4479.  		super_types[mddev->major_version].
  4480. -			validate_super(mddev, rdev);
  4481. +			validate_super(mddev, NULL/*freshest*/, rdev);
  4482.  		if (add_journal)
  4483.  			mddev_suspend(mddev);
  4484.  		err = mddev->pers->hot_add_disk(mddev, rdev);
  4485. @@ -3569,7 +3603,7 @@ static void analyze_sbs(struct mddev *mddev)
  4486.  		}
  4487.  
  4488.  	super_types[mddev->major_version].
  4489. -		validate_super(mddev, freshest);
  4490. +		validate_super(mddev, NULL/*freshest*/, freshest);
  4491.  
  4492.  	i = 0;
  4493.  	rdev_for_each_safe(rdev, tmp, mddev) {
  4494. @@ -3584,7 +3618,7 @@ static void analyze_sbs(struct mddev *mddev)
  4495.  		}
  4496.  		if (rdev != freshest) {
  4497.  			if (super_types[mddev->major_version].
  4498. -			    validate_super(mddev, rdev)) {
  4499. +			    validate_super(mddev, freshest, rdev)) {
  4500.  				pr_warn("md: kicking non-fresh %s from array!\n",
  4501.  					bdevname(rdev->bdev,b));
  4502.  				md_kick_rdev_from_array(rdev);
  4503. @@ -6424,7 +6458,7 @@ static int add_new_disk(struct mddev *mddev, mdu_disk_info_t *info)
  4504.  			rdev->saved_raid_disk = rdev->raid_disk;
  4505.  		} else
  4506.  			super_types[mddev->major_version].
  4507. -				validate_super(mddev, rdev);
  4508. +				validate_super(mddev, NULL/*freshest*/, rdev);
  4509.  		if ((info->state & (1<<MD_DISK_SYNC)) &&
  4510.  		     rdev->raid_disk != info->raid_disk) {
  4511.  			/* This was a hot-add request, but events doesn't
  4512. diff --git drivers/md/raid5.c drivers/md/raid5.c
  4513. index d2ac3d189410..6fca2df66550 100644
  4514. --- linux-4.14.336/drivers/md/raid5.c
  4515. +++ linux-4.14.336/drivers/md/raid5.c
  4516. @@ -44,7 +44,6 @@
  4517.   */
  4518.  
  4519.  #include <linux/blkdev.h>
  4520. -#include <linux/delay.h>
  4521.  #include <linux/kthread.h>
  4522.  #include <linux/raid/pq.h>
  4523.  #include <linux/async_tx.h>
  4524. @@ -6309,18 +6308,7 @@ static void raid5d(struct md_thread *thread)
  4525.  			spin_unlock_irq(&conf->device_lock);
  4526.  			md_check_recovery(mddev);
  4527.  			spin_lock_irq(&conf->device_lock);
  4528. -
  4529. -			/*
  4530. -			 * Waiting on MD_SB_CHANGE_PENDING below may deadlock
  4531. -			 * seeing md_check_recovery() is needed to clear
  4532. -			 * the flag when using mdmon.
  4533. -			 */
  4534. -			continue;
  4535.  		}
  4536. -
  4537. -		wait_event_lock_irq(mddev->sb_wait,
  4538. -			!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
  4539. -			conf->device_lock);
  4540.  	}
  4541.  	pr_debug("%d stripes handled\n", handled);
  4542.  
  4543. diff --git drivers/media/dvb-core/dvbdev.c drivers/media/dvb-core/dvbdev.c
  4544. index 1b3a54520d68..0506179a7c86 100644
  4545. --- linux-4.14.336/drivers/media/dvb-core/dvbdev.c
  4546. +++ linux-4.14.336/drivers/media/dvb-core/dvbdev.c
  4547. @@ -90,6 +90,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
  4548.  			err = file->f_op->open(inode, file);
  4549.  		up_read(&minor_rwsem);
  4550.  		mutex_unlock(&dvbdev_mutex);
  4551. +		if (err)
  4552. +			dvb_device_put(dvbdev);
  4553.  		return err;
  4554.  	}
  4555.  fail:
  4556. diff --git drivers/media/pci/ddbridge/ddbridge-main.c drivers/media/pci/ddbridge/ddbridge-main.c
  4557. index ccac7fe31336..13aab32f8048 100644
  4558. --- linux-4.14.336/drivers/media/pci/ddbridge/ddbridge-main.c
  4559. +++ linux-4.14.336/drivers/media/pci/ddbridge/ddbridge-main.c
  4560. @@ -265,7 +265,7 @@ fail:
  4561.  	ddb_unmap(dev);
  4562.  	pci_set_drvdata(pdev, NULL);
  4563.  	pci_disable_device(pdev);
  4564. -	return -1;
  4565. +	return stat;
  4566.  }
  4567.  
  4568.  /****************************************************************************/
  4569. diff --git drivers/media/usb/cx231xx/cx231xx-core.c drivers/media/usb/cx231xx/cx231xx-core.c
  4570. index f372ad3917a8..61fd934c0205 100644
  4571. --- linux-4.14.336/drivers/media/usb/cx231xx/cx231xx-core.c
  4572. +++ linux-4.14.336/drivers/media/usb/cx231xx/cx231xx-core.c
  4573. @@ -1038,6 +1038,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
  4574.  	if (!dev->video_mode.isoc_ctl.urb) {
  4575.  		dev_err(dev->dev,
  4576.  			"cannot alloc memory for usb buffers\n");
  4577. +		kfree(dma_q->p_left_data);
  4578.  		return -ENOMEM;
  4579.  	}
  4580.  
  4581. @@ -1047,6 +1048,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
  4582.  		dev_err(dev->dev,
  4583.  			"cannot allocate memory for usbtransfer\n");
  4584.  		kfree(dev->video_mode.isoc_ctl.urb);
  4585. +		kfree(dma_q->p_left_data);
  4586.  		return -ENOMEM;
  4587.  	}
  4588.  
  4589. diff --git drivers/media/usb/pvrusb2/pvrusb2-context.c drivers/media/usb/pvrusb2/pvrusb2-context.c
  4590. index d9e8481e9e28..9236463ba269 100644
  4591. --- linux-4.14.336/drivers/media/usb/pvrusb2/pvrusb2-context.c
  4592. +++ linux-4.14.336/drivers/media/usb/pvrusb2/pvrusb2-context.c
  4593. @@ -277,7 +277,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp)
  4594.  {
  4595.  	pvr2_hdw_disconnect(mp->hdw);
  4596.  	mp->disconnect_flag = !0;
  4597. -	pvr2_context_notify(mp);
  4598. +	if (!pvr2_context_shutok())
  4599. +		pvr2_context_notify(mp);
  4600.  }
  4601.  
  4602.  
  4603. diff --git drivers/media/usb/stk1160/stk1160-video.c drivers/media/usb/stk1160/stk1160-video.c
  4604. index ce8ebbe395a6..8a6cdbc36a08 100644
  4605. --- linux-4.14.336/drivers/media/usb/stk1160/stk1160-video.c
  4606. +++ linux-4.14.336/drivers/media/usb/stk1160/stk1160-video.c
  4607. @@ -117,8 +117,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
  4608.  
  4609.  	/*
  4610.  	 * TODO: These stk1160_dbg are very spammy!
  4611. -	 * We should 1) check why we are getting them
  4612. -	 * and 2) add ratelimit.
  4613. +	 * We should check why we are getting them.
  4614.  	 *
  4615.  	 * UPDATE: One of the reasons (the only one?) for getting these
  4616.  	 * is incorrect standard (mismatch between expected and configured).
  4617. @@ -161,7 +160,7 @@ void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
  4618.  
  4619.  	/* Let the bug hunt begin! sanity checks! */
  4620.  	if (lencopy < 0) {
  4621. -		stk1160_dbg("copy skipped: negative lencopy\n");
  4622. +		printk_ratelimited(KERN_DEBUG "copy skipped: negative lencopy\n");
  4623.  		return;
  4624.  	}
  4625.  
  4626. diff --git drivers/mfd/Kconfig drivers/mfd/Kconfig
  4627. index fc5e4fef89d2..7e90ed8fdb1c 100644
  4628. --- linux-4.14.336/drivers/mfd/Kconfig
  4629. +++ linux-4.14.336/drivers/mfd/Kconfig
  4630. @@ -1199,6 +1199,7 @@ config MFD_DAVINCI_VOICECODEC
  4631.  
  4632.  config MFD_TI_AM335X_TSCADC
  4633.  	tristate "TI ADC / Touch Screen chip support"
  4634. +	depends on ARCH_OMAP2PLUS || ARCH_K3 || COMPILE_TEST
  4635.  	select MFD_CORE
  4636.  	select REGMAP
  4637.  	select REGMAP_MMIO
  4638. diff --git drivers/mmc/core/mmc.c drivers/mmc/core/mmc.c
  4639. index 32bf0b47e339..69f0cc3a28bc 100644
  4640. --- linux-4.14.336/drivers/mmc/core/mmc.c
  4641. +++ linux-4.14.336/drivers/mmc/core/mmc.c
  4642. @@ -990,10 +990,12 @@ static int mmc_select_bus_width(struct mmc_card *card)
  4643.  	static unsigned ext_csd_bits[] = {
  4644.  		EXT_CSD_BUS_WIDTH_8,
  4645.  		EXT_CSD_BUS_WIDTH_4,
  4646. +		EXT_CSD_BUS_WIDTH_1,
  4647.  	};
  4648.  	static unsigned bus_widths[] = {
  4649.  		MMC_BUS_WIDTH_8,
  4650.  		MMC_BUS_WIDTH_4,
  4651. +		MMC_BUS_WIDTH_1,
  4652.  	};
  4653.  	struct mmc_host *host = card->host;
  4654.  	unsigned idx, bus_width = 0;
  4655. diff --git drivers/mtd/mtd_blkdevs.c drivers/mtd/mtd_blkdevs.c
  4656. index 9ec8f033ac5f..5a76e7c549ef 100644
  4657. --- linux-4.14.336/drivers/mtd/mtd_blkdevs.c
  4658. +++ linux-4.14.336/drivers/mtd/mtd_blkdevs.c
  4659. @@ -513,7 +513,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
  4660.  {
  4661.  	struct mtd_blktrans_ops *tr;
  4662.  
  4663. -	if (mtd->type == MTD_ABSENT)
  4664. +	if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
  4665.  		return;
  4666.  
  4667.  	list_for_each_entry(tr, &blktrans_majors, list)
  4668. @@ -556,7 +556,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
  4669.  	list_add(&tr->list, &blktrans_majors);
  4670.  
  4671.  	mtd_for_each_device(mtd)
  4672. -		if (mtd->type != MTD_ABSENT)
  4673. +		if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
  4674.  			tr->add_mtd(tr, mtd);
  4675.  
  4676.  	mutex_unlock(&mtd_table_mutex);
  4677. diff --git drivers/mtd/nand/fsl_ifc_nand.c drivers/mtd/nand/fsl_ifc_nand.c
  4678. index 0d4928161439..be7d9eb7359c 100644
  4679. --- linux-4.14.336/drivers/mtd/nand/fsl_ifc_nand.c
  4680. +++ linux-4.14.336/drivers/mtd/nand/fsl_ifc_nand.c
  4681. @@ -33,7 +33,7 @@
  4682.  
  4683.  #define ERR_BYTE		0xFF /* Value returned for read
  4684.  					bytes when read failed	*/
  4685. -#define IFC_TIMEOUT_MSECS	500  /* Maximum number of mSecs to wait
  4686. +#define IFC_TIMEOUT_MSECS	1000 /* Maximum timeout to wait
  4687.  					for IFC NAND Machine	*/
  4688.  
  4689.  struct fsl_ifc_ctrl;
  4690. diff --git drivers/net/bonding/bond_alb.c drivers/net/bonding/bond_alb.c
  4691. index 4926c3e06e4e..6cd4e024b41d 100644
  4692. --- linux-4.14.336/drivers/net/bonding/bond_alb.c
  4693. +++ linux-4.14.336/drivers/net/bonding/bond_alb.c
  4694. @@ -988,7 +988,8 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data)
  4695.  	if (netif_is_macvlan(upper) && !strict_match) {
  4696.  		tags = bond_verify_device_path(bond->dev, upper, 0);
  4697.  		if (IS_ERR_OR_NULL(tags))
  4698. -			BUG();
  4699. +			return -ENOMEM;
  4700. +
  4701.  		alb_send_lp_vid(slave, upper->dev_addr,
  4702.  				tags[0].vlan_proto, tags[0].vlan_id);
  4703.  		kfree(tags);
  4704. diff --git drivers/net/ethernet/aquantia/atlantic/aq_nic.c drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  4705. index 7a900f76c9ac..396c335909af 100644
  4706. --- linux-4.14.336/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  4707. +++ linux-4.14.336/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
  4708. @@ -884,7 +884,6 @@ int aq_nic_set_link_ksettings(struct aq_nic_s *self,
  4709.  		default:
  4710.  			err = -1;
  4711.  			goto err_exit;
  4712. -		break;
  4713.  		}
  4714.  		if (!(self->aq_hw_caps.link_speed_msk & rate)) {
  4715.  			err = -1;
  4716. diff --git drivers/net/ethernet/broadcom/bnxt/bnxt.c drivers/net/ethernet/broadcom/bnxt/bnxt.c
  4717. index ee438674d6cc..180a7ef588cf 100644
  4718. --- linux-4.14.336/drivers/net/ethernet/broadcom/bnxt/bnxt.c
  4719. +++ linux-4.14.336/drivers/net/ethernet/broadcom/bnxt/bnxt.c
  4720. @@ -7092,6 +7092,8 @@ static void bnxt_sp_task(struct work_struct *work)
  4721.  		bnxt_cfg_ntp_filters(bp);
  4722.  	if (test_and_clear_bit(BNXT_HWRM_EXEC_FWD_REQ_SP_EVENT, &bp->sp_event))
  4723.  		bnxt_hwrm_exec_fwd_req(bp);
  4724. +	if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event))
  4725. +		netdev_info(bp->dev, "Receive PF driver unload event!\n");
  4726.  	if (test_and_clear_bit(BNXT_VXLAN_ADD_PORT_SP_EVENT, &bp->sp_event)) {
  4727.  		bnxt_hwrm_tunnel_dst_port_alloc(
  4728.  			bp, bp->vxlan_port,
  4729. @@ -7583,8 +7585,6 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp)
  4730.  			}
  4731.  		}
  4732.  	}
  4733. -	if (test_and_clear_bit(BNXT_HWRM_PF_UNLOAD_SP_EVENT, &bp->sp_event))
  4734. -		netdev_info(bp->dev, "Receive PF driver unload event!");
  4735.  }
  4736.  
  4737.  #else
  4738. diff --git drivers/net/ethernet/broadcom/tg3.c drivers/net/ethernet/broadcom/tg3.c
  4739. index dc27c81ad512..44556eea780b 100644
  4740. --- linux-4.14.336/drivers/net/ethernet/broadcom/tg3.c
  4741. +++ linux-4.14.336/drivers/net/ethernet/broadcom/tg3.c
  4742. @@ -6434,6 +6434,14 @@ static void tg3_dump_state(struct tg3 *tp)
  4743.  	int i;
  4744.  	u32 *regs;
  4745.  
  4746. +	/* If it is a PCI error, all registers will be 0xffff,
  4747. +	 * we don't dump them out, just report the error and return
  4748. +	 */
  4749. +	if (tp->pdev->error_state != pci_channel_io_normal) {
  4750. +		netdev_err(tp->dev, "PCI channel ERROR!\n");
  4751. +		return;
  4752. +	}
  4753. +
  4754.  	regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC);
  4755.  	if (!regs)
  4756.  		return;
  4757. @@ -11168,7 +11176,8 @@ static void tg3_reset_task(struct work_struct *work)
  4758.  	rtnl_lock();
  4759.  	tg3_full_lock(tp, 0);
  4760.  
  4761. -	if (tp->pcierr_recovery || !netif_running(tp->dev)) {
  4762. +	if (tp->pcierr_recovery || !netif_running(tp->dev) ||
  4763. +	    tp->pdev->error_state != pci_channel_io_normal) {
  4764.  		tg3_flag_clear(tp, RESET_TASK_PENDING);
  4765.  		tg3_full_unlock(tp);
  4766.  		rtnl_unlock();
  4767. diff --git drivers/net/ethernet/cisco/enic/enic_ethtool.c drivers/net/ethernet/cisco/enic/enic_ethtool.c
  4768. index fd3980cc1e34..3280fbad5d5a 100644
  4769. --- linux-4.14.336/drivers/net/ethernet/cisco/enic/enic_ethtool.c
  4770. +++ linux-4.14.336/drivers/net/ethernet/cisco/enic/enic_ethtool.c
  4771. @@ -378,7 +378,6 @@ static int enic_grxclsrule(struct enic *enic, struct ethtool_rxnfc *cmd)
  4772.  		break;
  4773.  	default:
  4774.  		return -EINVAL;
  4775. -		break;
  4776.  	}
  4777.  
  4778.  	fsp->h_u.tcp_ip4_spec.ip4src = flow_get_u32_src(&n->keys);
  4779. diff --git drivers/net/ethernet/freescale/fec_main.c drivers/net/ethernet/freescale/fec_main.c
  4780. index 1085f1d721b0..4b169890d301 100644
  4781. --- linux-4.14.336/drivers/net/ethernet/freescale/fec_main.c
  4782. +++ linux-4.14.336/drivers/net/ethernet/freescale/fec_main.c
  4783. @@ -1746,6 +1746,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
  4784.  
  4785.  		/* if any of the above changed restart the FEC */
  4786.  		if (status_change) {
  4787. +			netif_stop_queue(ndev);
  4788.  			napi_disable(&fep->napi);
  4789.  			netif_tx_lock_bh(ndev);
  4790.  			fec_restart(ndev);
  4791. @@ -1755,6 +1756,7 @@ static void fec_enet_adjust_link(struct net_device *ndev)
  4792.  		}
  4793.  	} else {
  4794.  		if (fep->link) {
  4795. +			netif_stop_queue(ndev);
  4796.  			napi_disable(&fep->napi);
  4797.  			netif_tx_lock_bh(ndev);
  4798.  			fec_stop(ndev);
  4799. diff --git drivers/net/ethernet/intel/i40e/i40e_main.c drivers/net/ethernet/intel/i40e/i40e_main.c
  4800. index a783ebb14db9..ec5da7cbf416 100644
  4801. --- linux-4.14.336/drivers/net/ethernet/intel/i40e/i40e_main.c
  4802. +++ linux-4.14.336/drivers/net/ethernet/intel/i40e/i40e_main.c
  4803. @@ -4708,7 +4708,7 @@ static int i40e_pf_wait_queues_disabled(struct i40e_pf *pf)
  4804.  {
  4805.  	int v, ret = 0;
  4806.  
  4807. -	for (v = 0; v < pf->hw.func_caps.num_vsis; v++) {
  4808. +	for (v = 0; v < pf->num_alloc_vsi; v++) {
  4809.  		if (pf->vsi[v]) {
  4810.  			ret = i40e_vsi_wait_queues_disabled(pf->vsi[v]);
  4811.  			if (ret)
  4812. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_common.c drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
  4813. index 6b5662674c75..71583f8756c2 100644
  4814. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
  4815. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
  4816. @@ -55,7 +55,7 @@ static s32 ixgbe_write_eeprom_buffer_bit_bang(struct ixgbe_hw *hw, u16 offset,
  4817.  					     u16 words, u16 *data);
  4818.  static s32 ixgbe_detect_eeprom_page_size_generic(struct ixgbe_hw *hw,
  4819.  						 u16 offset);
  4820. -static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw);
  4821. +static s32 ixgbe_disable_pcie_primary(struct ixgbe_hw *hw);
  4822.  
  4823.  /* Base table for registers values that change by MAC */
  4824.  const u32 ixgbe_mvals_8259X[IXGBE_MVALS_IDX_LIMIT] = {
  4825. @@ -771,10 +771,10 @@ s32 ixgbe_stop_adapter_generic(struct ixgbe_hw *hw)
  4826.  	usleep_range(1000, 2000);
  4827.  
  4828.  	/*
  4829. -	 * Prevent the PCI-E bus from from hanging by disabling PCI-E master
  4830. +	 * Prevent the PCI-E bus from hanging by disabling PCI-E primary
  4831.  	 * access and verify no pending requests
  4832.  	 */
  4833. -	return ixgbe_disable_pcie_master(hw);
  4834. +	return ixgbe_disable_pcie_primary(hw);
  4835.  }
  4836.  
  4837.  /**
  4838. @@ -2530,15 +2530,15 @@ static u32 ixgbe_pcie_timeout_poll(struct ixgbe_hw *hw)
  4839.  }
  4840.  
  4841.  /**
  4842. - *  ixgbe_disable_pcie_master - Disable PCI-express master access
  4843. + *  ixgbe_disable_pcie_primary - Disable PCI-express primary access
  4844.   *  @hw: pointer to hardware structure
  4845.   *
  4846. - *  Disables PCI-Express master access and verifies there are no pending
  4847. - *  requests. IXGBE_ERR_MASTER_REQUESTS_PENDING is returned if master disable
  4848. - *  bit hasn't caused the master requests to be disabled, else 0
  4849. - *  is returned signifying master requests disabled.
  4850. + *  Disables PCI-Express primary access and verifies there are no pending
  4851. + *  requests. IXGBE_ERR_PRIMARY_REQUESTS_PENDING is returned if primary disable
  4852. + *  bit hasn't caused the primary requests to be disabled, else 0
  4853. + *  is returned signifying primary requests disabled.
  4854.   **/
  4855. -static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
  4856. +static s32 ixgbe_disable_pcie_primary(struct ixgbe_hw *hw)
  4857.  {
  4858.  	u32 i, poll;
  4859.  	u16 value;
  4860. @@ -2547,23 +2547,23 @@ static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
  4861.  	IXGBE_WRITE_REG(hw, IXGBE_CTRL, IXGBE_CTRL_GIO_DIS);
  4862.  
  4863.  	/* Poll for bit to read as set */
  4864. -	for (i = 0; i < IXGBE_PCI_MASTER_DISABLE_TIMEOUT; i++) {
  4865. +	for (i = 0; i < IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT; i++) {
  4866.  		if (IXGBE_READ_REG(hw, IXGBE_CTRL) & IXGBE_CTRL_GIO_DIS)
  4867.  			break;
  4868.  		usleep_range(100, 120);
  4869.  	}
  4870. -	if (i >= IXGBE_PCI_MASTER_DISABLE_TIMEOUT) {
  4871. +	if (i >= IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT) {
  4872.  		hw_dbg(hw, "GIO disable did not set - requesting resets\n");
  4873.  		goto gio_disable_fail;
  4874.  	}
  4875.  
  4876. -	/* Exit if master requests are blocked */
  4877. +	/* Exit if primary requests are blocked */
  4878.  	if (!(IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_GIO) ||
  4879.  	    ixgbe_removed(hw->hw_addr))
  4880.  		return 0;
  4881.  
  4882. -	/* Poll for master request bit to clear */
  4883. -	for (i = 0; i < IXGBE_PCI_MASTER_DISABLE_TIMEOUT; i++) {
  4884. +	/* Poll for primary request bit to clear */
  4885. +	for (i = 0; i < IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT; i++) {
  4886.  		udelay(100);
  4887.  		if (!(IXGBE_READ_REG(hw, IXGBE_STATUS) & IXGBE_STATUS_GIO))
  4888.  			return 0;
  4889. @@ -2571,13 +2571,13 @@ static s32 ixgbe_disable_pcie_master(struct ixgbe_hw *hw)
  4890.  
  4891.  	/*
  4892.  	 * Two consecutive resets are required via CTRL.RST per datasheet
  4893. -	 * 5.2.5.3.2 Master Disable.  We set a flag to inform the reset routine
  4894. -	 * of this need.  The first reset prevents new master requests from
  4895. +	 * 5.2.5.3.2 Primary Disable.  We set a flag to inform the reset routine
  4896. +	 * of this need.  The first reset prevents new primary requests from
  4897.  	 * being issued by our device.  We then must wait 1usec or more for any
  4898.  	 * remaining completions from the PCIe bus to trickle in, and then reset
  4899.  	 * again to clear out any effects they may have had on our device.
  4900.  	 */
  4901. -	hw_dbg(hw, "GIO Master Disable bit didn't clear - requesting resets\n");
  4902. +	hw_dbg(hw, "GIO Primary Disable bit didn't clear - requesting resets\n");
  4903.  gio_disable_fail:
  4904.  	hw->mac.flags |= IXGBE_FLAGS_DOUBLE_RESET_REQUIRED;
  4905.  
  4906. @@ -2599,7 +2599,7 @@ gio_disable_fail:
  4907.  	}
  4908.  
  4909.  	hw_dbg(hw, "PCIe transaction pending bit also did not clear.\n");
  4910. -	return IXGBE_ERR_MASTER_REQUESTS_PENDING;
  4911. +	return IXGBE_ERR_PRIMARY_REQUESTS_PENDING;
  4912.  }
  4913.  
  4914.  /**
  4915. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_main.c drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
  4916. index ac9835e61602..ca9bdaed31c5 100644
  4917. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
  4918. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
  4919. @@ -2660,7 +2660,6 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter)
  4920.  {
  4921.  	struct ixgbe_hw *hw = &adapter->hw;
  4922.  	u32 eicr = adapter->interrupt_event;
  4923. -	s32 rc;
  4924.  
  4925.  	if (test_bit(__IXGBE_DOWN, &adapter->state))
  4926.  		return;
  4927. @@ -2694,14 +2693,13 @@ static void ixgbe_check_overtemp_subtask(struct ixgbe_adapter *adapter)
  4928.  		}
  4929.  
  4930.  		/* Check if this is not due to overtemp */
  4931. -		if (hw->phy.ops.check_overtemp(hw) != IXGBE_ERR_OVERTEMP)
  4932. +		if (!hw->phy.ops.check_overtemp(hw))
  4933.  			return;
  4934.  
  4935.  		break;
  4936.  	case IXGBE_DEV_ID_X550EM_A_1G_T:
  4937.  	case IXGBE_DEV_ID_X550EM_A_1G_T_L:
  4938. -		rc = hw->phy.ops.check_overtemp(hw);
  4939. -		if (rc != IXGBE_ERR_OVERTEMP)
  4940. +		if (!hw->phy.ops.check_overtemp(hw))
  4941.  			return;
  4942.  		break;
  4943.  	default:
  4944. @@ -5690,8 +5688,8 @@ void ixgbe_reset(struct ixgbe_adapter *adapter)
  4945.  	case IXGBE_ERR_SFP_NOT_PRESENT:
  4946.  	case IXGBE_ERR_SFP_NOT_SUPPORTED:
  4947.  		break;
  4948. -	case IXGBE_ERR_MASTER_REQUESTS_PENDING:
  4949. -		e_dev_err("master disable timed out\n");
  4950. +	case IXGBE_ERR_PRIMARY_REQUESTS_PENDING:
  4951. +		e_dev_err("primary disable timed out\n");
  4952.  		break;
  4953.  	case IXGBE_ERR_EEPROM_VERSION:
  4954.  		/* We are running on a pre-production device, log a warning */
  4955. @@ -7636,7 +7634,7 @@ static void ixgbe_service_timer(unsigned long data)
  4956.  static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter)
  4957.  {
  4958.  	struct ixgbe_hw *hw = &adapter->hw;
  4959. -	u32 status;
  4960. +	bool overtemp;
  4961.  
  4962.  	if (!(adapter->flags2 & IXGBE_FLAG2_PHY_INTERRUPT))
  4963.  		return;
  4964. @@ -7646,11 +7644,9 @@ static void ixgbe_phy_interrupt_subtask(struct ixgbe_adapter *adapter)
  4965.  	if (!hw->phy.ops.handle_lasi)
  4966.  		return;
  4967.  
  4968. -	status = hw->phy.ops.handle_lasi(&adapter->hw);
  4969. -	if (status != IXGBE_ERR_OVERTEMP)
  4970. -		return;
  4971. -
  4972. -	e_crit(drv, "%s\n", ixgbe_overheat_msg);
  4973. +	hw->phy.ops.handle_lasi(&adapter->hw, &overtemp);
  4974. +	if (overtemp)
  4975. +		e_crit(drv, "%s\n", ixgbe_overheat_msg);
  4976.  }
  4977.  
  4978.  static void ixgbe_reset_subtask(struct ixgbe_adapter *adapter)
  4979. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
  4980. index 654a402f0e9e..09a7c0f4aa2a 100644
  4981. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
  4982. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
  4983. @@ -429,8 +429,7 @@ s32 ixgbe_reset_phy_generic(struct ixgbe_hw *hw)
  4984.  		return status;
  4985.  
  4986.  	/* Don't reset PHY if it's shut down due to overtemp. */
  4987. -	if (!hw->phy.reset_if_overtemp &&
  4988. -	    (IXGBE_ERR_OVERTEMP == hw->phy.ops.check_overtemp(hw)))
  4989. +	if (!hw->phy.reset_if_overtemp && hw->phy.ops.check_overtemp(hw))
  4990.  		return 0;
  4991.  
  4992.  	/* Blocked by MNG FW so bail */
  4993. @@ -2329,22 +2328,24 @@ static void ixgbe_i2c_bus_clear(struct ixgbe_hw *hw)
  4994.   *  @hw: pointer to hardware structure
  4995.   *
  4996.   *  Checks if the LASI temp alarm status was triggered due to overtemp
  4997. + *
  4998. + *  Return true when an overtemp event detected, otherwise false.
  4999.   **/
  5000. -s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw)
  5001. +bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw)
  5002.  {
  5003.  	u16 phy_data = 0;
  5004. +	u32 status;
  5005.  
  5006.  	if (hw->device_id != IXGBE_DEV_ID_82599_T3_LOM)
  5007. -		return 0;
  5008. +		return false;
  5009.  
  5010.  	/* Check that the LASI temp alarm status was triggered */
  5011. -	hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG,
  5012. -			     MDIO_MMD_PMAPMD, &phy_data);
  5013. -
  5014. -	if (!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM))
  5015. -		return 0;
  5016. +	status = hw->phy.ops.read_reg(hw, IXGBE_TN_LASI_STATUS_REG,
  5017. +				      MDIO_MMD_PMAPMD, &phy_data);
  5018. +	if (status)
  5019. +		return false;
  5020.  
  5021. -	return IXGBE_ERR_OVERTEMP;
  5022. +	return !!(phy_data & IXGBE_TN_LASI_STATUS_TEMP_ALARM);
  5023.  }
  5024.  
  5025.  /** ixgbe_set_copper_phy_power - Control power for copper phy
  5026. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
  5027. index 94df1d99be95..7002f0a534c7 100644
  5028. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
  5029. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h
  5030. @@ -178,7 +178,7 @@ s32 ixgbe_identify_sfp_module_generic(struct ixgbe_hw *hw);
  5031.  s32 ixgbe_get_sfp_init_sequence_offsets(struct ixgbe_hw *hw,
  5032.  					u16 *list_offset,
  5033.  					u16 *data_offset);
  5034. -s32 ixgbe_tn_check_overtemp(struct ixgbe_hw *hw);
  5035. +bool ixgbe_tn_check_overtemp(struct ixgbe_hw *hw);
  5036.  s32 ixgbe_read_i2c_byte_generic(struct ixgbe_hw *hw, u8 byte_offset,
  5037.  				u8 dev_addr, u8 *data);
  5038.  s32 ixgbe_read_i2c_byte_generic_unlocked(struct ixgbe_hw *hw, u8 byte_offset,
  5039. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_type.h drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
  5040. index ffa0ee5cd0f5..93d18050284d 100644
  5041. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
  5042. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_type.h
  5043. @@ -1227,7 +1227,7 @@ struct ixgbe_thermal_sensor_data {
  5044.  #define IXGBE_PSRTYPE_RQPL_SHIFT    29
  5045.  
  5046.  /* CTRL Bit Masks */
  5047. -#define IXGBE_CTRL_GIO_DIS      0x00000004 /* Global IO Master Disable bit */
  5048. +#define IXGBE_CTRL_GIO_DIS      0x00000004 /* Global IO Primary Disable bit */
  5049.  #define IXGBE_CTRL_LNK_RST      0x00000008 /* Link Reset. Resets everything. */
  5050.  #define IXGBE_CTRL_RST          0x04000000 /* Reset (SW) */
  5051.  #define IXGBE_CTRL_RST_MASK     (IXGBE_CTRL_LNK_RST | IXGBE_CTRL_RST)
  5052. @@ -1790,7 +1790,7 @@ enum {
  5053.  /* STATUS Bit Masks */
  5054.  #define IXGBE_STATUS_LAN_ID         0x0000000C /* LAN ID */
  5055.  #define IXGBE_STATUS_LAN_ID_SHIFT   2          /* LAN ID Shift*/
  5056. -#define IXGBE_STATUS_GIO            0x00080000 /* GIO Master Enable Status */
  5057. +#define IXGBE_STATUS_GIO            0x00080000 /* GIO Primary Enable Status */
  5058.  
  5059.  #define IXGBE_STATUS_LAN_ID_0   0x00000000 /* LAN ID 0 */
  5060.  #define IXGBE_STATUS_LAN_ID_1   0x00000004 /* LAN ID 1 */
  5061. @@ -2172,8 +2172,8 @@ enum {
  5062.  #define IXGBE_PCIDEVCTRL2_4_8s		0xd
  5063.  #define IXGBE_PCIDEVCTRL2_17_34s	0xe
  5064.  
  5065. -/* Number of 100 microseconds we wait for PCI Express master disable */
  5066. -#define IXGBE_PCI_MASTER_DISABLE_TIMEOUT	800
  5067. +/* Number of 100 microseconds we wait for PCI Express primary disable */
  5068. +#define IXGBE_PCI_PRIMARY_DISABLE_TIMEOUT	800
  5069.  
  5070.  /* RAH */
  5071.  #define IXGBE_RAH_VIND_MASK     0x003C0000
  5072. @@ -3482,10 +3482,10 @@ struct ixgbe_phy_operations {
  5073.  	s32 (*read_i2c_sff8472)(struct ixgbe_hw *, u8 , u8 *);
  5074.  	s32 (*read_i2c_eeprom)(struct ixgbe_hw *, u8 , u8 *);
  5075.  	s32 (*write_i2c_eeprom)(struct ixgbe_hw *, u8, u8);
  5076. -	s32 (*check_overtemp)(struct ixgbe_hw *);
  5077. +	bool (*check_overtemp)(struct ixgbe_hw *);
  5078.  	s32 (*set_phy_power)(struct ixgbe_hw *, bool on);
  5079.  	s32 (*enter_lplu)(struct ixgbe_hw *);
  5080. -	s32 (*handle_lasi)(struct ixgbe_hw *hw);
  5081. +	s32 (*handle_lasi)(struct ixgbe_hw *hw, bool *);
  5082.  	s32 (*read_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr,
  5083.  				      u8 *value);
  5084.  	s32 (*write_i2c_byte_unlocked)(struct ixgbe_hw *, u8 offset, u8 addr,
  5085. @@ -3651,7 +3651,7 @@ struct ixgbe_info {
  5086.  #define IXGBE_ERR_ADAPTER_STOPPED               -9
  5087.  #define IXGBE_ERR_INVALID_MAC_ADDR              -10
  5088.  #define IXGBE_ERR_DEVICE_NOT_SUPPORTED          -11
  5089. -#define IXGBE_ERR_MASTER_REQUESTS_PENDING       -12
  5090. +#define IXGBE_ERR_PRIMARY_REQUESTS_PENDING      -12
  5091.  #define IXGBE_ERR_INVALID_LINK_SETTINGS         -13
  5092.  #define IXGBE_ERR_AUTONEG_NOT_COMPLETE          -14
  5093.  #define IXGBE_ERR_RESET_FAILED                  -15
  5094. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
  5095. index 6ea0d6a5fb90..b5e4e78f86ee 100644
  5096. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
  5097. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c
  5098. @@ -375,7 +375,6 @@ static s32 ixgbe_calc_eeprom_checksum_X540(struct ixgbe_hw *hw)
  5099.  		if (ixgbe_read_eerd_generic(hw, pointer, &length)) {
  5100.  			hw_dbg(hw, "EEPROM read failed\n");
  5101.  			return IXGBE_ERR_EEPROM;
  5102. -			break;
  5103.  		}
  5104.  
  5105.  		/* Skip pointer section if length is invalid. */
  5106. diff --git drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
  5107. index 10fa0e095ec3..f99596cf3d7e 100644
  5108. --- linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
  5109. +++ linux-4.14.336/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c
  5110. @@ -620,8 +620,10 @@ static s32 ixgbe_setup_fw_link(struct ixgbe_hw *hw)
  5111.  	rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_SETUP_LINK, &setup);
  5112.  	if (rc)
  5113.  		return rc;
  5114. +
  5115.  	if (setup[0] == FW_PHY_ACT_SETUP_LINK_RSP_DOWN)
  5116. -		return IXGBE_ERR_OVERTEMP;
  5117. +		return -EIO;
  5118. +
  5119.  	return 0;
  5120.  }
  5121.  
  5122. @@ -735,7 +737,8 @@ static s32 ixgbe_read_iosf_sb_reg_x550(struct ixgbe_hw *hw, u32 reg_addr,
  5123.  		error = (command & IXGBE_SB_IOSF_CTRL_CMPL_ERR_MASK) >>
  5124.  			 IXGBE_SB_IOSF_CTRL_CMPL_ERR_SHIFT;
  5125.  		hw_dbg(hw, "Failed to read, error %x\n", error);
  5126. -		return IXGBE_ERR_PHY;
  5127. +		ret = IXGBE_ERR_PHY;
  5128. +		goto out;
  5129.  	}
  5130.  
  5131.  	if (!ret)
  5132. @@ -2314,18 +2317,18 @@ static s32 ixgbe_get_link_capabilities_X550em(struct ixgbe_hw *hw,
  5133.   * @hw: pointer to hardware structure
  5134.   * @lsc: pointer to boolean flag which indicates whether external Base T
  5135.   *	 PHY interrupt is lsc
  5136. + * @is_overtemp: indicate whether an overtemp event encountered
  5137.   *
  5138.   * Determime if external Base T PHY interrupt cause is high temperature
  5139.   * failure alarm or link status change.
  5140. - *
  5141. - * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature
  5142. - * failure alarm, else return PHY access status.
  5143.   **/
  5144. -static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
  5145. +static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc,
  5146. +				       bool *is_overtemp)
  5147.  {
  5148.  	u32 status;
  5149.  	u16 reg;
  5150.  
  5151. +	*is_overtemp = false;
  5152.  	*lsc = false;
  5153.  
  5154.  	/* Vendor alarm triggered */
  5155. @@ -2357,7 +2360,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
  5156.  	if (reg & IXGBE_MDIO_GLOBAL_ALM_1_HI_TMP_FAIL) {
  5157.  		/* power down the PHY in case the PHY FW didn't already */
  5158.  		ixgbe_set_copper_phy_power(hw, false);
  5159. -		return IXGBE_ERR_OVERTEMP;
  5160. +		*is_overtemp = true;
  5161. +		return -EIO;
  5162.  	}
  5163.  	if (reg & IXGBE_MDIO_GLOBAL_ALM_1_DEV_FAULT) {
  5164.  		/*  device fault alarm triggered */
  5165. @@ -2371,7 +2375,8 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
  5166.  		if (reg == IXGBE_MDIO_GLOBAL_FAULT_MSG_HI_TMP) {
  5167.  			/* power down the PHY in case the PHY FW didn't */
  5168.  			ixgbe_set_copper_phy_power(hw, false);
  5169. -			return IXGBE_ERR_OVERTEMP;
  5170. +			*is_overtemp = true;
  5171. +			return -EIO;
  5172.  		}
  5173.  	}
  5174.  
  5175. @@ -2407,12 +2412,12 @@ static s32 ixgbe_get_lasi_ext_t_x550em(struct ixgbe_hw *hw, bool *lsc)
  5176.   **/
  5177.  static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw)
  5178.  {
  5179. +	bool lsc, overtemp;
  5180.  	u32 status;
  5181.  	u16 reg;
  5182. -	bool lsc;
  5183.  
  5184.  	/* Clear interrupt flags */
  5185. -	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc);
  5186. +	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, &overtemp);
  5187.  
  5188.  	/* Enable link status change alarm */
  5189.  
  5190. @@ -2491,21 +2496,20 @@ static s32 ixgbe_enable_lasi_ext_t_x550em(struct ixgbe_hw *hw)
  5191.  /**
  5192.   * ixgbe_handle_lasi_ext_t_x550em - Handle external Base T PHY interrupt
  5193.   * @hw: pointer to hardware structure
  5194. + * @is_overtemp: indicate whether an overtemp event encountered
  5195.   *
  5196.   * Handle external Base T PHY interrupt. If high temperature
  5197.   * failure alarm then return error, else if link status change
  5198.   * then setup internal/external PHY link
  5199. - *
  5200. - * Return IXGBE_ERR_OVERTEMP if interrupt is high temperature
  5201. - * failure alarm, else return PHY access status.
  5202.   **/
  5203. -static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw)
  5204. +static s32 ixgbe_handle_lasi_ext_t_x550em(struct ixgbe_hw *hw,
  5205. +					  bool *is_overtemp)
  5206.  {
  5207.  	struct ixgbe_phy_info *phy = &hw->phy;
  5208.  	bool lsc;
  5209.  	u32 status;
  5210.  
  5211. -	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc);
  5212. +	status = ixgbe_get_lasi_ext_t_x550em(hw, &lsc, is_overtemp);
  5213.  	if (status)
  5214.  		return status;
  5215.  
  5216. @@ -3132,21 +3136,23 @@ static s32 ixgbe_reset_phy_fw(struct ixgbe_hw *hw)
  5217.  /**
  5218.   * ixgbe_check_overtemp_fw - Check firmware-controlled PHYs for overtemp
  5219.   * @hw: pointer to hardware structure
  5220. + *
  5221. + * Return true when an overtemp event detected, otherwise false.
  5222.   */
  5223. -static s32 ixgbe_check_overtemp_fw(struct ixgbe_hw *hw)
  5224. +static bool ixgbe_check_overtemp_fw(struct ixgbe_hw *hw)
  5225.  {
  5226.  	u32 store[FW_PHY_ACT_DATA_COUNT] = { 0 };
  5227.  	s32 rc;
  5228.  
  5229.  	rc = ixgbe_fw_phy_activity(hw, FW_PHY_ACT_GET_LINK_INFO, &store);
  5230.  	if (rc)
  5231. -		return rc;
  5232. +		return false;
  5233.  
  5234.  	if (store[0] & FW_PHY_ACT_GET_LINK_INFO_TEMP) {
  5235.  		ixgbe_shutdown_fw_phy(hw);
  5236. -		return IXGBE_ERR_OVERTEMP;
  5237. +		return true;
  5238.  	}
  5239. -	return 0;
  5240. +	return false;
  5241.  }
  5242.  
  5243.  /**
  5244. diff --git drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
  5245. index c567cff499d1..b8c7997ea52b 100644
  5246. --- linux-4.14.336/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
  5247. +++ linux-4.14.336/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
  5248. @@ -229,11 +229,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
  5249.  
  5250.  	ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
  5251.  			sizeof(*ft->g), GFP_KERNEL);
  5252. -	in = kvzalloc(inlen, GFP_KERNEL);
  5253. -	if  (!in || !ft->g) {
  5254. -		kvfree(ft->g);
  5255. -		kvfree(in);
  5256. +	if (!ft->g)
  5257.  		return -ENOMEM;
  5258. +
  5259. +	in = kvzalloc(inlen, GFP_KERNEL);
  5260. +	if (!in) {
  5261. +		err = -ENOMEM;
  5262. +		goto err_free_g;
  5263.  	}
  5264.  
  5265.  	mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
  5266. @@ -253,7 +255,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
  5267.  		break;
  5268.  	default:
  5269.  		err = -EINVAL;
  5270. -		goto out;
  5271. +		goto err_free_in;
  5272.  	}
  5273.  
  5274.  	switch (type) {
  5275. @@ -275,7 +277,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
  5276.  		break;
  5277.  	default:
  5278.  		err = -EINVAL;
  5279. -		goto out;
  5280. +		goto err_free_in;
  5281.  	}
  5282.  
  5283.  	MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
  5284. @@ -284,7 +286,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
  5285.  	MLX5_SET_CFG(in, end_flow_index, ix - 1);
  5286.  	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
  5287.  	if (IS_ERR(ft->g[ft->num_groups]))
  5288. -		goto err;
  5289. +		goto err_clean_group;
  5290.  	ft->num_groups++;
  5291.  
  5292.  	memset(in, 0, inlen);
  5293. @@ -293,18 +295,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
  5294.  	MLX5_SET_CFG(in, end_flow_index, ix - 1);
  5295.  	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
  5296.  	if (IS_ERR(ft->g[ft->num_groups]))
  5297. -		goto err;
  5298. +		goto err_clean_group;
  5299.  	ft->num_groups++;
  5300.  
  5301.  	kvfree(in);
  5302.  	return 0;
  5303.  
  5304. -err:
  5305. +err_clean_group:
  5306.  	err = PTR_ERR(ft->g[ft->num_groups]);
  5307.  	ft->g[ft->num_groups] = NULL;
  5308. -out:
  5309. +err_free_in:
  5310.  	kvfree(in);
  5311. -
  5312. +err_free_g:
  5313. +	kfree(ft->g);
  5314. +	ft->g = NULL;
  5315.  	return err;
  5316.  }
  5317.  
  5318. diff --git drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
  5319. index cd678323bacb..375c1c4ffc0c 100644
  5320. --- linux-4.14.336/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
  5321. +++ linux-4.14.336/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
  5322. @@ -571,11 +571,13 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
  5323.  	const u32 barcfg_msix_general =
  5324.  		NFP_PCIE_BAR_PCIE2CPP_MapType(
  5325.  			NFP_PCIE_BAR_PCIE2CPP_MapType_GENERAL) |
  5326. -		NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT;
  5327. +		NFP_PCIE_BAR_PCIE2CPP_LengthSelect(
  5328. +			NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT);
  5329.  	const u32 barcfg_msix_xpb =
  5330.  		NFP_PCIE_BAR_PCIE2CPP_MapType(
  5331.  			NFP_PCIE_BAR_PCIE2CPP_MapType_BULK) |
  5332. -		NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT |
  5333. +		NFP_PCIE_BAR_PCIE2CPP_LengthSelect(
  5334. +			NFP_PCIE_BAR_PCIE2CPP_LengthSelect_32BIT) |
  5335.  		NFP_PCIE_BAR_PCIE2CPP_Target_BaseAddress(
  5336.  			NFP_CPP_TARGET_ISLAND_XPB);
  5337.  	const u32 barcfg_explicit[4] = {
  5338. diff --git drivers/net/ethernet/qlogic/qla3xxx.c drivers/net/ethernet/qlogic/qla3xxx.c
  5339. index 6c8a591db713..bc3d268916b8 100644
  5340. --- linux-4.14.336/drivers/net/ethernet/qlogic/qla3xxx.c
  5341. +++ linux-4.14.336/drivers/net/ethernet/qlogic/qla3xxx.c
  5342. @@ -316,12 +316,11 @@ static void ql_release_to_lrg_buf_free_list(struct ql3_adapter *qdev,
  5343.  			 * buffer
  5344.  			 */
  5345.  			skb_reserve(lrg_buf_cb->skb, QL_HEADER_SPACE);
  5346. -			map = pci_map_single(qdev->pdev,
  5347. +			map = dma_map_single(&qdev->pdev->dev,
  5348.  					     lrg_buf_cb->skb->data,
  5349. -					     qdev->lrg_buffer_len -
  5350. -					     QL_HEADER_SPACE,
  5351. -					     PCI_DMA_FROMDEVICE);
  5352. -			err = pci_dma_mapping_error(qdev->pdev, map);
  5353. +					     qdev->lrg_buffer_len - QL_HEADER_SPACE,
  5354. +					     DMA_FROM_DEVICE);
  5355. +			err = dma_mapping_error(&qdev->pdev->dev, map);
  5356.  			if (err) {
  5357.  				netdev_err(qdev->ndev,
  5358.  					   "PCI mapping failed with error: %d\n",
  5359. @@ -1803,13 +1802,12 @@ static int ql_populate_free_queue(struct ql3_adapter *qdev)
  5360.  				 * first buffer
  5361.  				 */
  5362.  				skb_reserve(lrg_buf_cb->skb, QL_HEADER_SPACE);
  5363. -				map = pci_map_single(qdev->pdev,
  5364. +				map = dma_map_single(&qdev->pdev->dev,
  5365.  						     lrg_buf_cb->skb->data,
  5366. -						     qdev->lrg_buffer_len -
  5367. -						     QL_HEADER_SPACE,
  5368. -						     PCI_DMA_FROMDEVICE);
  5369. +						     qdev->lrg_buffer_len - QL_HEADER_SPACE,
  5370. +						     DMA_FROM_DEVICE);
  5371.  
  5372. -				err = pci_dma_mapping_error(qdev->pdev, map);
  5373. +				err = dma_mapping_error(&qdev->pdev->dev, map);
  5374.  				if (err) {
  5375.  					netdev_err(qdev->ndev,
  5376.  						   "PCI mapping failed with error: %d\n",
  5377. @@ -1944,18 +1942,16 @@ static void ql_process_mac_tx_intr(struct ql3_adapter *qdev,
  5378.  		goto invalid_seg_count;
  5379.  	}
  5380.  
  5381. -	pci_unmap_single(qdev->pdev,
  5382. +	dma_unmap_single(&qdev->pdev->dev,
  5383.  			 dma_unmap_addr(&tx_cb->map[0], mapaddr),
  5384. -			 dma_unmap_len(&tx_cb->map[0], maplen),
  5385. -			 PCI_DMA_TODEVICE);
  5386. +			 dma_unmap_len(&tx_cb->map[0], maplen), DMA_TO_DEVICE);
  5387.  	tx_cb->seg_count--;
  5388.  	if (tx_cb->seg_count) {
  5389.  		for (i = 1; i < tx_cb->seg_count; i++) {
  5390. -			pci_unmap_page(qdev->pdev,
  5391. -				       dma_unmap_addr(&tx_cb->map[i],
  5392. -						      mapaddr),
  5393. +			dma_unmap_page(&qdev->pdev->dev,
  5394. +				       dma_unmap_addr(&tx_cb->map[i], mapaddr),
  5395.  				       dma_unmap_len(&tx_cb->map[i], maplen),
  5396. -				       PCI_DMA_TODEVICE);
  5397. +				       DMA_TO_DEVICE);
  5398.  		}
  5399.  	}
  5400.  	qdev->ndev->stats.tx_packets++;
  5401. @@ -2022,10 +2018,9 @@ static void ql_process_mac_rx_intr(struct ql3_adapter *qdev,
  5402.  	qdev->ndev->stats.rx_bytes += length;
  5403.  
  5404.  	skb_put(skb, length);
  5405. -	pci_unmap_single(qdev->pdev,
  5406. +	dma_unmap_single(&qdev->pdev->dev,
  5407.  			 dma_unmap_addr(lrg_buf_cb2, mapaddr),
  5408. -			 dma_unmap_len(lrg_buf_cb2, maplen),
  5409. -			 PCI_DMA_FROMDEVICE);
  5410. +			 dma_unmap_len(lrg_buf_cb2, maplen), DMA_FROM_DEVICE);
  5411.  	prefetch(skb->data);
  5412.  	skb_checksum_none_assert(skb);
  5413.  	skb->protocol = eth_type_trans(skb, qdev->ndev);
  5414. @@ -2068,10 +2063,9 @@ static void ql_process_macip_rx_intr(struct ql3_adapter *qdev,
  5415.  	skb2 = lrg_buf_cb2->skb;
  5416.  
  5417.  	skb_put(skb2, length);	/* Just the second buffer length here. */
  5418. -	pci_unmap_single(qdev->pdev,
  5419. +	dma_unmap_single(&qdev->pdev->dev,
  5420.  			 dma_unmap_addr(lrg_buf_cb2, mapaddr),
  5421. -			 dma_unmap_len(lrg_buf_cb2, maplen),
  5422. -			 PCI_DMA_FROMDEVICE);
  5423. +			 dma_unmap_len(lrg_buf_cb2, maplen), DMA_FROM_DEVICE);
  5424.  	prefetch(skb2->data);
  5425.  
  5426.  	skb_checksum_none_assert(skb2);
  5427. @@ -2320,9 +2314,9 @@ static int ql_send_map(struct ql3_adapter *qdev,
  5428.  	/*
  5429.  	 * Map the skb buffer first.
  5430.  	 */
  5431. -	map = pci_map_single(qdev->pdev, skb->data, len, PCI_DMA_TODEVICE);
  5432. +	map = dma_map_single(&qdev->pdev->dev, skb->data, len, DMA_TO_DEVICE);
  5433.  
  5434. -	err = pci_dma_mapping_error(qdev->pdev, map);
  5435. +	err = dma_mapping_error(&qdev->pdev->dev, map);
  5436.  	if (err) {
  5437.  		netdev_err(qdev->ndev, "PCI mapping failed with error: %d\n",
  5438.  			   err);
  5439. @@ -2358,11 +2352,11 @@ static int ql_send_map(struct ql3_adapter *qdev,
  5440.  		    (seg == 7 && seg_cnt > 8) ||
  5441.  		    (seg == 12 && seg_cnt > 13) ||
  5442.  		    (seg == 17 && seg_cnt > 18)) {
  5443. -			map = pci_map_single(qdev->pdev, oal,
  5444. +			map = dma_map_single(&qdev->pdev->dev, oal,
  5445.  					     sizeof(struct oal),
  5446. -					     PCI_DMA_TODEVICE);
  5447. +					     DMA_TO_DEVICE);
  5448.  
  5449. -			err = pci_dma_mapping_error(qdev->pdev, map);
  5450. +			err = dma_mapping_error(&qdev->pdev->dev, map);
  5451.  			if (err) {
  5452.  				netdev_err(qdev->ndev,
  5453.  					   "PCI mapping outbound address list with error: %d\n",
  5454. @@ -2424,24 +2418,24 @@ map_error:
  5455.  		    (seg == 7 && seg_cnt > 8) ||
  5456.  		    (seg == 12 && seg_cnt > 13) ||
  5457.  		    (seg == 17 && seg_cnt > 18)) {
  5458. -			pci_unmap_single(qdev->pdev,
  5459. -				dma_unmap_addr(&tx_cb->map[seg], mapaddr),
  5460. -				dma_unmap_len(&tx_cb->map[seg], maplen),
  5461. -				 PCI_DMA_TODEVICE);
  5462. +			dma_unmap_single(&qdev->pdev->dev,
  5463. +					 dma_unmap_addr(&tx_cb->map[seg], mapaddr),
  5464. +					 dma_unmap_len(&tx_cb->map[seg], maplen),
  5465. +					 DMA_TO_DEVICE);
  5466.  			oal++;
  5467.  			seg++;
  5468.  		}
  5469.  
  5470. -		pci_unmap_page(qdev->pdev,
  5471. +		dma_unmap_page(&qdev->pdev->dev,
  5472.  			       dma_unmap_addr(&tx_cb->map[seg], mapaddr),
  5473.  			       dma_unmap_len(&tx_cb->map[seg], maplen),
  5474. -			       PCI_DMA_TODEVICE);
  5475. +			       DMA_TO_DEVICE);
  5476.  	}
  5477.  
  5478. -	pci_unmap_single(qdev->pdev,
  5479. +	dma_unmap_single(&qdev->pdev->dev,
  5480.  			 dma_unmap_addr(&tx_cb->map[0], mapaddr),
  5481.  			 dma_unmap_addr(&tx_cb->map[0], maplen),
  5482. -			 PCI_DMA_TODEVICE);
  5483. +			 DMA_TO_DEVICE);
  5484.  
  5485.  	return NETDEV_TX_BUSY;
  5486.  
  5487. @@ -2527,9 +2521,8 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
  5488.  	wmb();
  5489.  
  5490.  	qdev->req_q_virt_addr =
  5491. -	    pci_alloc_consistent(qdev->pdev,
  5492. -				 (size_t) qdev->req_q_size,
  5493. -				 &qdev->req_q_phy_addr);
  5494. +	    dma_alloc_coherent(&qdev->pdev->dev, (size_t)qdev->req_q_size,
  5495. +			       &qdev->req_q_phy_addr, GFP_KERNEL);
  5496.  
  5497.  	if ((qdev->req_q_virt_addr == NULL) ||
  5498.  	    LS_64BITS(qdev->req_q_phy_addr) & (qdev->req_q_size - 1)) {
  5499. @@ -2538,16 +2531,14 @@ static int ql_alloc_net_req_rsp_queues(struct ql3_adapter *qdev)
  5500.  	}
  5501.  
  5502.  	qdev->rsp_q_virt_addr =
  5503. -	    pci_alloc_consistent(qdev->pdev,
  5504. -				 (size_t) qdev->rsp_q_size,
  5505. -				 &qdev->rsp_q_phy_addr);
  5506. +	    dma_alloc_coherent(&qdev->pdev->dev, (size_t)qdev->rsp_q_size,
  5507. +			       &qdev->rsp_q_phy_addr, GFP_KERNEL);
  5508.  
  5509.  	if ((qdev->rsp_q_virt_addr == NULL) ||
  5510.  	    LS_64BITS(qdev->rsp_q_phy_addr) & (qdev->rsp_q_size - 1)) {
  5511.  		netdev_err(qdev->ndev, "rspQ allocation failed\n");
  5512. -		pci_free_consistent(qdev->pdev, (size_t) qdev->req_q_size,
  5513. -				    qdev->req_q_virt_addr,
  5514. -				    qdev->req_q_phy_addr);
  5515. +		dma_free_coherent(&qdev->pdev->dev, (size_t)qdev->req_q_size,
  5516. +				  qdev->req_q_virt_addr, qdev->req_q_phy_addr);
  5517.  		return -ENOMEM;
  5518.  	}
  5519.  
  5520. @@ -2563,15 +2554,13 @@ static void ql_free_net_req_rsp_queues(struct ql3_adapter *qdev)
  5521.  		return;
  5522.  	}
  5523.  
  5524. -	pci_free_consistent(qdev->pdev,
  5525. -			    qdev->req_q_size,
  5526. -			    qdev->req_q_virt_addr, qdev->req_q_phy_addr);
  5527. +	dma_free_coherent(&qdev->pdev->dev, qdev->req_q_size,
  5528. +			  qdev->req_q_virt_addr, qdev->req_q_phy_addr);
  5529.  
  5530.  	qdev->req_q_virt_addr = NULL;
  5531.  
  5532. -	pci_free_consistent(qdev->pdev,
  5533. -			    qdev->rsp_q_size,
  5534. -			    qdev->rsp_q_virt_addr, qdev->rsp_q_phy_addr);
  5535. +	dma_free_coherent(&qdev->pdev->dev, qdev->rsp_q_size,
  5536. +			  qdev->rsp_q_virt_addr, qdev->rsp_q_phy_addr);
  5537.  
  5538.  	qdev->rsp_q_virt_addr = NULL;
  5539.  
  5540. @@ -2595,12 +2584,13 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev)
  5541.  		return -ENOMEM;
  5542.  
  5543.  	qdev->lrg_buf_q_alloc_virt_addr =
  5544. -		pci_alloc_consistent(qdev->pdev,
  5545. -				     qdev->lrg_buf_q_alloc_size,
  5546. -				     &qdev->lrg_buf_q_alloc_phy_addr);
  5547. +		dma_alloc_coherent(&qdev->pdev->dev,
  5548. +				   qdev->lrg_buf_q_alloc_size,
  5549. +				   &qdev->lrg_buf_q_alloc_phy_addr, GFP_KERNEL);
  5550.  
  5551.  	if (qdev->lrg_buf_q_alloc_virt_addr == NULL) {
  5552.  		netdev_err(qdev->ndev, "lBufQ failed\n");
  5553. +		kfree(qdev->lrg_buf);
  5554.  		return -ENOMEM;
  5555.  	}
  5556.  	qdev->lrg_buf_q_virt_addr = qdev->lrg_buf_q_alloc_virt_addr;
  5557. @@ -2615,15 +2605,17 @@ static int ql_alloc_buffer_queues(struct ql3_adapter *qdev)
  5558.  		qdev->small_buf_q_alloc_size = qdev->small_buf_q_size * 2;
  5559.  
  5560.  	qdev->small_buf_q_alloc_virt_addr =
  5561. -		pci_alloc_consistent(qdev->pdev,
  5562. -				     qdev->small_buf_q_alloc_size,
  5563. -				     &qdev->small_buf_q_alloc_phy_addr);
  5564. +		dma_alloc_coherent(&qdev->pdev->dev,
  5565. +				   qdev->small_buf_q_alloc_size,
  5566. +				   &qdev->small_buf_q_alloc_phy_addr, GFP_KERNEL);
  5567.  
  5568.  	if (qdev->small_buf_q_alloc_virt_addr == NULL) {
  5569.  		netdev_err(qdev->ndev, "Small Buffer Queue allocation failed\n");
  5570. -		pci_free_consistent(qdev->pdev, qdev->lrg_buf_q_alloc_size,
  5571. -				    qdev->lrg_buf_q_alloc_virt_addr,
  5572. -				    qdev->lrg_buf_q_alloc_phy_addr);
  5573. +		dma_free_coherent(&qdev->pdev->dev,
  5574. +				  qdev->lrg_buf_q_alloc_size,
  5575. +				  qdev->lrg_buf_q_alloc_virt_addr,
  5576. +				  qdev->lrg_buf_q_alloc_phy_addr);
  5577. +		kfree(qdev->lrg_buf);
  5578.  		return -ENOMEM;
  5579.  	}
  5580.  
  5581. @@ -2640,17 +2632,15 @@ static void ql_free_buffer_queues(struct ql3_adapter *qdev)
  5582.  		return;
  5583.  	}
  5584.  	kfree(qdev->lrg_buf);
  5585. -	pci_free_consistent(qdev->pdev,
  5586. -			    qdev->lrg_buf_q_alloc_size,
  5587. -			    qdev->lrg_buf_q_alloc_virt_addr,
  5588. -			    qdev->lrg_buf_q_alloc_phy_addr);
  5589. +	dma_free_coherent(&qdev->pdev->dev, qdev->lrg_buf_q_alloc_size,
  5590. +			  qdev->lrg_buf_q_alloc_virt_addr,
  5591. +			  qdev->lrg_buf_q_alloc_phy_addr);
  5592.  
  5593.  	qdev->lrg_buf_q_virt_addr = NULL;
  5594.  
  5595. -	pci_free_consistent(qdev->pdev,
  5596. -			    qdev->small_buf_q_alloc_size,
  5597. -			    qdev->small_buf_q_alloc_virt_addr,
  5598. -			    qdev->small_buf_q_alloc_phy_addr);
  5599. +	dma_free_coherent(&qdev->pdev->dev, qdev->small_buf_q_alloc_size,
  5600. +			  qdev->small_buf_q_alloc_virt_addr,
  5601. +			  qdev->small_buf_q_alloc_phy_addr);
  5602.  
  5603.  	qdev->small_buf_q_virt_addr = NULL;
  5604.  
  5605. @@ -2668,9 +2658,9 @@ static int ql_alloc_small_buffers(struct ql3_adapter *qdev)
  5606.  		 QL_SMALL_BUFFER_SIZE);
  5607.  
  5608.  	qdev->small_buf_virt_addr =
  5609. -		pci_alloc_consistent(qdev->pdev,
  5610. -				     qdev->small_buf_total_size,
  5611. -				     &qdev->small_buf_phy_addr);
  5612. +		dma_alloc_coherent(&qdev->pdev->dev,
  5613. +				   qdev->small_buf_total_size,
  5614. +				   &qdev->small_buf_phy_addr, GFP_KERNEL);
  5615.  
  5616.  	if (qdev->small_buf_virt_addr == NULL) {
  5617.  		netdev_err(qdev->ndev, "Failed to get small buffer memory\n");
  5618. @@ -2703,10 +2693,10 @@ static void ql_free_small_buffers(struct ql3_adapter *qdev)
  5619.  		return;
  5620.  	}
  5621.  	if (qdev->small_buf_virt_addr != NULL) {
  5622. -		pci_free_consistent(qdev->pdev,
  5623. -				    qdev->small_buf_total_size,
  5624. -				    qdev->small_buf_virt_addr,
  5625. -				    qdev->small_buf_phy_addr);
  5626. +		dma_free_coherent(&qdev->pdev->dev,
  5627. +				  qdev->small_buf_total_size,
  5628. +				  qdev->small_buf_virt_addr,
  5629. +				  qdev->small_buf_phy_addr);
  5630.  
  5631.  		qdev->small_buf_virt_addr = NULL;
  5632.  	}
  5633. @@ -2721,10 +2711,10 @@ static void ql_free_large_buffers(struct ql3_adapter *qdev)
  5634.  		lrg_buf_cb = &qdev->lrg_buf[i];
  5635.  		if (lrg_buf_cb->skb) {
  5636.  			dev_kfree_skb(lrg_buf_cb->skb);
  5637. -			pci_unmap_single(qdev->pdev,
  5638. +			dma_unmap_single(&qdev->pdev->dev,
  5639.  					 dma_unmap_addr(lrg_buf_cb, mapaddr),
  5640.  					 dma_unmap_len(lrg_buf_cb, maplen),
  5641. -					 PCI_DMA_FROMDEVICE);
  5642. +					 DMA_FROM_DEVICE);
  5643.  			memset(lrg_buf_cb, 0, sizeof(struct ql_rcv_buf_cb));
  5644.  		} else {
  5645.  			break;
  5646. @@ -2776,13 +2766,11 @@ static int ql_alloc_large_buffers(struct ql3_adapter *qdev)
  5647.  			 * buffer
  5648.  			 */
  5649.  			skb_reserve(skb, QL_HEADER_SPACE);
  5650. -			map = pci_map_single(qdev->pdev,
  5651. -					     skb->data,
  5652. -					     qdev->lrg_buffer_len -
  5653. -					     QL_HEADER_SPACE,
  5654. -					     PCI_DMA_FROMDEVICE);
  5655. +			map = dma_map_single(&qdev->pdev->dev, skb->data,
  5656. +					     qdev->lrg_buffer_len - QL_HEADER_SPACE,
  5657. +					     DMA_FROM_DEVICE);
  5658.  
  5659. -			err = pci_dma_mapping_error(qdev->pdev, map);
  5660. +			err = dma_mapping_error(&qdev->pdev->dev, map);
  5661.  			if (err) {
  5662.  				netdev_err(qdev->ndev,
  5663.  					   "PCI mapping failed with error: %d\n",
  5664. @@ -2867,8 +2855,8 @@ static int ql_alloc_mem_resources(struct ql3_adapter *qdev)
  5665.  	 * Network Completion Queue Producer Index Register
  5666.  	 */
  5667.  	qdev->shadow_reg_virt_addr =
  5668. -		pci_alloc_consistent(qdev->pdev,
  5669. -				     PAGE_SIZE, &qdev->shadow_reg_phy_addr);
  5670. +		dma_alloc_coherent(&qdev->pdev->dev, PAGE_SIZE,
  5671. +				   &qdev->shadow_reg_phy_addr, GFP_KERNEL);
  5672.  
  5673.  	if (qdev->shadow_reg_virt_addr != NULL) {
  5674.  		qdev->preq_consumer_index = qdev->shadow_reg_virt_addr;
  5675. @@ -2923,10 +2911,9 @@ err_small_buffers:
  5676.  err_buffer_queues:
  5677.  	ql_free_net_req_rsp_queues(qdev);
  5678.  err_req_rsp:
  5679. -	pci_free_consistent(qdev->pdev,
  5680. -			    PAGE_SIZE,
  5681. -			    qdev->shadow_reg_virt_addr,
  5682. -			    qdev->shadow_reg_phy_addr);
  5683. +	dma_free_coherent(&qdev->pdev->dev, PAGE_SIZE,
  5684. +			  qdev->shadow_reg_virt_addr,
  5685. +			  qdev->shadow_reg_phy_addr);
  5686.  
  5687.  	return -ENOMEM;
  5688.  }
  5689. @@ -2939,10 +2926,9 @@ static void ql_free_mem_resources(struct ql3_adapter *qdev)
  5690.  	ql_free_buffer_queues(qdev);
  5691.  	ql_free_net_req_rsp_queues(qdev);
  5692.  	if (qdev->shadow_reg_virt_addr != NULL) {
  5693. -		pci_free_consistent(qdev->pdev,
  5694. -				    PAGE_SIZE,
  5695. -				    qdev->shadow_reg_virt_addr,
  5696. -				    qdev->shadow_reg_phy_addr);
  5697. +		dma_free_coherent(&qdev->pdev->dev, PAGE_SIZE,
  5698. +				  qdev->shadow_reg_virt_addr,
  5699. +				  qdev->shadow_reg_phy_addr);
  5700.  		qdev->shadow_reg_virt_addr = NULL;
  5701.  	}
  5702.  }
  5703. @@ -3643,18 +3629,15 @@ static void ql_reset_work(struct work_struct *work)
  5704.  			if (tx_cb->skb) {
  5705.  				netdev_printk(KERN_DEBUG, ndev,
  5706.  					      "Freeing lost SKB\n");
  5707. -				pci_unmap_single(qdev->pdev,
  5708. -					 dma_unmap_addr(&tx_cb->map[0],
  5709. -							mapaddr),
  5710. -					 dma_unmap_len(&tx_cb->map[0], maplen),
  5711. -					 PCI_DMA_TODEVICE);
  5712. +				dma_unmap_single(&qdev->pdev->dev,
  5713. +						 dma_unmap_addr(&tx_cb->map[0], mapaddr),
  5714. +						 dma_unmap_len(&tx_cb->map[0], maplen),
  5715. +						 DMA_TO_DEVICE);
  5716.  				for (j = 1; j < tx_cb->seg_count; j++) {
  5717. -					pci_unmap_page(qdev->pdev,
  5718. -					       dma_unmap_addr(&tx_cb->map[j],
  5719. -							      mapaddr),
  5720. -					       dma_unmap_len(&tx_cb->map[j],
  5721. -							     maplen),
  5722. -					       PCI_DMA_TODEVICE);
  5723. +					dma_unmap_page(&qdev->pdev->dev,
  5724. +						       dma_unmap_addr(&tx_cb->map[j], mapaddr),
  5725. +						       dma_unmap_len(&tx_cb->map[j], maplen),
  5726. +						       DMA_TO_DEVICE);
  5727.  				}
  5728.  				dev_kfree_skb(tx_cb->skb);
  5729.  				tx_cb->skb = NULL;
  5730. @@ -3786,13 +3769,10 @@ static int ql3xxx_probe(struct pci_dev *pdev,
  5731.  
  5732.  	pci_set_master(pdev);
  5733.  
  5734. -	if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
  5735. +	if (!dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
  5736.  		pci_using_dac = 1;
  5737. -		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
  5738. -	} else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
  5739. +	else if (!(err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32))))
  5740.  		pci_using_dac = 0;
  5741. -		err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
  5742. -	}
  5743.  
  5744.  	if (err) {
  5745.  		pr_err("%s no usable DMA configuration\n", pci_name(pdev));
  5746. diff --git drivers/net/ethernet/renesas/ravb_main.c drivers/net/ethernet/renesas/ravb_main.c
  5747. index b97d450214df..2190ed6b0081 100644
  5748. --- linux-4.14.336/drivers/net/ethernet/renesas/ravb_main.c
  5749. +++ linux-4.14.336/drivers/net/ethernet/renesas/ravb_main.c
  5750. @@ -1545,7 +1545,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
  5751.  	struct ravb_tstamp_skb *ts_skb;
  5752.  	struct ravb_tx_desc *desc;
  5753.  	unsigned long flags;
  5754. -	u32 dma_addr;
  5755. +	dma_addr_t dma_addr;
  5756.  	void *buffer;
  5757.  	u32 entry;
  5758.  	u32 len;
  5759. diff --git drivers/net/fjes/fjes_hw.c drivers/net/fjes/fjes_hw.c
  5760. index 9c652c04375b..c3fa8db69b9e 100644
  5761. --- linux-4.14.336/drivers/net/fjes/fjes_hw.c
  5762. +++ linux-4.14.336/drivers/net/fjes/fjes_hw.c
  5763. @@ -235,21 +235,25 @@ static int fjes_hw_setup(struct fjes_hw *hw)
  5764.  
  5765.  	mem_size = FJES_DEV_REQ_BUF_SIZE(hw->max_epid);
  5766.  	hw->hw_info.req_buf = kzalloc(mem_size, GFP_KERNEL);
  5767. -	if (!(hw->hw_info.req_buf))
  5768. -		return -ENOMEM;
  5769. +	if (!(hw->hw_info.req_buf)) {
  5770. +		result = -ENOMEM;
  5771. +		goto free_ep_info;
  5772. +	}
  5773.  
  5774.  	hw->hw_info.req_buf_size = mem_size;
  5775.  
  5776.  	mem_size = FJES_DEV_RES_BUF_SIZE(hw->max_epid);
  5777.  	hw->hw_info.res_buf = kzalloc(mem_size, GFP_KERNEL);
  5778. -	if (!(hw->hw_info.res_buf))
  5779. -		return -ENOMEM;
  5780. +	if (!(hw->hw_info.res_buf)) {
  5781. +		result = -ENOMEM;
  5782. +		goto free_req_buf;
  5783. +	}
  5784.  
  5785.  	hw->hw_info.res_buf_size = mem_size;
  5786.  
  5787.  	result = fjes_hw_alloc_shared_status_region(hw);
  5788.  	if (result)
  5789. -		return result;
  5790. +		goto free_res_buf;
  5791.  
  5792.  	hw->hw_info.buffer_share_bit = 0;
  5793.  	hw->hw_info.buffer_unshare_reserve_bit = 0;
  5794. @@ -260,11 +264,11 @@ static int fjes_hw_setup(struct fjes_hw *hw)
  5795.  
  5796.  			result = fjes_hw_alloc_epbuf(&buf_pair->tx);
  5797.  			if (result)
  5798. -				return result;
  5799. +				goto free_epbuf;
  5800.  
  5801.  			result = fjes_hw_alloc_epbuf(&buf_pair->rx);
  5802.  			if (result)
  5803. -				return result;
  5804. +				goto free_epbuf;
  5805.  
  5806.  			spin_lock_irqsave(&hw->rx_status_lock, flags);
  5807.  			fjes_hw_setup_epbuf(&buf_pair->tx, mac,
  5808. @@ -287,6 +291,25 @@ static int fjes_hw_setup(struct fjes_hw *hw)
  5809.  	fjes_hw_init_command_registers(hw, &param);
  5810.  
  5811.  	return 0;
  5812. +
  5813. +free_epbuf:
  5814. +	for (epidx = 0; epidx < hw->max_epid ; epidx++) {
  5815. +		if (epidx == hw->my_epid)
  5816. +			continue;
  5817. +		fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].tx);
  5818. +		fjes_hw_free_epbuf(&hw->ep_shm_info[epidx].rx);
  5819. +	}
  5820. +	fjes_hw_free_shared_status_region(hw);
  5821. +free_res_buf:
  5822. +	kfree(hw->hw_info.res_buf);
  5823. +	hw->hw_info.res_buf = NULL;
  5824. +free_req_buf:
  5825. +	kfree(hw->hw_info.req_buf);
  5826. +	hw->hw_info.req_buf = NULL;
  5827. +free_ep_info:
  5828. +	kfree(hw->ep_shm_info);
  5829. +	hw->ep_shm_info = NULL;
  5830. +	return result;
  5831.  }
  5832.  
  5833.  static void fjes_hw_cleanup(struct fjes_hw *hw)
  5834. diff --git drivers/net/gtp.c drivers/net/gtp.c
  5835. index d7bf8212ff04..a222736c3117 100644
  5836. --- linux-4.14.336/drivers/net/gtp.c
  5837. +++ linux-4.14.336/drivers/net/gtp.c
  5838. @@ -1380,26 +1380,26 @@ static int __init gtp_init(void)
  5839.  
  5840.  	get_random_bytes(&gtp_h_initval, sizeof(gtp_h_initval));
  5841.  
  5842. -	err = rtnl_link_register(&gtp_link_ops);
  5843. +	err = register_pernet_subsys(&gtp_net_ops);
  5844.  	if (err < 0)
  5845.  		goto error_out;
  5846.  
  5847. -	err = genl_register_family(&gtp_genl_family);
  5848. +	err = rtnl_link_register(&gtp_link_ops);
  5849.  	if (err < 0)
  5850. -		goto unreg_rtnl_link;
  5851. +		goto unreg_pernet_subsys;
  5852.  
  5853. -	err = register_pernet_subsys(&gtp_net_ops);
  5854. +	err = genl_register_family(&gtp_genl_family);
  5855.  	if (err < 0)
  5856. -		goto unreg_genl_family;
  5857. +		goto unreg_rtnl_link;
  5858.  
  5859.  	pr_info("GTP module loaded (pdp ctx size %zd bytes)\n",
  5860.  		sizeof(struct pdp_ctx));
  5861.  	return 0;
  5862.  
  5863. -unreg_genl_family:
  5864. -	genl_unregister_family(&gtp_genl_family);
  5865.  unreg_rtnl_link:
  5866.  	rtnl_link_unregister(&gtp_link_ops);
  5867. +unreg_pernet_subsys:
  5868. +	unregister_pernet_subsys(&gtp_net_ops);
  5869.  error_out:
  5870.  	pr_err("error loading GTP module loaded\n");
  5871.  	return err;
  5872. diff --git drivers/net/ppp/ppp_async.c drivers/net/ppp/ppp_async.c
  5873. index 297a986e6653..4d981d9e0e38 100644
  5874. --- linux-4.14.336/drivers/net/ppp/ppp_async.c
  5875. +++ linux-4.14.336/drivers/net/ppp/ppp_async.c
  5876. @@ -474,6 +474,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)
  5877.  	case PPPIOCSMRU:
  5878.  		if (get_user(val, p))
  5879.  			break;
  5880. +		if (val > U16_MAX) {
  5881. +			err = -EINVAL;
  5882. +			break;
  5883. +		}
  5884.  		if (val < PPP_MRU)
  5885.  			val = PPP_MRU;
  5886.  		ap->mru = val;
  5887. diff --git drivers/net/usb/ax88172a.c drivers/net/usb/ax88172a.c
  5888. index 909755ef71ac..5881620e4436 100644
  5889. --- linux-4.14.336/drivers/net/usb/ax88172a.c
  5890. +++ linux-4.14.336/drivers/net/usb/ax88172a.c
  5891. @@ -198,7 +198,9 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
  5892.  	u8 buf[ETH_ALEN];
  5893.  	struct ax88172a_private *priv;
  5894.  
  5895. -	usbnet_get_endpoints(dev, intf);
  5896. +	ret = usbnet_get_endpoints(dev, intf);
  5897. +	if (ret)
  5898. +		return ret;
  5899.  
  5900.  	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
  5901.  	if (!priv)
  5902. diff --git drivers/net/usb/dm9601.c drivers/net/usb/dm9601.c
  5903. index 5aad26600b03..9b7db5fd9e08 100644
  5904. --- linux-4.14.336/drivers/net/usb/dm9601.c
  5905. +++ linux-4.14.336/drivers/net/usb/dm9601.c
  5906. @@ -231,7 +231,7 @@ static int dm9601_mdio_read(struct net_device *netdev, int phy_id, int loc)
  5907.  	err = dm_read_shared_word(dev, 1, loc, &res);
  5908.  	if (err < 0) {
  5909.  		netdev_err(dev->net, "MDIO read error: %d\n", err);
  5910. -		return err;
  5911. +		return 0;
  5912.  	}
  5913.  
  5914.  	netdev_dbg(dev->net,
  5915. diff --git drivers/net/usb/lan78xx.c drivers/net/usb/lan78xx.c
  5916. index d6a71c051ec1..171accb5ebbf 100644
  5917. --- linux-4.14.336/drivers/net/usb/lan78xx.c
  5918. +++ linux-4.14.336/drivers/net/usb/lan78xx.c
  5919. @@ -2450,7 +2450,8 @@ static int lan78xx_reset(struct lan78xx_net *dev)
  5920.  	if (dev->chipid == ID_REV_CHIP_ID_7801_)
  5921.  		buf &= ~MAC_CR_GMII_EN_;
  5922.  
  5923. -	if (dev->chipid == ID_REV_CHIP_ID_7800_) {
  5924. +	if (dev->chipid == ID_REV_CHIP_ID_7800_ ||
  5925. +	    dev->chipid == ID_REV_CHIP_ID_7850_) {
  5926.  		ret = lan78xx_read_raw_eeprom(dev, 0, 1, &sig);
  5927.  		if (!ret && sig != EEPROM_INDICATOR) {
  5928.  			/* Implies there is no external eeprom. Set mac speed */
  5929. diff --git drivers/net/virtio_net.c drivers/net/virtio_net.c
  5930. index 067ebdd0d589..8e1a3c523b09 100644
  5931. --- linux-4.14.336/drivers/net/virtio_net.c
  5932. +++ linux-4.14.336/drivers/net/virtio_net.c
  5933. @@ -2277,10 +2277,11 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
  5934.  {
  5935.  	vq_callback_t **callbacks;
  5936.  	struct virtqueue **vqs;
  5937. -	int ret = -ENOMEM;
  5938. -	int i, total_vqs;
  5939.  	const char **names;
  5940. +	int ret = -ENOMEM;
  5941. +	int total_vqs;
  5942.  	bool *ctx;
  5943. +	u16 i;
  5944.  
  5945.  	/* We expect 1 RX virtqueue followed by 1 TX virtqueue, followed by
  5946.  	 * possible N-1 RX/TX queue pairs used in multiqueue mode, followed by
  5947. @@ -2317,8 +2318,8 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
  5948.  	for (i = 0; i < vi->max_queue_pairs; i++) {
  5949.  		callbacks[rxq2vq(i)] = skb_recv_done;
  5950.  		callbacks[txq2vq(i)] = skb_xmit_done;
  5951. -		sprintf(vi->rq[i].name, "input.%d", i);
  5952. -		sprintf(vi->sq[i].name, "output.%d", i);
  5953. +		sprintf(vi->rq[i].name, "input.%u", i);
  5954. +		sprintf(vi->sq[i].name, "output.%u", i);
  5955.  		names[rxq2vq(i)] = vi->rq[i].name;
  5956.  		names[txq2vq(i)] = vi->sq[i].name;
  5957.  		if (ctx)
  5958. diff --git drivers/net/wan/lmc/lmc_proto.c drivers/net/wan/lmc/lmc_proto.c
  5959. index f600075e84a2..7ae39a2b6340 100644
  5960. --- linux-4.14.336/drivers/net/wan/lmc/lmc_proto.c
  5961. +++ linux-4.14.336/drivers/net/wan/lmc/lmc_proto.c
  5962. @@ -103,17 +103,13 @@ __be16 lmc_proto_type(lmc_softc_t *sc, struct sk_buff *skb) /*FOLD00*/
  5963.      switch(sc->if_type){
  5964.      case LMC_PPP:
  5965.  	    return hdlc_type_trans(skb, sc->lmc_device);
  5966. -	    break;
  5967.      case LMC_NET:
  5968.          return htons(ETH_P_802_2);
  5969. -        break;
  5970.      case LMC_RAW: /* Packet type for skbuff kind of useless */
  5971.          return htons(ETH_P_802_2);
  5972. -        break;
  5973.      default:
  5974.          printk(KERN_WARNING "%s: No protocol set for this interface, assuming 802.2 (which is wrong!!)\n", sc->name);
  5975.          return htons(ETH_P_802_2);
  5976. -        break;
  5977.      }
  5978.      lmc_trace(sc->lmc_device, "lmc_proto_tye out");
  5979.  
  5980. diff --git drivers/net/wireless/ath/ath9k/htc_drv_txrx.c drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
  5981. index e62ed7f42281..763521fca11d 100644
  5982. --- linux-4.14.336/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
  5983. +++ linux-4.14.336/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
  5984. @@ -647,9 +647,10 @@ void ath9k_htc_txstatus(struct ath9k_htc_priv *priv, void *wmi_event)
  5985.  	struct ath9k_htc_tx_event *tx_pend;
  5986.  	int i;
  5987.  
  5988. -	for (i = 0; i < txs->cnt; i++) {
  5989. -		WARN_ON(txs->cnt > HTC_MAX_TX_STATUS);
  5990. +	if (WARN_ON_ONCE(txs->cnt > HTC_MAX_TX_STATUS))
  5991. +		return;
  5992.  
  5993. +	for (i = 0; i < txs->cnt; i++) {
  5994.  		__txs = &txs->txstatus[i];
  5995.  
  5996.  		skb = ath9k_htc_tx_get_packet(priv, __txs);
  5997. diff --git drivers/net/wireless/marvell/libertas/Kconfig drivers/net/wireless/marvell/libertas/Kconfig
  5998. index e6268ceacbf1..28985cdac541 100644
  5999. --- linux-4.14.336/drivers/net/wireless/marvell/libertas/Kconfig
  6000. +++ linux-4.14.336/drivers/net/wireless/marvell/libertas/Kconfig
  6001. @@ -1,8 +1,6 @@
  6002.  config LIBERTAS
  6003.  	tristate "Marvell 8xxx Libertas WLAN driver support"
  6004.  	depends on CFG80211
  6005. -	select WIRELESS_EXT
  6006. -	select WEXT_SPY
  6007.  	select LIB80211
  6008.  	select FW_LOADER
  6009.  	---help---
  6010. diff --git drivers/net/wireless/marvell/mwifiex/cfg80211.c drivers/net/wireless/marvell/mwifiex/cfg80211.c
  6011. index a88bddc38389..76205d6b2f9c 100644
  6012. --- linux-4.14.336/drivers/net/wireless/marvell/mwifiex/cfg80211.c
  6013. +++ linux-4.14.336/drivers/net/wireless/marvell/mwifiex/cfg80211.c
  6014. @@ -1940,6 +1940,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
  6015.  
  6016.  	mwifiex_set_sys_config_invalid_data(bss_cfg);
  6017.  
  6018. +	memcpy(bss_cfg->mac_addr, priv->curr_addr, ETH_ALEN);
  6019. +
  6020.  	if (params->beacon_interval)
  6021.  		bss_cfg->beacon_period = params->beacon_interval;
  6022.  	if (params->dtim_period)
  6023. diff --git drivers/net/wireless/marvell/mwifiex/fw.h drivers/net/wireless/marvell/mwifiex/fw.h
  6024. index c802b73a15c5..99b40bc6e7a6 100644
  6025. --- linux-4.14.336/drivers/net/wireless/marvell/mwifiex/fw.h
  6026. +++ linux-4.14.336/drivers/net/wireless/marvell/mwifiex/fw.h
  6027. @@ -168,6 +168,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
  6028.  #define TLV_TYPE_STA_MAC_ADDR       (PROPRIETARY_TLV_BASE_ID + 32)
  6029.  #define TLV_TYPE_BSSID              (PROPRIETARY_TLV_BASE_ID + 35)
  6030.  #define TLV_TYPE_CHANNELBANDLIST    (PROPRIETARY_TLV_BASE_ID + 42)
  6031. +#define TLV_TYPE_UAP_MAC_ADDRESS    (PROPRIETARY_TLV_BASE_ID + 43)
  6032.  #define TLV_TYPE_UAP_BEACON_PERIOD  (PROPRIETARY_TLV_BASE_ID + 44)
  6033.  #define TLV_TYPE_UAP_DTIM_PERIOD    (PROPRIETARY_TLV_BASE_ID + 45)
  6034.  #define TLV_TYPE_UAP_BCAST_SSID     (PROPRIETARY_TLV_BASE_ID + 48)
  6035. diff --git drivers/net/wireless/marvell/mwifiex/ioctl.h drivers/net/wireless/marvell/mwifiex/ioctl.h
  6036. index 0dd592ea6e83..96ff91655a77 100644
  6037. --- linux-4.14.336/drivers/net/wireless/marvell/mwifiex/ioctl.h
  6038. +++ linux-4.14.336/drivers/net/wireless/marvell/mwifiex/ioctl.h
  6039. @@ -119,6 +119,7 @@ struct mwifiex_uap_bss_param {
  6040.  	u8 qos_info;
  6041.  	u8 power_constraint;
  6042.  	struct mwifiex_types_wmm_info wmm_info;
  6043. +	u8 mac_addr[ETH_ALEN];
  6044.  };
  6045.  
  6046.  enum {
  6047. diff --git drivers/net/wireless/marvell/mwifiex/uap_cmd.c drivers/net/wireless/marvell/mwifiex/uap_cmd.c
  6048. index 0939a8c8f3ab..1ab253c97c14 100644
  6049. --- linux-4.14.336/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
  6050. +++ linux-4.14.336/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
  6051. @@ -479,6 +479,7 @@ void mwifiex_config_uap_11d(struct mwifiex_private *priv,
  6052.  static int
  6053.  mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
  6054.  {
  6055. +	struct host_cmd_tlv_mac_addr *mac_tlv;
  6056.  	struct host_cmd_tlv_dtim_period *dtim_period;
  6057.  	struct host_cmd_tlv_beacon_period *beacon_period;
  6058.  	struct host_cmd_tlv_ssid *ssid;
  6059. @@ -498,6 +499,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
  6060.  	int i;
  6061.  	u16 cmd_size = *param_size;
  6062.  
  6063. +	mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv;
  6064. +	mac_tlv->header.type = cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
  6065. +	mac_tlv->header.len = cpu_to_le16(ETH_ALEN);
  6066. +	memcpy(mac_tlv->mac_addr, bss_cfg->mac_addr, ETH_ALEN);
  6067. +	cmd_size += sizeof(struct host_cmd_tlv_mac_addr);
  6068. +	tlv += sizeof(struct host_cmd_tlv_mac_addr);
  6069. +
  6070.  	if (bss_cfg->ssid.ssid_len) {
  6071.  		ssid = (struct host_cmd_tlv_ssid *)tlv;
  6072.  		ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID);
  6073. diff --git drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
  6074. index bfd704b17a44..9263a6a64788 100644
  6075. --- linux-4.14.336/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
  6076. +++ linux-4.14.336/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
  6077. @@ -6366,6 +6366,18 @@ static const struct usb_device_id dev_table[] = {
  6078.  	.driver_info = (unsigned long)&rtl8192eu_fops},
  6079.  {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x818c, 0xff, 0xff, 0xff),
  6080.  	.driver_info = (unsigned long)&rtl8192eu_fops},
  6081. +/* D-Link DWA-131 rev C1 */
  6082. +{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3312, 0xff, 0xff, 0xff),
  6083. +	.driver_info = (unsigned long)&rtl8192eu_fops},
  6084. +/* TP-Link TL-WN8200ND V2 */
  6085. +{USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0126, 0xff, 0xff, 0xff),
  6086. +	.driver_info = (unsigned long)&rtl8192eu_fops},
  6087. +/* Mercusys MW300UM */
  6088. +{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0100, 0xff, 0xff, 0xff),
  6089. +	.driver_info = (unsigned long)&rtl8192eu_fops},
  6090. +/* Mercusys MW300UH */
  6091. +{USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0104, 0xff, 0xff, 0xff),
  6092. +	.driver_info = (unsigned long)&rtl8192eu_fops},
  6093.  #endif
  6094.  { }
  6095.  };
  6096. diff --git drivers/net/wireless/realtek/rtlwifi/pci.c drivers/net/wireless/realtek/rtlwifi/pci.c
  6097. index ab74f3155854..b6c3a6d422ea 100644
  6098. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/pci.c
  6099. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/pci.c
  6100. @@ -194,21 +194,29 @@ static bool _rtl_pci_platform_switch_device_pci_aspm(
  6101.  	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
  6102.  	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
  6103.  
  6104. +	value &= PCI_EXP_LNKCTL_ASPMC;
  6105. +
  6106.  	if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE)
  6107. -		value |= 0x40;
  6108. +		value |= PCI_EXP_LNKCTL_CCC;
  6109.  
  6110. -	pci_write_config_byte(rtlpci->pdev, 0x80, value);
  6111. +	pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
  6112. +					   PCI_EXP_LNKCTL_ASPMC | value,
  6113. +					   value);
  6114.  
  6115.  	return false;
  6116.  }
  6117.  
  6118. -/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/
  6119. -static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u8 value)
  6120. +/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */
  6121. +static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value)
  6122.  {
  6123.  	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
  6124.  	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
  6125.  
  6126. -	pci_write_config_byte(rtlpci->pdev, 0x81, value);
  6127. +	value &= PCI_EXP_LNKCTL_CLKREQ_EN;
  6128. +
  6129. +	pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
  6130. +					   PCI_EXP_LNKCTL_CLKREQ_EN,
  6131. +					   value);
  6132.  
  6133.  	if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE)
  6134.  		udelay(100);
  6135. @@ -222,11 +230,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
  6136.  	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
  6137.  	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
  6138.  	u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
  6139. -	u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
  6140.  	/*Retrieve original configuration settings. */
  6141.  	u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg;
  6142. -	u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter.
  6143. -				pcibridge_linkctrlreg;
  6144.  	u16 aspmlevel = 0;
  6145.  	u8 tmp_u1b = 0;
  6146.  
  6147. @@ -251,16 +256,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
  6148.  	/*Set corresponding value. */
  6149.  	aspmlevel |= BIT(0) | BIT(1);
  6150.  	linkctrl_reg &= ~aspmlevel;
  6151. -	pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1));
  6152.  
  6153.  	_rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg);
  6154. -	udelay(50);
  6155. -
  6156. -	/*4 Disable Pci Bridge ASPM */
  6157. -	pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
  6158. -			      pcibridge_linkctrlreg);
  6159. -
  6160. -	udelay(50);
  6161.  }
  6162.  
  6163.  /*
  6164. @@ -276,9 +273,7 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
  6165.  	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
  6166.  	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
  6167.  	u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
  6168. -	u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
  6169.  	u16 aspmlevel;
  6170. -	u8 u_pcibridge_aspmsetting;
  6171.  	u8 u_device_aspmsetting;
  6172.  
  6173.  	if (!ppsc->support_aspm)
  6174. @@ -290,25 +285,6 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
  6175.  		return;
  6176.  	}
  6177.  
  6178. -	/*4 Enable Pci Bridge ASPM */
  6179. -
  6180. -	u_pcibridge_aspmsetting =
  6181. -	    pcipriv->ndis_adapter.pcibridge_linkctrlreg |
  6182. -	    rtlpci->const_hostpci_aspm_setting;
  6183. -
  6184. -	if (pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL)
  6185. -		u_pcibridge_aspmsetting &= ~BIT(0);
  6186. -
  6187. -	pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
  6188. -			      u_pcibridge_aspmsetting);
  6189. -
  6190. -	RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
  6191. -		 "PlatformEnableASPM(): Write reg[%x] = %x\n",
  6192. -		 (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
  6193. -		 u_pcibridge_aspmsetting);
  6194. -
  6195. -	udelay(50);
  6196. -
  6197.  	/*Get ASPM level (with/without Clock Req) */
  6198.  	aspmlevel = rtlpci->const_devicepci_aspm_setting;
  6199.  	u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg;
  6200. @@ -322,7 +298,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
  6201.  
  6202.  	if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
  6203.  		_rtl_pci_switch_clk_req(hw, (ppsc->reg_rfps_level &
  6204. -					     RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
  6205. +					     RT_RF_OFF_LEVL_CLK_REQ) ?
  6206. +					     PCI_EXP_LNKCTL_CLKREQ_EN : 0);
  6207.  		RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_CLK_REQ);
  6208.  	}
  6209.  	udelay(100);
  6210. @@ -390,22 +367,6 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
  6211.  	return find_buddy_priv;
  6212.  }
  6213.  
  6214. -static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw)
  6215. -{
  6216. -	struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
  6217. -	struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
  6218. -	u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset;
  6219. -	u8 linkctrl_reg;
  6220. -	u8 num4bbytes;
  6221. -
  6222. -	num4bbytes = (capabilityoffset + 0x10) / 4;
  6223. -
  6224. -	/*Read  Link Control Register */
  6225. -	pci_read_config_byte(rtlpci->pdev, (num4bbytes << 2), &linkctrl_reg);
  6226. -
  6227. -	pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg;
  6228. -}
  6229. -
  6230.  static void rtl_pci_parse_configuration(struct pci_dev *pdev,
  6231.  		struct ieee80211_hw *hw)
  6232.  {
  6233. @@ -2076,12 +2037,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
  6234.  		    PCI_SLOT(bridge_pdev->devfn);
  6235.  		pcipriv->ndis_adapter.pcibridge_funcnum =
  6236.  		    PCI_FUNC(bridge_pdev->devfn);
  6237. -		pcipriv->ndis_adapter.pcibridge_pciehdr_offset =
  6238. -		    pci_pcie_cap(bridge_pdev);
  6239. -		pcipriv->ndis_adapter.num4bytes =
  6240. -		    (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10) / 4;
  6241. -
  6242. -		rtl_pci_get_linkcontrol_field(hw);
  6243.  
  6244.  		if (pcipriv->ndis_adapter.pcibridge_vendor ==
  6245.  		    PCI_BRIDGE_VENDOR_AMD) {
  6246. @@ -2098,13 +2053,11 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
  6247.  		 pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
  6248.  
  6249.  	RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
  6250. -		 "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
  6251. +		 "pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n",
  6252.  		 pcipriv->ndis_adapter.pcibridge_busnum,
  6253.  		 pcipriv->ndis_adapter.pcibridge_devnum,
  6254.  		 pcipriv->ndis_adapter.pcibridge_funcnum,
  6255.  		 pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
  6256. -		 pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
  6257. -		 pcipriv->ndis_adapter.pcibridge_linkctrlreg,
  6258.  		 pcipriv->ndis_adapter.amd_l1_patch);
  6259.  
  6260.  	rtl_pci_parse_configuration(pdev, hw);
  6261. diff --git drivers/net/wireless/realtek/rtlwifi/pci.h drivers/net/wireless/realtek/rtlwifi/pci.h
  6262. index d9039ea10ba4..19b7a57313da 100644
  6263. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/pci.h
  6264. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/pci.h
  6265. @@ -262,11 +262,6 @@ struct mp_adapter {
  6266.  	u16 pcibridge_vendorid;
  6267.  	u16 pcibridge_deviceid;
  6268.  
  6269. -	u8 num4bytes;
  6270. -
  6271. -	u8 pcibridge_pciehdr_offset;
  6272. -	u8 pcibridge_linkctrlreg;
  6273. -
  6274.  	bool amd_l1_patch;
  6275.  };
  6276.  
  6277. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
  6278. index 14a256062614..44cabfa1ca27 100644
  6279. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
  6280. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
  6281. @@ -38,7 +38,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,
  6282.  static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
  6283.  					enum radio_path rfpath, u32 offset,
  6284.  					u32 data);
  6285. -static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask);
  6286.  static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw);
  6287.  static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
  6288.  static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
  6289. @@ -68,7 +67,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6290.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6291.  		 "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
  6292.  	originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6293. -	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
  6294. +	bitshift = calculate_bit_shift(bitmask);
  6295.  	returnvalue = (originalvalue & bitmask) >> bitshift;
  6296.  
  6297.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6298. @@ -91,7 +90,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
  6299.  
  6300.  	if (bitmask != MASKDWORD) {
  6301.  		originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6302. -		bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
  6303. +		bitshift = calculate_bit_shift(bitmask);
  6304.  		data = ((originalvalue & (~bitmask)) | (data << bitshift));
  6305.  	}
  6306.  
  6307. @@ -117,7 +116,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
  6308.  
  6309.  
  6310.  	original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr);
  6311. -	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
  6312. +	bitshift = calculate_bit_shift(bitmask);
  6313.  	readback_value = (original_value & bitmask) >> bitshift;
  6314.  
  6315.  	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
  6316. @@ -146,7 +145,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
  6317.  			original_value = _rtl88e_phy_rf_serial_read(hw,
  6318.  								    rfpath,
  6319.  								    regaddr);
  6320. -			bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
  6321. +			bitshift = calculate_bit_shift(bitmask);
  6322.  			data =
  6323.  			    ((original_value & (~bitmask)) |
  6324.  			     (data << bitshift));
  6325. @@ -232,17 +231,6 @@ static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
  6326.  		 rfpath, pphyreg->rf3wire_offset, data_and_addr);
  6327.  }
  6328.  
  6329. -static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask)
  6330. -{
  6331. -	u32 i;
  6332. -
  6333. -	for (i = 0; i <= 31; i++) {
  6334. -		if (((bitmask >> i) & 0x1) == 1)
  6335. -			break;
  6336. -	}
  6337. -	return i;
  6338. -}
  6339. -
  6340.  bool rtl88e_phy_mac_config(struct ieee80211_hw *hw)
  6341.  {
  6342.  	struct rtl_priv *rtlpriv = rtl_priv(hw);
  6343. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
  6344. index 7c6e5d91439d..bc2b3849828d 100644
  6345. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
  6346. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
  6347. @@ -39,7 +39,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6348.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
  6349.  		 regaddr, bitmask);
  6350.  	originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6351. -	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6352. +	bitshift = calculate_bit_shift(bitmask);
  6353.  	returnvalue = (originalvalue & bitmask) >> bitshift;
  6354.  
  6355.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6356. @@ -62,7 +62,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
  6357.  
  6358.  	if (bitmask != MASKDWORD) {
  6359.  		originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6360. -		bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6361. +		bitshift = calculate_bit_shift(bitmask);
  6362.  		data = ((originalvalue & (~bitmask)) | (data << bitshift));
  6363.  	}
  6364.  
  6365. @@ -165,18 +165,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
  6366.  }
  6367.  EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);
  6368.  
  6369. -u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask)
  6370. -{
  6371. -	u32 i;
  6372. -
  6373. -	for (i = 0; i <= 31; i++) {
  6374. -		if (((bitmask >> i) & 0x1) == 1)
  6375. -			break;
  6376. -	}
  6377. -	return i;
  6378. -}
  6379. -EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift);
  6380. -
  6381.  static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw)
  6382.  {
  6383.  	rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2);
  6384. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
  6385. index d11261e05a2e..76f574047c62 100644
  6386. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
  6387. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
  6388. @@ -218,7 +218,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,
  6389.  void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
  6390.  void rtl92c_phy_set_io(struct ieee80211_hw *hw);
  6391.  void rtl92c_bb_block_on(struct ieee80211_hw *hw);
  6392. -u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
  6393.  long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
  6394.  				  enum wireless_mode wirelessmode,
  6395.  				  u8 txpwridx);
  6396. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
  6397. index 7c6d7fc1ef9a..9f478d8af804 100644
  6398. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
  6399. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
  6400. @@ -61,7 +61,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
  6401.  							       rfpath, regaddr);
  6402.  	}
  6403.  
  6404. -	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6405. +	bitshift = calculate_bit_shift(bitmask);
  6406.  	readback_value = (original_value & bitmask) >> bitshift;
  6407.  
  6408.  	spin_unlock(&rtlpriv->locks.rf_lock);
  6409. @@ -132,7 +132,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
  6410.  			original_value = _rtl92c_phy_rf_serial_read(hw,
  6411.  								    rfpath,
  6412.  								    regaddr);
  6413. -			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6414. +			bitshift = calculate_bit_shift(bitmask);
  6415.  			data =
  6416.  			    ((original_value & (~bitmask)) |
  6417.  			     (data << bitshift));
  6418. @@ -144,7 +144,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
  6419.  			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
  6420.  								       rfpath,
  6421.  								       regaddr);
  6422. -			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6423. +			bitshift = calculate_bit_shift(bitmask);
  6424.  			data =
  6425.  			    ((original_value & (~bitmask)) |
  6426.  			     (data << bitshift));
  6427. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
  6428. index 93f3bc0197b4..e084a91e26d9 100644
  6429. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
  6430. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
  6431. @@ -116,7 +116,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
  6432.  			       u32 offset);
  6433.  u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
  6434.  				  enum radio_path rfpath, u32 offset);
  6435. -u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
  6436.  void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
  6437.  				 enum radio_path rfpath, u32 offset, u32 data);
  6438.  void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
  6439. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
  6440. index f068dd5317a7..5a5476a2dc2f 100644
  6441. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
  6442. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
  6443. @@ -54,7 +54,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
  6444.  		original_value = _rtl92c_phy_fw_rf_serial_read(hw,
  6445.  							       rfpath, regaddr);
  6446.  	}
  6447. -	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6448. +	bitshift = calculate_bit_shift(bitmask);
  6449.  	readback_value = (original_value & bitmask) >> bitshift;
  6450.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6451.  		 "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
  6452. @@ -78,7 +78,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
  6453.  			original_value = _rtl92c_phy_rf_serial_read(hw,
  6454.  								    rfpath,
  6455.  								    regaddr);
  6456. -			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6457. +			bitshift = calculate_bit_shift(bitmask);
  6458.  			data =
  6459.  			    ((original_value & (~bitmask)) |
  6460.  			     (data << bitshift));
  6461. @@ -89,7 +89,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
  6462.  			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
  6463.  								       rfpath,
  6464.  								       regaddr);
  6465. -			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
  6466. +			bitshift = calculate_bit_shift(bitmask);
  6467.  			data =
  6468.  			    ((original_value & (~bitmask)) |
  6469.  			     (data << bitshift));
  6470. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
  6471. index 53734250479c..2ee779614269 100644
  6472. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
  6473. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
  6474. @@ -182,17 +182,14 @@ static u32 targetchnl_2g[TARGET_CHNL_NUM_2G] = {
  6475.  	25711, 25658, 25606, 25554, 25502, 25451, 25328
  6476.  };
  6477.  
  6478. -static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask)
  6479. -{
  6480. -	u32 i;
  6481. -
  6482. -	for (i = 0; i <= 31; i++) {
  6483. -		if (((bitmask >> i) & 0x1) == 1)
  6484. -			break;
  6485. -	}
  6486. -
  6487. -	return i;
  6488. -}
  6489. +static const u8 channel_all[59] = {
  6490. +	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
  6491. +	36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
  6492. +	60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
  6493. +	114, 116, 118, 120, 122, 124, 126, 128,	130,
  6494. +	132, 134, 136, 138, 140, 149, 151, 153, 155,
  6495. +	157, 159, 161, 163, 165
  6496. +};
  6497.  
  6498.  u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6499.  {
  6500. @@ -216,7 +213,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6501.  	} else {
  6502.  		originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6503.  	}
  6504. -	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
  6505. +	bitshift = calculate_bit_shift(bitmask);
  6506.  	returnvalue = (originalvalue & bitmask) >> bitshift;
  6507.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6508.  		 "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
  6509. @@ -248,7 +245,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
  6510.  					dbi_direct);
  6511.  		else
  6512.  			originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6513. -		bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
  6514. +		bitshift = calculate_bit_shift(bitmask);
  6515.  		data = ((originalvalue & (~bitmask)) | (data << bitshift));
  6516.  	}
  6517.  	if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
  6518. @@ -336,7 +333,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
  6519.  		 regaddr, rfpath, bitmask);
  6520.  	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
  6521.  	original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr);
  6522. -	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
  6523. +	bitshift = calculate_bit_shift(bitmask);
  6524.  	readback_value = (original_value & bitmask) >> bitshift;
  6525.  	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
  6526.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6527. @@ -363,7 +360,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
  6528.  		if (bitmask != RFREG_OFFSET_MASK) {
  6529.  			original_value = _rtl92d_phy_rf_serial_read(hw,
  6530.  				rfpath, regaddr);
  6531. -			bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
  6532. +			bitshift = calculate_bit_shift(bitmask);
  6533.  			data = ((original_value & (~bitmask)) |
  6534.  				(data << bitshift));
  6535.  		}
  6536. @@ -1383,14 +1380,6 @@ static void _rtl92d_phy_switch_rf_setting(struct ieee80211_hw *hw, u8 channel)
  6537.  
  6538.  u8 rtl92d_get_rightchnlplace_for_iqk(u8 chnl)
  6539.  {
  6540. -	u8 channel_all[59] = {
  6541. -		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
  6542. -		36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58,
  6543. -		60, 62, 64, 100, 102, 104, 106, 108, 110, 112,
  6544. -		114, 116, 118, 120, 122, 124, 126, 128,	130,
  6545. -		132, 134, 136, 138, 140, 149, 151, 153, 155,
  6546. -		157, 159, 161, 163, 165
  6547. -	};
  6548.  	u8 place = chnl;
  6549.  
  6550.  	if (chnl > 14) {
  6551. @@ -3245,37 +3234,28 @@ void rtl92d_phy_config_macphymode_info(struct ieee80211_hw *hw)
  6552.  u8 rtl92d_get_chnlgroup_fromarray(u8 chnl)
  6553.  {
  6554.  	u8 group;
  6555. -	u8 channel_info[59] = {
  6556. -		1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
  6557. -		36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56,
  6558. -		58, 60, 62, 64, 100, 102, 104, 106, 108,
  6559. -		110, 112, 114, 116, 118, 120, 122, 124,
  6560. -		126, 128, 130, 132, 134, 136, 138, 140,
  6561. -		149, 151, 153, 155, 157, 159, 161, 163,
  6562. -		165
  6563. -	};
  6564.  
  6565. -	if (channel_info[chnl] <= 3)
  6566. +	if (channel_all[chnl] <= 3)
  6567.  		group = 0;
  6568. -	else if (channel_info[chnl] <= 9)
  6569. +	else if (channel_all[chnl] <= 9)
  6570.  		group = 1;
  6571. -	else if (channel_info[chnl] <= 14)
  6572. +	else if (channel_all[chnl] <= 14)
  6573.  		group = 2;
  6574. -	else if (channel_info[chnl] <= 44)
  6575. +	else if (channel_all[chnl] <= 44)
  6576.  		group = 3;
  6577. -	else if (channel_info[chnl] <= 54)
  6578. +	else if (channel_all[chnl] <= 54)
  6579.  		group = 4;
  6580. -	else if (channel_info[chnl] <= 64)
  6581. +	else if (channel_all[chnl] <= 64)
  6582.  		group = 5;
  6583. -	else if (channel_info[chnl] <= 112)
  6584. +	else if (channel_all[chnl] <= 112)
  6585.  		group = 6;
  6586. -	else if (channel_info[chnl] <= 126)
  6587. +	else if (channel_all[chnl] <= 126)
  6588.  		group = 7;
  6589. -	else if (channel_info[chnl] <= 140)
  6590. +	else if (channel_all[chnl] <= 140)
  6591.  		group = 8;
  6592. -	else if (channel_info[chnl] <= 153)
  6593. +	else if (channel_all[chnl] <= 153)
  6594.  		group = 9;
  6595. -	else if (channel_info[chnl] <= 159)
  6596. +	else if (channel_all[chnl] <= 159)
  6597.  		group = 10;
  6598.  	else
  6599.  		group = 11;
  6600. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
  6601. index 8b072ee8e0d5..9a3e88d6a570 100644
  6602. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
  6603. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
  6604. @@ -38,7 +38,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,
  6605.  static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
  6606.  					 enum radio_path rfpath, u32 offset,
  6607.  					 u32 data);
  6608. -static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask);
  6609.  static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw);
  6610.  static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
  6611.  static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
  6612. @@ -68,7 +67,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6613.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6614.  		 "regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
  6615.  	originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6616. -	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
  6617. +	bitshift = calculate_bit_shift(bitmask);
  6618.  	returnvalue = (originalvalue & bitmask) >> bitshift;
  6619.  
  6620.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
  6621. @@ -90,7 +89,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,
  6622.  
  6623.  	if (bitmask != MASKDWORD) {
  6624.  		originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6625. -		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
  6626. +		bitshift = calculate_bit_shift(bitmask);
  6627.  		data = ((originalvalue & (~bitmask)) | (data << bitshift));
  6628.  	}
  6629.  
  6630. @@ -115,7 +114,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,
  6631.  	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
  6632.  
  6633.  	original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr);
  6634. -	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
  6635. +	bitshift = calculate_bit_shift(bitmask);
  6636.  	readback_value = (original_value & bitmask) >> bitshift;
  6637.  
  6638.  	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
  6639. @@ -143,7 +142,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,
  6640.  
  6641.  	if (bitmask != RFREG_OFFSET_MASK) {
  6642.  		original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr);
  6643. -		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
  6644. +		bitshift = calculate_bit_shift(bitmask);
  6645.  		data = (original_value & (~bitmask)) | (data << bitshift);
  6646.  	}
  6647.  
  6648. @@ -226,17 +225,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
  6649.  		 pphyreg->rf3wire_offset, data_and_addr);
  6650.  }
  6651.  
  6652. -static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask)
  6653. -{
  6654. -	u32 i;
  6655. -
  6656. -	for (i = 0; i <= 31; i++) {
  6657. -		if (((bitmask >> i) & 0x1) == 1)
  6658. -			break;
  6659. -	}
  6660. -	return i;
  6661. -}
  6662. -
  6663.  bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw)
  6664.  {
  6665.  	return _rtl92ee_phy_config_mac_with_headerfile(hw);
  6666. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
  6667. index 86cb853f7169..0430a3b823d6 100644
  6668. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
  6669. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
  6670. @@ -36,18 +36,6 @@
  6671.  #include "hw.h"
  6672.  #include "table.h"
  6673.  
  6674. -static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask)
  6675. -{
  6676. -	u32 i;
  6677. -
  6678. -	for (i = 0; i <= 31; i++) {
  6679. -		if (((bitmask >> i) & 0x1) == 1)
  6680. -			break;
  6681. -	}
  6682. -
  6683. -	return i;
  6684. -}
  6685. -
  6686.  u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6687.  {
  6688.  	struct rtl_priv *rtlpriv = rtl_priv(hw);
  6689. @@ -57,7 +45,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
  6690.  		 regaddr, bitmask);
  6691.  
  6692.  	originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6693. -	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
  6694. +	bitshift = calculate_bit_shift(bitmask);
  6695.  	returnvalue = (originalvalue & bitmask) >> bitshift;
  6696.  
  6697.  	RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
  6698. @@ -79,7 +67,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
  6699.  
  6700.  	if (bitmask != MASKDWORD) {
  6701.  		originalvalue = rtl_read_dword(rtlpriv, regaddr);
  6702. -		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
  6703. +		bitshift = calculate_bit_shift(bitmask);
  6704.  		data = ((originalvalue & (~bitmask)) | (data << bitshift));
  6705.  	}
  6706.  
  6707. @@ -187,7 +175,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
  6708.  
  6709.  	original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr);
  6710.  
  6711. -	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
  6712. +	bitshift = calculate_bit_shift(bitmask);
  6713.  	readback_value = (original_value & bitmask) >> bitshift;
  6714.  
  6715.  	spin_unlock(&rtlpriv->locks.rf_lock);
  6716. @@ -218,7 +206,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
  6717.  	if (bitmask != RFREG_OFFSET_MASK) {
  6718.  		original_value = _rtl92s_phy_rf_serial_read(hw, rfpath,
  6719.  							    regaddr);
  6720. -		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
  6721. +		bitshift = calculate_bit_shift(bitmask);
  6722.  		data = ((original_value & (~bitmask)) | (data << bitshift));
  6723.  	}
  6724.  
  6725. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
  6726. index 5cf29f5a4b54..e6ac496e898e 100644
  6727. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
  6728. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/phy.c
  6729. @@ -72,7 +72,7 @@ u32 rtl8723e_phy_query_rf_reg(struct ieee80211_hw *hw,
  6730.  							    rfpath, regaddr);
  6731.  	}
  6732.  
  6733. -	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
  6734. +	bitshift = calculate_bit_shift(bitmask);
  6735.  	readback_value = (original_value & bitmask) >> bitshift;
  6736.  
  6737.  	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
  6738. @@ -104,7 +104,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
  6739.  			original_value = rtl8723_phy_rf_serial_read(hw,
  6740.  								    rfpath,
  6741.  								    regaddr);
  6742. -			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
  6743. +			bitshift = calculate_bit_shift(bitmask);
  6744.  			data =
  6745.  			    ((original_value & (~bitmask)) |
  6746.  			     (data << bitshift));
  6747. @@ -113,7 +113,7 @@ void rtl8723e_phy_set_rf_reg(struct ieee80211_hw *hw,
  6748.  		rtl8723_phy_rf_serial_write(hw, rfpath, regaddr, data);
  6749.  	} else {
  6750.  		if (bitmask != RFREG_OFFSET_MASK) {
  6751. -			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
  6752. +			bitshift = calculate_bit_shift(bitmask);
  6753.  			data =
  6754.  			    ((original_value & (~bitmask)) |
  6755.  			     (data << bitshift));
  6756. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
  6757. index 9606641519e7..f1b42f9d6cd1 100644
  6758. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
  6759. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723be/phy.c
  6760. @@ -63,7 +63,7 @@ u32 rtl8723be_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
  6761.  	spin_lock_irqsave(&rtlpriv->locks.rf_lock, flags);
  6762.  
  6763.  	original_value = rtl8723_phy_rf_serial_read(hw, rfpath, regaddr);
  6764. -	bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
  6765. +	bitshift = calculate_bit_shift(bitmask);
  6766.  	readback_value = (original_value & bitmask) >> bitshift;
  6767.  
  6768.  	spin_unlock_irqrestore(&rtlpriv->locks.rf_lock, flags);
  6769. @@ -91,7 +91,7 @@ void rtl8723be_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path path,
  6770.  	if (bitmask != RFREG_OFFSET_MASK) {
  6771.  			original_value = rtl8723_phy_rf_serial_read(hw, path,
  6772.  								    regaddr);
  6773. -			bitshift = rtl8723_phy_calculate_bit_shift(bitmask);
  6774. +			bitshift = calculate_bit_shift(bitmask);
  6775.  			data = ((original_value & (~bitmask)) |
  6776.  				(data << bitshift));
  6777.  		}
  6778. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c
  6779. index 43d24e1ee5e6..af9cd74e09d4 100644
  6780. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c
  6781. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c
  6782. @@ -75,13 +75,9 @@ EXPORT_SYMBOL_GPL(rtl8723_phy_set_bb_reg);
  6783.  
  6784.  u32 rtl8723_phy_calculate_bit_shift(u32 bitmask)
  6785.  {
  6786. -	u32 i;
  6787. +	u32 i = ffs(bitmask);
  6788.  
  6789. -	for (i = 0; i <= 31; i++) {
  6790. -		if (((bitmask >> i) & 0x1) == 1)
  6791. -			break;
  6792. -	}
  6793. -	return i;
  6794. +	return i ? i - 1 : 32;
  6795.  }
  6796.  EXPORT_SYMBOL_GPL(rtl8723_phy_calculate_bit_shift);
  6797.  
  6798. diff --git drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
  6799. index 176deb2b5386..f96d823e7f14 100644
  6800. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
  6801. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
  6802. @@ -49,7 +49,13 @@ static u32 _rtl8821ae_phy_rf_serial_read(struct ieee80211_hw *hw,
  6803.  static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
  6804.  					   enum radio_path rfpath, u32 offset,
  6805.  					   u32 data);
  6806. -static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask);
  6807. +static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
  6808. +{
  6809. +	if (WARN_ON_ONCE(!bitmask))
  6810. +		return 0;
  6811. +
  6812. +	return __ffs(bitmask);
  6813. +}
  6814.  static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw);
  6815.  /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
  6816.  static bool _rtl8821ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
  6817. @@ -296,17 +302,6 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
  6818.  		 rfpath, pphyreg->rf3wire_offset, data_and_addr);
  6819.  }
  6820.  
  6821. -static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
  6822. -{
  6823. -	u32 i;
  6824. -
  6825. -	for (i = 0; i <= 31; i++) {
  6826. -		if (((bitmask >> i) & 0x1) == 1)
  6827. -			break;
  6828. -	}
  6829. -	return i;
  6830. -}
  6831. -
  6832.  bool rtl8821ae_phy_mac_config(struct ieee80211_hw *hw)
  6833.  {
  6834.  	bool rtstatus = 0;
  6835. diff --git drivers/net/wireless/realtek/rtlwifi/wifi.h drivers/net/wireless/realtek/rtlwifi/wifi.h
  6836. index c73ce334ce6c..61f5b6fc1754 100644
  6837. --- linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/wifi.h
  6838. +++ linux-4.14.336/drivers/net/wireless/realtek/rtlwifi/wifi.h
  6839. @@ -3095,4 +3095,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw,
  6840.  	return ieee80211_find_sta(mac->vif, mac_addr);
  6841.  }
  6842.  
  6843. +static inline u32 calculate_bit_shift(u32 bitmask)
  6844. +{
  6845. +	if (WARN_ON_ONCE(!bitmask))
  6846. +		return 0;
  6847. +
  6848. +	return __ffs(bitmask);
  6849. +}
  6850.  #endif
  6851. diff --git drivers/net/xen-netback/netback.c drivers/net/xen-netback/netback.c
  6852. index 47e7e9aab9cf..901ddea37da6 100644
  6853. --- linux-4.14.336/drivers/net/xen-netback/netback.c
  6854. +++ linux-4.14.336/drivers/net/xen-netback/netback.c
  6855. @@ -97,13 +97,12 @@ module_param_named(hash_cache_size, xenvif_hash_cache_size, uint, 0644);
  6856.  MODULE_PARM_DESC(hash_cache_size, "Number of flows in the hash cache");
  6857.  
  6858.  static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
  6859. -			       u8 status);
  6860. +			       s8 status);
  6861.  
  6862.  static void make_tx_response(struct xenvif_queue *queue,
  6863. -			     struct xen_netif_tx_request *txp,
  6864. +			     const struct xen_netif_tx_request *txp,
  6865.  			     unsigned int extra_count,
  6866. -			     s8       st);
  6867. -static void push_tx_responses(struct xenvif_queue *queue);
  6868. +			     s8 status);
  6869.  
  6870.  static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx);
  6871.  
  6872. @@ -201,13 +200,9 @@ static void xenvif_tx_err(struct xenvif_queue *queue,
  6873.  			  unsigned int extra_count, RING_IDX end)
  6874.  {
  6875.  	RING_IDX cons = queue->tx.req_cons;
  6876. -	unsigned long flags;
  6877.  
  6878.  	do {
  6879. -		spin_lock_irqsave(&queue->response_lock, flags);
  6880.  		make_tx_response(queue, txp, extra_count, XEN_NETIF_RSP_ERROR);
  6881. -		push_tx_responses(queue);
  6882. -		spin_unlock_irqrestore(&queue->response_lock, flags);
  6883.  		if (cons == end)
  6884.  			break;
  6885.  		RING_COPY_REQUEST(&queue->tx, cons++, txp);
  6886. @@ -456,12 +451,20 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
  6887.  	}
  6888.  
  6889.  	for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;
  6890. -	     shinfo->nr_frags++, gop++, nr_slots--) {
  6891. +	     nr_slots--) {
  6892. +		if (unlikely(!txp->size)) {
  6893. +			make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY);
  6894. +			++txp;
  6895. +			continue;
  6896. +		}
  6897. +
  6898.  		index = pending_index(queue->pending_cons++);
  6899.  		pending_idx = queue->pending_ring[index];
  6900.  		xenvif_tx_create_map_op(queue, pending_idx, txp,
  6901.  				        txp == first ? extra_count : 0, gop);
  6902.  		frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
  6903. +		++shinfo->nr_frags;
  6904. +		++gop;
  6905.  
  6906.  		if (txp == first)
  6907.  			txp = txfrags;
  6908. @@ -474,20 +477,33 @@ static void xenvif_get_requests(struct xenvif_queue *queue,
  6909.  		shinfo = skb_shinfo(nskb);
  6910.  		frags = shinfo->frags;
  6911.  
  6912. -		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
  6913. -		     shinfo->nr_frags++, txp++, gop++) {
  6914. +		for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) {
  6915. +			if (unlikely(!txp->size)) {
  6916. +				make_tx_response(queue, txp, 0,
  6917. +						 XEN_NETIF_RSP_OKAY);
  6918. +				continue;
  6919. +			}
  6920. +
  6921.  			index = pending_index(queue->pending_cons++);
  6922.  			pending_idx = queue->pending_ring[index];
  6923.  			xenvif_tx_create_map_op(queue, pending_idx, txp, 0,
  6924.  						gop);
  6925.  			frag_set_pending_idx(&frags[shinfo->nr_frags],
  6926.  					     pending_idx);
  6927. +			++shinfo->nr_frags;
  6928. +			++gop;
  6929. +		}
  6930. +
  6931. +		if (shinfo->nr_frags) {
  6932. +			skb_shinfo(skb)->frag_list = nskb;
  6933. +			nskb = NULL;
  6934.  		}
  6935. +	}
  6936.  
  6937. -		skb_shinfo(skb)->frag_list = nskb;
  6938. -	} else if (nskb) {
  6939. +	if (nskb) {
  6940.  		/* A frag_list skb was allocated but it is no longer needed
  6941. -		 * because enough slots were converted to copy ops above.
  6942. +		 * because enough slots were converted to copy ops above or some
  6943. +		 * were empty.
  6944.  		 */
  6945.  		kfree_skb(nskb);
  6946.  	}
  6947. @@ -960,7 +976,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
  6948.  					 (ret == 0) ?
  6949.  					 XEN_NETIF_RSP_OKAY :
  6950.  					 XEN_NETIF_RSP_ERROR);
  6951. -			push_tx_responses(queue);
  6952.  			continue;
  6953.  		}
  6954.  
  6955. @@ -972,7 +987,6 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,
  6956.  
  6957.  			make_tx_response(queue, &txreq, extra_count,
  6958.  					 XEN_NETIF_RSP_OKAY);
  6959. -			push_tx_responses(queue);
  6960.  			continue;
  6961.  		}
  6962.  
  6963. @@ -1398,8 +1412,35 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
  6964.  	return work_done;
  6965.  }
  6966.  
  6967. +static void _make_tx_response(struct xenvif_queue *queue,
  6968. +			     const struct xen_netif_tx_request *txp,
  6969. +			     unsigned int extra_count,
  6970. +			     s8 status)
  6971. +{
  6972. +	RING_IDX i = queue->tx.rsp_prod_pvt;
  6973. +	struct xen_netif_tx_response *resp;
  6974. +
  6975. +	resp = RING_GET_RESPONSE(&queue->tx, i);
  6976. +	resp->id     = txp->id;
  6977. +	resp->status = status;
  6978. +
  6979. +	while (extra_count-- != 0)
  6980. +		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
  6981. +
  6982. +	queue->tx.rsp_prod_pvt = ++i;
  6983. +}
  6984. +
  6985. +static void push_tx_responses(struct xenvif_queue *queue)
  6986. +{
  6987. +	int notify;
  6988. +
  6989. +	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
  6990. +	if (notify)
  6991. +		notify_remote_via_irq(queue->tx_irq);
  6992. +}
  6993. +
  6994.  static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
  6995. -			       u8 status)
  6996. +			       s8 status)
  6997.  {
  6998.  	struct pending_tx_info *pending_tx_info;
  6999.  	pending_ring_idx_t index;
  7000. @@ -1409,8 +1450,8 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
  7001.  
  7002.  	spin_lock_irqsave(&queue->response_lock, flags);
  7003.  
  7004. -	make_tx_response(queue, &pending_tx_info->req,
  7005. -			 pending_tx_info->extra_count, status);
  7006. +	_make_tx_response(queue, &pending_tx_info->req,
  7007. +			  pending_tx_info->extra_count, status);
  7008.  
  7009.  	/* Release the pending index before pusing the Tx response so
  7010.  	 * its available before a new Tx request is pushed by the
  7011. @@ -1424,32 +1465,19 @@ static void xenvif_idx_release(struct xenvif_queue *queue, u16 pending_idx,
  7012.  	spin_unlock_irqrestore(&queue->response_lock, flags);
  7013.  }
  7014.  
  7015. -
  7016.  static void make_tx_response(struct xenvif_queue *queue,
  7017. -			     struct xen_netif_tx_request *txp,
  7018. +			     const struct xen_netif_tx_request *txp,
  7019.  			     unsigned int extra_count,
  7020. -			     s8       st)
  7021. +			     s8 status)
  7022.  {
  7023. -	RING_IDX i = queue->tx.rsp_prod_pvt;
  7024. -	struct xen_netif_tx_response *resp;
  7025. -
  7026. -	resp = RING_GET_RESPONSE(&queue->tx, i);
  7027. -	resp->id     = txp->id;
  7028. -	resp->status = st;
  7029. -
  7030. -	while (extra_count-- != 0)
  7031. -		RING_GET_RESPONSE(&queue->tx, ++i)->status = XEN_NETIF_RSP_NULL;
  7032. +	unsigned long flags;
  7033.  
  7034. -	queue->tx.rsp_prod_pvt = ++i;
  7035. -}
  7036. +	spin_lock_irqsave(&queue->response_lock, flags);
  7037.  
  7038. -static void push_tx_responses(struct xenvif_queue *queue)
  7039. -{
  7040. -	int notify;
  7041. +	_make_tx_response(queue, txp, extra_count, status);
  7042. +	push_tx_responses(queue);
  7043.  
  7044. -	RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&queue->tx, notify);
  7045. -	if (notify)
  7046. -		notify_remote_via_irq(queue->tx_irq);
  7047. +	spin_unlock_irqrestore(&queue->response_lock, flags);
  7048.  }
  7049.  
  7050.  static void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
  7051. diff --git drivers/pci/host/pcie-mediatek.c drivers/pci/host/pcie-mediatek.c
  7052. index 60c3110b5151..6a47a6681f8d 100644
  7053. --- linux-4.14.336/drivers/pci/host/pcie-mediatek.c
  7054. +++ linux-4.14.336/drivers/pci/host/pcie-mediatek.c
  7055. @@ -628,6 +628,14 @@ static irqreturn_t mtk_pcie_intr_handler(int irq, void *data)
  7056.  		while ((status = readl(port->base + PCIE_INT_STATUS)) & MSI_STATUS) {
  7057.  			unsigned long imsi_status;
  7058.  
  7059. +			/*
  7060. +			 * The interrupt status can be cleared even if the
  7061. +			 * MSI status remains pending. As such, given the
  7062. +			 * edge-triggered interrupt type, its status should
  7063. +			 * be cleared before being dispatched to the
  7064. +			 * handler of the underlying device.
  7065. +			 */
  7066. +			writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
  7067.  			while ((imsi_status = readl(port->base + PCIE_IMSI_STATUS))) {
  7068.  				for_each_set_bit(bit, &imsi_status, MTK_MSI_IRQS_NUM) {
  7069.  					/* Clear the MSI */
  7070. @@ -636,8 +644,6 @@ static irqreturn_t mtk_pcie_intr_handler(int irq, void *data)
  7071.  					generic_handle_irq(virq);
  7072.  				}
  7073.  			}
  7074. -			/* Clear MSI interrupt status */
  7075. -			writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
  7076.  		}
  7077.  	}
  7078.  
  7079. diff --git drivers/pci/msi.c drivers/pci/msi.c
  7080. index bbddf492da9f..548045dda97c 100644
  7081. --- linux-4.14.336/drivers/pci/msi.c
  7082. +++ linux-4.14.336/drivers/pci/msi.c
  7083. @@ -1380,7 +1380,7 @@ irq_hw_number_t pci_msi_domain_calc_hwirq(struct pci_dev *dev,
  7084.  {
  7085.  	return (irq_hw_number_t)desc->msi_attrib.entry_nr |
  7086.  		PCI_DEVID(dev->bus->number, dev->devfn) << 11 |
  7087. -		(pci_domain_nr(dev->bus) & 0xFFFFFFFF) << 27;
  7088. +		((irq_hw_number_t)(pci_domain_nr(dev->bus) & 0xFFFFFFFF)) << 27;
  7089.  }
  7090.  
  7091.  static inline bool pci_msi_desc_is_multi_msi(struct msi_desc *desc)
  7092. diff --git drivers/pci/quirks.c drivers/pci/quirks.c
  7093. index e32147929cf3..ef9303547484 100644
  7094. --- linux-4.14.336/drivers/pci/quirks.c
  7095. +++ linux-4.14.336/drivers/pci/quirks.c
  7096. @@ -441,10 +441,13 @@ static void quirk_amd_dwc_class(struct pci_dev *pdev)
  7097.  {
  7098.  	u32 class = pdev->class;
  7099.  
  7100. -	/* Use "USB Device (not host controller)" class */
  7101. -	pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
  7102. -	dev_info(&pdev->dev, "PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
  7103. -		 class, pdev->class);
  7104. +	if (class != PCI_CLASS_SERIAL_USB_DEVICE) {
  7105. +		/* Use "USB Device (not host controller)" class */
  7106. +		pdev->class = PCI_CLASS_SERIAL_USB_DEVICE;
  7107. +		dev_info(&pdev->dev,
  7108. +			"PCI class overridden (%#08x -> %#08x) so dwc3 driver can claim this instead of xhci\n",
  7109. +			class, pdev->class);
  7110. +	}
  7111.  }
  7112.  DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB,
  7113.  		quirk_amd_dwc_class);
  7114. @@ -3450,6 +3453,19 @@ static void quirk_no_pm_reset(struct pci_dev *dev)
  7115.  DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
  7116.  			       PCI_CLASS_DISPLAY_VGA, 8, quirk_no_pm_reset);
  7117.  
  7118. +/*
  7119. + * Spectrum-{1,2,3,4} devices report that a D3hot->D0 transition causes a reset
  7120. + * (i.e., they advertise NoSoftRst-). However, this transition does not have
  7121. + * any effect on the device: It continues to be operational and network ports
  7122. + * remain up. Advertising this support makes it seem as if a PM reset is viable
  7123. + * for these devices. Mark it as unavailable to skip it when testing reset
  7124. + * methods.
  7125. + */
  7126. +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcb84, quirk_no_pm_reset);
  7127. +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf6c, quirk_no_pm_reset);
  7128. +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf70, quirk_no_pm_reset);
  7129. +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, 0xcf80, quirk_no_pm_reset);
  7130. +
  7131.  /*
  7132.   * Thunderbolt controllers with broken MSI hotplug signaling:
  7133.   * Entire 1st generation (Light Ridge, Eagle Ridge, Light Peak) and part
  7134. diff --git drivers/phy/ti/phy-omap-usb2.c drivers/phy/ti/phy-omap-usb2.c
  7135. index fe909fd8144f..ae94e1e66bcc 100644
  7136. --- linux-4.14.336/drivers/phy/ti/phy-omap-usb2.c
  7137. +++ linux-4.14.336/drivers/phy/ti/phy-omap-usb2.c
  7138. @@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled)
  7139.  {
  7140.  	struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
  7141.  
  7142. -	if (!phy->comparator)
  7143. +	if (!phy->comparator || !phy->comparator->set_vbus)
  7144.  		return -ENODEV;
  7145.  
  7146.  	return phy->comparator->set_vbus(phy->comparator, enabled);
  7147. @@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg)
  7148.  {
  7149.  	struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
  7150.  
  7151. -	if (!phy->comparator)
  7152. +	if (!phy->comparator || !phy->comparator->start_srp)
  7153.  		return -ENODEV;
  7154.  
  7155.  	return phy->comparator->start_srp(phy->comparator);
  7156. diff --git drivers/pnp/pnpacpi/rsparser.c drivers/pnp/pnpacpi/rsparser.c
  7157. index 43d8ed577e70..d8cee80e8df8 100644
  7158. --- linux-4.14.336/drivers/pnp/pnpacpi/rsparser.c
  7159. +++ linux-4.14.336/drivers/pnp/pnpacpi/rsparser.c
  7160. @@ -160,13 +160,13 @@ static int vendor_resource_matches(struct pnp_dev *dev,
  7161.  static void pnpacpi_parse_allocated_vendor(struct pnp_dev *dev,
  7162.  				    struct acpi_resource_vendor_typed *vendor)
  7163.  {
  7164. -	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid, 16)) {
  7165. -		u64 start, length;
  7166. +	struct { u64 start, length; } range;
  7167.  
  7168. -		memcpy(&start, vendor->byte_data, sizeof(start));
  7169. -		memcpy(&length, vendor->byte_data + 8, sizeof(length));
  7170. -
  7171. -		pnp_add_mem_resource(dev, start, start + length - 1, 0);
  7172. +	if (vendor_resource_matches(dev, vendor, &hp_ccsr_uuid,
  7173. +				    sizeof(range))) {
  7174. +		memcpy(&range, vendor->byte_data, sizeof(range));
  7175. +		pnp_add_mem_resource(dev, range.start, range.start +
  7176. +				     range.length - 1, 0);
  7177.  	}
  7178.  }
  7179.  
  7180. diff --git drivers/power/supply/bq27xxx_battery_i2c.c drivers/power/supply/bq27xxx_battery_i2c.c
  7181. index 426ce81333a5..3eb839405d3f 100644
  7182. --- linux-4.14.336/drivers/power/supply/bq27xxx_battery_i2c.c
  7183. +++ linux-4.14.336/drivers/power/supply/bq27xxx_battery_i2c.c
  7184. @@ -217,7 +217,9 @@ static int bq27xxx_battery_i2c_remove(struct i2c_client *client)
  7185.  {
  7186.  	struct bq27xxx_device_info *di = i2c_get_clientdata(client);
  7187.  
  7188. -	free_irq(client->irq, di);
  7189. +	if (client->irq)
  7190. +		free_irq(client->irq, di);
  7191. +
  7192.  	bq27xxx_battery_teardown(di);
  7193.  
  7194.  	mutex_lock(&battery_mutex);
  7195. diff --git drivers/regulator/pwm-regulator.c drivers/regulator/pwm-regulator.c
  7196. index a2fd140eff81..5faa5906ad69 100644
  7197. --- linux-4.14.336/drivers/regulator/pwm-regulator.c
  7198. +++ linux-4.14.336/drivers/regulator/pwm-regulator.c
  7199. @@ -164,6 +164,9 @@ static int pwm_regulator_get_voltage(struct regulator_dev *rdev)
  7200.  	pwm_get_state(drvdata->pwm, &pstate);
  7201.  
  7202.  	voltage = pwm_get_relative_duty_cycle(&pstate, duty_unit);
  7203. +	if (voltage < min(max_uV_duty, min_uV_duty) ||
  7204. +	    voltage > max(max_uV_duty, min_uV_duty))
  7205. +		return -ENOTRECOVERABLE;
  7206.  
  7207.  	/*
  7208.  	 * The dutycycle for min_uV might be greater than the one for max_uV.
  7209. diff --git drivers/reset/hisilicon/hi6220_reset.c drivers/reset/hisilicon/hi6220_reset.c
  7210. index d5e5229308f2..d77a7ad7e57a 100644
  7211. --- linux-4.14.336/drivers/reset/hisilicon/hi6220_reset.c
  7212. +++ linux-4.14.336/drivers/reset/hisilicon/hi6220_reset.c
  7213. @@ -107,7 +107,7 @@ static int hi6220_reset_probe(struct platform_device *pdev)
  7214.  	if (!data)
  7215.  		return -ENOMEM;
  7216.  
  7217. -	type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev);
  7218. +	type = (uintptr_t)of_device_get_match_data(dev);
  7219.  
  7220.  	regmap = syscon_node_to_regmap(np);
  7221.  	if (IS_ERR(regmap)) {
  7222. diff --git drivers/rpmsg/virtio_rpmsg_bus.c drivers/rpmsg/virtio_rpmsg_bus.c
  7223. index 82b83002fcba..5aeb976fb4ee 100644
  7224. --- linux-4.14.336/drivers/rpmsg/virtio_rpmsg_bus.c
  7225. +++ linux-4.14.336/drivers/rpmsg/virtio_rpmsg_bus.c
  7226. @@ -389,6 +389,7 @@ static void virtio_rpmsg_release_device(struct device *dev)
  7227.  	struct rpmsg_device *rpdev = to_rpmsg_device(dev);
  7228.  	struct virtio_rpmsg_channel *vch = to_virtio_rpmsg_channel(rpdev);
  7229.  
  7230. +	kfree(rpdev->driver_override);
  7231.  	kfree(vch);
  7232.  }
  7233.  
  7234. diff --git drivers/s390/block/scm_blk.c drivers/s390/block/scm_blk.c
  7235. index 5c944ee76ec1..a37fd27258bd 100644
  7236. --- linux-4.14.336/drivers/s390/block/scm_blk.c
  7237. +++ linux-4.14.336/drivers/s390/block/scm_blk.c
  7238. @@ -17,6 +17,7 @@
  7239.  #include <linux/genhd.h>
  7240.  #include <linux/slab.h>
  7241.  #include <linux/list.h>
  7242. +#include <linux/io.h>
  7243.  #include <asm/eadm.h>
  7244.  #include "scm_blk.h"
  7245.  
  7246. @@ -130,7 +131,7 @@ static void scm_request_done(struct scm_request *scmrq)
  7247.  
  7248.  	for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
  7249.  		msb = &scmrq->aob->msb[i];
  7250. -		aidaw = msb->data_addr;
  7251. +		aidaw = (u64)phys_to_virt(msb->data_addr);
  7252.  
  7253.  		if ((msb->flags & MSB_FLAG_IDA) && aidaw &&
  7254.  		    IS_ALIGNED(aidaw, PAGE_SIZE))
  7255. @@ -195,12 +196,12 @@ static int scm_request_prepare(struct scm_request *scmrq)
  7256.  	msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
  7257.  	msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE;
  7258.  	msb->flags |= MSB_FLAG_IDA;
  7259. -	msb->data_addr = (u64) aidaw;
  7260. +	msb->data_addr = (u64)virt_to_phys(aidaw);
  7261.  
  7262.  	rq_for_each_segment(bv, req, iter) {
  7263.  		WARN_ON(bv.bv_offset);
  7264.  		msb->blk_count += bv.bv_len >> 12;
  7265. -		aidaw->data_addr = (u64) page_address(bv.bv_page);
  7266. +		aidaw->data_addr = virt_to_phys(page_address(bv.bv_page));
  7267.  		aidaw++;
  7268.  	}
  7269.  
  7270. diff --git drivers/s390/net/qeth_l3_main.c drivers/s390/net/qeth_l3_main.c
  7271. index 8bccfd686b73..7d9a64e2691a 100644
  7272. --- linux-4.14.336/drivers/s390/net/qeth_l3_main.c
  7273. +++ linux-4.14.336/drivers/s390/net/qeth_l3_main.c
  7274. @@ -364,9 +364,10 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover)
  7275.  		if (!recover) {
  7276.  			hash_del(&addr->hnode);
  7277.  			kfree(addr);
  7278. -			continue;
  7279. +		} else {
  7280. +			/* prepare for recovery */
  7281. +			addr->disp_flag = QETH_DISP_ADDR_ADD;
  7282.  		}
  7283. -		addr->disp_flag = QETH_DISP_ADDR_ADD;
  7284.  	}
  7285.  
  7286.  	spin_unlock_bh(&card->ip_lock);
  7287. @@ -404,11 +405,13 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
  7288.  			} else
  7289.  				rc = qeth_l3_register_addr_entry(card, addr);
  7290.  
  7291. -			if (!rc) {
  7292. +			if (!rc || rc == -EADDRINUSE || rc == -ENETDOWN) {
  7293. +				/* keep it in the records */
  7294.  				addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
  7295.  				if (addr->ref_counter < 1)
  7296.  					qeth_l3_delete_ip(card, addr);
  7297.  			} else {
  7298. +				/* bad address */
  7299.  				hash_del(&addr->hnode);
  7300.  				kfree(addr);
  7301.  			}
  7302. diff --git drivers/scsi/Kconfig drivers/scsi/Kconfig
  7303. index ba1bfb30a272..aeb73c170b3a 100644
  7304. --- linux-4.14.336/drivers/scsi/Kconfig
  7305. +++ linux-4.14.336/drivers/scsi/Kconfig
  7306. @@ -1394,7 +1394,7 @@ source "drivers/scsi/arm/Kconfig"
  7307.  
  7308.  config JAZZ_ESP
  7309.  	bool "MIPS JAZZ FAS216 SCSI support"
  7310. -	depends on MACH_JAZZ && SCSI
  7311. +	depends on MACH_JAZZ && SCSI=y
  7312.  	select SCSI_SPI_ATTRS
  7313.  	help
  7314.  	  This is the driver for the onboard SCSI host adapter of MIPS Magnum
  7315. diff --git drivers/scsi/fcoe/fcoe_ctlr.c drivers/scsi/fcoe/fcoe_ctlr.c
  7316. index 57826f7bb9f2..1c8fa41aa3ab 100644
  7317. --- linux-4.14.336/drivers/scsi/fcoe/fcoe_ctlr.c
  7318. +++ linux-4.14.336/drivers/scsi/fcoe/fcoe_ctlr.c
  7319. @@ -330,17 +330,16 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
  7320.  {
  7321.  	struct fcoe_fcf *sel;
  7322.  	struct fcoe_fcf *fcf;
  7323. -	unsigned long flags;
  7324.  
  7325.  	mutex_lock(&fip->ctlr_mutex);
  7326. -	spin_lock_irqsave(&fip->ctlr_lock, flags);
  7327. +	spin_lock_bh(&fip->ctlr_lock);
  7328.  
  7329.  	kfree_skb(fip->flogi_req);
  7330.  	fip->flogi_req = NULL;
  7331.  	list_for_each_entry(fcf, &fip->fcfs, list)
  7332.  		fcf->flogi_sent = 0;
  7333.  
  7334. -	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
  7335. +	spin_unlock_bh(&fip->ctlr_lock);
  7336.  	sel = fip->sel_fcf;
  7337.  
  7338.  	if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
  7339. @@ -710,7 +709,6 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
  7340.  {
  7341.  	struct fc_frame *fp;
  7342.  	struct fc_frame_header *fh;
  7343. -	unsigned long flags;
  7344.  	u16 old_xid;
  7345.  	u8 op;
  7346.  	u8 mac[ETH_ALEN];
  7347. @@ -744,11 +742,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
  7348.  		op = FIP_DT_FLOGI;
  7349.  		if (fip->mode == FIP_MODE_VN2VN)
  7350.  			break;
  7351. -		spin_lock_irqsave(&fip->ctlr_lock, flags);
  7352. +		spin_lock_bh(&fip->ctlr_lock);
  7353.  		kfree_skb(fip->flogi_req);
  7354.  		fip->flogi_req = skb;
  7355.  		fip->flogi_req_send = 1;
  7356. -		spin_unlock_irqrestore(&fip->ctlr_lock, flags);
  7357. +		spin_unlock_bh(&fip->ctlr_lock);
  7358.  		schedule_work(&fip->timer_work);
  7359.  		return -EINPROGRESS;
  7360.  	case ELS_FDISC:
  7361. @@ -1725,11 +1723,10 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
  7362.  static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
  7363.  {
  7364.  	struct fcoe_fcf *fcf;
  7365. -	unsigned long flags;
  7366.  	int error;
  7367.  
  7368.  	mutex_lock(&fip->ctlr_mutex);
  7369. -	spin_lock_irqsave(&fip->ctlr_lock, flags);
  7370. +	spin_lock_bh(&fip->ctlr_lock);
  7371.  	LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
  7372.  	fcf = fcoe_ctlr_select(fip);
  7373.  	if (!fcf || fcf->flogi_sent) {
  7374. @@ -1740,7 +1737,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
  7375.  		fcoe_ctlr_solicit(fip, NULL);
  7376.  		error = fcoe_ctlr_flogi_send_locked(fip);
  7377.  	}
  7378. -	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
  7379. +	spin_unlock_bh(&fip->ctlr_lock);
  7380.  	mutex_unlock(&fip->ctlr_mutex);
  7381.  	return error;
  7382.  }
  7383. @@ -1757,9 +1754,8 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
  7384.  static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
  7385.  {
  7386.  	struct fcoe_fcf *fcf;
  7387. -	unsigned long flags;
  7388.  
  7389. -	spin_lock_irqsave(&fip->ctlr_lock, flags);
  7390. +	spin_lock_bh(&fip->ctlr_lock);
  7391.  	fcf = fip->sel_fcf;
  7392.  	if (!fcf || !fip->flogi_req_send)
  7393.  		goto unlock;
  7394. @@ -1786,7 +1782,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
  7395.  	} else /* XXX */
  7396.  		LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
  7397.  unlock:
  7398. -	spin_unlock_irqrestore(&fip->ctlr_lock, flags);
  7399. +	spin_unlock_bh(&fip->ctlr_lock);
  7400.  }
  7401.  
  7402.  /**
  7403. diff --git drivers/scsi/isci/request.c drivers/scsi/isci/request.c
  7404. index 2f151708b59a..13ecf554762e 100644
  7405. --- linux-4.14.336/drivers/scsi/isci/request.c
  7406. +++ linux-4.14.336/drivers/scsi/isci/request.c
  7407. @@ -3398,7 +3398,7 @@ static enum sci_status isci_io_request_build(struct isci_host *ihost,
  7408.  		return SCI_FAILURE;
  7409.  	}
  7410.  
  7411. -	return SCI_SUCCESS;
  7412. +	return status;
  7413.  }
  7414.  
  7415.  static struct isci_request *isci_request_from_tag(struct isci_host *ihost, u16 tag)
  7416. diff --git drivers/scsi/libfc/fc_fcp.c drivers/scsi/libfc/fc_fcp.c
  7417. index 772c35a5c49e..72ceffc58112 100644
  7418. --- linux-4.14.336/drivers/scsi/libfc/fc_fcp.c
  7419. +++ linux-4.14.336/drivers/scsi/libfc/fc_fcp.c
  7420. @@ -283,6 +283,11 @@ static int fc_fcp_send_abort(struct fc_fcp_pkt *fsp)
  7421.  	if (!fsp->seq_ptr)
  7422.  		return -EINVAL;
  7423.  
  7424. +	if (fsp->state & FC_SRB_ABORT_PENDING) {
  7425. +		FC_FCP_DBG(fsp, "abort already pending\n");
  7426. +		return -EBUSY;
  7427. +	}
  7428. +
  7429.  	per_cpu_ptr(fsp->lp->stats, get_cpu())->FcpPktAborts++;
  7430.  	put_cpu();
  7431.  
  7432. @@ -1693,7 +1698,7 @@ static void fc_fcp_rec_error(struct fc_fcp_pkt *fsp, struct fc_frame *fp)
  7433.  		if (fsp->recov_retry++ < FC_MAX_RECOV_RETRY)
  7434.  			fc_fcp_rec(fsp);
  7435.  		else
  7436. -			fc_fcp_recovery(fsp, FC_ERROR);
  7437. +			fc_fcp_recovery(fsp, FC_TIMED_OUT);
  7438.  		break;
  7439.  	}
  7440.  	fc_fcp_unlock_pkt(fsp);
  7441. @@ -1711,11 +1716,12 @@ static void fc_fcp_recovery(struct fc_fcp_pkt *fsp, u8 code)
  7442.  	fsp->status_code = code;
  7443.  	fsp->cdb_status = 0;
  7444.  	fsp->io_status = 0;
  7445. -	/*
  7446. -	 * if this fails then we let the scsi command timer fire and
  7447. -	 * scsi-ml escalate.
  7448. -	 */
  7449. -	fc_fcp_send_abort(fsp);
  7450. +	if (!fsp->cmd)
  7451. +		/*
  7452. +		 * Only abort non-scsi commands; otherwise let the
  7453. +		 * scsi command timer fire and scsi-ml escalate.
  7454. +		 */
  7455. +		fc_fcp_send_abort(fsp);
  7456.  }
  7457.  
  7458.  /**
  7459. diff --git drivers/scsi/lpfc/lpfc.h drivers/scsi/lpfc/lpfc.h
  7460. index 5fc41aa53ceb..97a2f6c6337c 100644
  7461. --- linux-4.14.336/drivers/scsi/lpfc/lpfc.h
  7462. +++ linux-4.14.336/drivers/scsi/lpfc/lpfc.h
  7463. @@ -31,6 +31,7 @@
  7464.  struct lpfc_sli2_slim;
  7465.  
  7466.  #define ELX_MODEL_NAME_SIZE	80
  7467. +#define ELX_FW_NAME_SIZE	84
  7468.  
  7469.  #define LPFC_PCI_DEV_LP		0x1
  7470.  #define LPFC_PCI_DEV_OC		0x2
  7471. diff --git drivers/scsi/lpfc/lpfc_init.c drivers/scsi/lpfc/lpfc_init.c
  7472. index 3e9574eede20..0f954853ccad 100644
  7473. --- linux-4.14.336/drivers/scsi/lpfc/lpfc_init.c
  7474. +++ linux-4.14.336/drivers/scsi/lpfc/lpfc_init.c
  7475. @@ -11086,7 +11086,7 @@ out:
  7476.  int
  7477.  lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
  7478.  {
  7479. -	uint8_t file_name[ELX_MODEL_NAME_SIZE];
  7480. +	char file_name[ELX_FW_NAME_SIZE] = {0};
  7481.  	int ret;
  7482.  	const struct firmware *fw;
  7483.  
  7484. @@ -11095,7 +11095,7 @@ lpfc_sli4_request_firmware_update(struct lpfc_hba *phba, uint8_t fw_upgrade)
  7485.  	    LPFC_SLI_INTF_IF_TYPE_2)
  7486.  		return -EPERM;
  7487.  
  7488. -	snprintf(file_name, ELX_MODEL_NAME_SIZE, "%s.grp", phba->ModelName);
  7489. +	scnprintf(file_name, sizeof(file_name), "%s.grp", phba->ModelName);
  7490.  
  7491.  	if (fw_upgrade == INT_FW_UPGRADE) {
  7492.  		ret = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,
  7493. diff --git drivers/spi/spi-ppc4xx.c drivers/spi/spi-ppc4xx.c
  7494. index 967d94844b30..58765a62fc15 100644
  7495. --- linux-4.14.336/drivers/spi/spi-ppc4xx.c
  7496. +++ linux-4.14.336/drivers/spi/spi-ppc4xx.c
  7497. @@ -173,10 +173,8 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
  7498.  	int scr;
  7499.  	u8 cdm = 0;
  7500.  	u32 speed;
  7501. -	u8 bits_per_word;
  7502.  
  7503.  	/* Start with the generic configuration for this device. */
  7504. -	bits_per_word = spi->bits_per_word;
  7505.  	speed = spi->max_speed_hz;
  7506.  
  7507.  	/*
  7508. @@ -184,9 +182,6 @@ static int spi_ppc4xx_setupxfer(struct spi_device *spi, struct spi_transfer *t)
  7509.  	 * the transfer to overwrite the generic configuration with zeros.
  7510.  	 */
  7511.  	if (t) {
  7512. -		if (t->bits_per_word)
  7513. -			bits_per_word = t->bits_per_word;
  7514. -
  7515.  		if (t->speed_hz)
  7516.  			speed = min(t->speed_hz, spi->max_speed_hz);
  7517.  	}
  7518. diff --git drivers/staging/iio/impedance-analyzer/ad5933.c drivers/staging/iio/impedance-analyzer/ad5933.c
  7519. index 6d31001d1825..344053df0383 100644
  7520. --- linux-4.14.336/drivers/staging/iio/impedance-analyzer/ad5933.c
  7521. +++ linux-4.14.336/drivers/staging/iio/impedance-analyzer/ad5933.c
  7522. @@ -658,7 +658,7 @@ static void ad5933_work(struct work_struct *work)
  7523.  		struct ad5933_state, work.work);
  7524.  	struct iio_dev *indio_dev = i2c_get_clientdata(st->client);
  7525.  	__be16 buf[2];
  7526. -	int val[2];
  7527. +	u16 val[2];
  7528.  	unsigned char status;
  7529.  	int ret;
  7530.  
  7531. diff --git drivers/target/target_core_device.c drivers/target/target_core_device.c
  7532. index 907b06056f02..ccefa4eb9f1f 100644
  7533. --- linux-4.14.336/drivers/target/target_core_device.c
  7534. +++ linux-4.14.336/drivers/target/target_core_device.c
  7535. @@ -164,7 +164,6 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
  7536.  	struct se_session *se_sess = se_cmd->se_sess;
  7537.  	struct se_node_acl *nacl = se_sess->se_node_acl;
  7538.  	struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
  7539. -	unsigned long flags;
  7540.  
  7541.  	rcu_read_lock();
  7542.  	deve = target_nacl_find_deve(nacl, unpacked_lun);
  7543. @@ -195,10 +194,6 @@ out_unlock:
  7544.  	se_cmd->se_dev = rcu_dereference_raw(se_lun->lun_se_dev);
  7545.  	se_tmr->tmr_dev = rcu_dereference_raw(se_lun->lun_se_dev);
  7546.  
  7547. -	spin_lock_irqsave(&se_tmr->tmr_dev->se_tmr_lock, flags);
  7548. -	list_add_tail(&se_tmr->tmr_list, &se_tmr->tmr_dev->dev_tmr_list);
  7549. -	spin_unlock_irqrestore(&se_tmr->tmr_dev->se_tmr_lock, flags);
  7550. -
  7551.  	return 0;
  7552.  }
  7553.  EXPORT_SYMBOL(transport_lookup_tmr_lun);
  7554. diff --git drivers/target/target_core_transport.c drivers/target/target_core_transport.c
  7555. index c20997bf314e..41ebdd629b9d 100644
  7556. --- linux-4.14.336/drivers/target/target_core_transport.c
  7557. +++ linux-4.14.336/drivers/target/target_core_transport.c
  7558. @@ -3424,6 +3424,10 @@ int transport_generic_handle_tmr(
  7559.  	unsigned long flags;
  7560.  	bool aborted = false;
  7561.  
  7562. +	spin_lock_irqsave(&cmd->se_dev->se_tmr_lock, flags);
  7563. +	list_add_tail(&cmd->se_tmr_req->tmr_list, &cmd->se_dev->dev_tmr_list);
  7564. +	spin_unlock_irqrestore(&cmd->se_dev->se_tmr_lock, flags);
  7565. +
  7566.  	spin_lock_irqsave(&cmd->t_state_lock, flags);
  7567.  	if (cmd->transport_state & CMD_T_ABORTED) {
  7568.  		aborted = true;
  7569. diff --git drivers/tty/serial/imx.c drivers/tty/serial/imx.c
  7570. index 7fccf69931c5..6cfa6a908336 100644
  7571. --- linux-4.14.336/drivers/tty/serial/imx.c
  7572. +++ linux-4.14.336/drivers/tty/serial/imx.c
  7573. @@ -2215,7 +2215,7 @@ static int serial_imx_probe(struct platform_device *pdev)
  7574.  	/* For register access, we only need to enable the ipg clock. */
  7575.  	ret = clk_prepare_enable(sport->clk_ipg);
  7576.  	if (ret) {
  7577. -		dev_err(&pdev->dev, "failed to enable per clk: %d\n", ret);
  7578. +		dev_err(&pdev->dev, "failed to enable ipg clk: %d\n", ret);
  7579.  		return ret;
  7580.  	}
  7581.  
  7582. diff --git drivers/tty/serial/sc16is7xx.c drivers/tty/serial/sc16is7xx.c
  7583. index 73280d400eb2..3afaab69f0e2 100644
  7584. --- linux-4.14.336/drivers/tty/serial/sc16is7xx.c
  7585. +++ linux-4.14.336/drivers/tty/serial/sc16is7xx.c
  7586. @@ -29,6 +29,7 @@
  7587.  #include <linux/tty_flip.h>
  7588.  #include <linux/spi/spi.h>
  7589.  #include <linux/uaccess.h>
  7590. +#include <linux/units.h>
  7591.  #include <uapi/linux/sched/types.h>
  7592.  
  7593.  #define SC16IS7XX_NAME			"sc16is7xx"
  7594. @@ -1401,9 +1402,12 @@ static int sc16is7xx_spi_probe(struct spi_device *spi)
  7595.  
  7596.  	/* Setup SPI bus */
  7597.  	spi->bits_per_word	= 8;
  7598. -	/* only supports mode 0 on SC16IS762 */
  7599. +	/* For all variants, only mode 0 is supported */
  7600. +	if ((spi->mode & SPI_MODE_X_MASK) != SPI_MODE_0)
  7601. +		return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n");
  7602. +
  7603.  	spi->mode		= spi->mode ? : SPI_MODE_0;
  7604. -	spi->max_speed_hz	= spi->max_speed_hz ? : 15000000;
  7605. +	spi->max_speed_hz	= spi->max_speed_hz ? : 4 * HZ_PER_MHZ;
  7606.  	ret = spi_setup(spi);
  7607.  	if (ret)
  7608.  		return ret;
  7609. diff --git drivers/uio/uio.c drivers/uio/uio.c
  7610. index be33a5ce3d8e..3ebea6388220 100644
  7611. --- linux-4.14.336/drivers/uio/uio.c
  7612. +++ linux-4.14.336/drivers/uio/uio.c
  7613. @@ -465,13 +465,13 @@ static int uio_open(struct inode *inode, struct file *filep)
  7614.  
  7615.  	mutex_lock(&minor_lock);
  7616.  	idev = idr_find(&uio_idr, iminor(inode));
  7617. -	mutex_unlock(&minor_lock);
  7618.  	if (!idev) {
  7619.  		ret = -ENODEV;
  7620. +		mutex_unlock(&minor_lock);
  7621.  		goto out;
  7622.  	}
  7623. -
  7624.  	get_device(&idev->dev);
  7625. +	mutex_unlock(&minor_lock);
  7626.  
  7627.  	if (!try_module_get(idev->owner)) {
  7628.  		ret = -ENODEV;
  7629. @@ -1020,9 +1020,8 @@ void uio_unregister_device(struct uio_info *info)
  7630.  	idev->info = NULL;
  7631.  	mutex_unlock(&idev->info_lock);
  7632.  
  7633. -	device_unregister(&idev->dev);
  7634. -
  7635.  	uio_free_minor(minor);
  7636. +	device_unregister(&idev->dev);
  7637.  
  7638.  	return;
  7639.  }
  7640. diff --git drivers/usb/chipidea/core.c drivers/usb/chipidea/core.c
  7641. index 4cacb91c4729..a4880b137f1b 100644
  7642. --- linux-4.14.336/drivers/usb/chipidea/core.c
  7643. +++ linux-4.14.336/drivers/usb/chipidea/core.c
  7644. @@ -542,6 +542,13 @@ static irqreturn_t ci_irq_handler(int irq, void *data)
  7645.  	u32 otgsc = 0;
  7646.  
  7647.  	if (ci->in_lpm) {
  7648. +		/*
  7649. +		 * If we already have a wakeup irq pending there,
  7650. +		 * let's just return to wait resume finished firstly.
  7651. +		 */
  7652. +		if (ci->wakeup_int)
  7653. +			return IRQ_HANDLED;
  7654. +
  7655.  		disable_irq_nosync(irq);
  7656.  		ci->wakeup_int = true;
  7657.  		pm_runtime_get(ci->dev);
  7658. diff --git drivers/usb/core/hub.c drivers/usb/core/hub.c
  7659. index 4a0765bca8e7..afe3a46a0d2d 100644
  7660. --- linux-4.14.336/drivers/usb/core/hub.c
  7661. +++ linux-4.14.336/drivers/usb/core/hub.c
  7662. @@ -43,8 +43,8 @@
  7663.  #define USB_VENDOR_TEXAS_INSTRUMENTS		0x0451
  7664.  #define USB_PRODUCT_TUSB8041_USB3		0x8140
  7665.  #define USB_PRODUCT_TUSB8041_USB2		0x8142
  7666. -#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01
  7667. -#define HUB_QUIRK_DISABLE_AUTOSUSPEND		0x02
  7668. +#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	BIT(0)
  7669. +#define HUB_QUIRK_DISABLE_AUTOSUSPEND		BIT(1)
  7670.  
  7671.  /* Protect struct usb_device->state and ->children members
  7672.   * Note: Both are also protected by ->dev.sem, except that ->state can
  7673. @@ -2308,17 +2308,25 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
  7674.  			}
  7675.  		} else if (desc->bLength == sizeof
  7676.  				(struct usb_otg_descriptor)) {
  7677. -			/* Set a_alt_hnp_support for legacy otg device */
  7678. -			err = usb_control_msg(udev,
  7679. -				usb_sndctrlpipe(udev, 0),
  7680. -				USB_REQ_SET_FEATURE, 0,
  7681. -				USB_DEVICE_A_ALT_HNP_SUPPORT,
  7682. -				0, NULL, 0,
  7683. -				USB_CTRL_SET_TIMEOUT);
  7684. -			if (err < 0)
  7685. -				dev_err(&udev->dev,
  7686. -					"set a_alt_hnp_support failed: %d\n",
  7687. -					err);
  7688. +			/*
  7689. +			 * We are operating on a legacy OTP device
  7690. +			 * These should be told that they are operating
  7691. +			 * on the wrong port if we have another port that does
  7692. +			 * support HNP
  7693. +			 */
  7694. +			if (bus->otg_port != 0) {
  7695. +				/* Set a_alt_hnp_support for legacy otg device */
  7696. +				err = usb_control_msg(udev,
  7697. +					usb_sndctrlpipe(udev, 0),
  7698. +					USB_REQ_SET_FEATURE, 0,
  7699. +					USB_DEVICE_A_ALT_HNP_SUPPORT,
  7700. +					0, NULL, 0,
  7701. +					USB_CTRL_SET_TIMEOUT);
  7702. +				if (err < 0)
  7703. +					dev_err(&udev->dev,
  7704. +						"set a_alt_hnp_support failed: %d\n",
  7705. +						err);
  7706. +			}
  7707.  		}
  7708.  	}
  7709.  #endif
  7710. diff --git drivers/usb/dwc3/ep0.c drivers/usb/dwc3/ep0.c
  7711. index 17bc5b958ea0..f3f9fca246b8 100644
  7712. --- linux-4.14.336/drivers/usb/dwc3/ep0.c
  7713. +++ linux-4.14.336/drivers/usb/dwc3/ep0.c
  7714. @@ -246,7 +246,10 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
  7715.  		struct dwc3_request	*req;
  7716.  
  7717.  		req = next_request(&dep->pending_list);
  7718. -		dwc3_gadget_giveback(dep, req, -ECONNRESET);
  7719. +		if (!dwc->connected)
  7720. +			dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
  7721. +		else
  7722. +			dwc3_gadget_giveback(dep, req, -ECONNRESET);
  7723.  	}
  7724.  
  7725.  	dwc->ep0state = EP0_SETUP_PHASE;
  7726. diff --git drivers/usb/gadget/function/f_mass_storage.c drivers/usb/gadget/function/f_mass_storage.c
  7727. index 6aee3cf50c74..43bceee1d6c7 100644
  7728. --- linux-4.14.336/drivers/usb/gadget/function/f_mass_storage.c
  7729. +++ linux-4.14.336/drivers/usb/gadget/function/f_mass_storage.c
  7730. @@ -576,21 +576,37 @@ static int start_transfer(struct fsg_dev *fsg, struct usb_ep *ep,
  7731.  
  7732.  static bool start_in_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
  7733.  {
  7734. +	int rc;
  7735. +
  7736.  	if (!fsg_is_set(common))
  7737.  		return false;
  7738.  	bh->state = BUF_STATE_SENDING;
  7739. -	if (start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq))
  7740. +	rc = start_transfer(common->fsg, common->fsg->bulk_in, bh->inreq);
  7741. +	if (rc) {
  7742.  		bh->state = BUF_STATE_EMPTY;
  7743. +		if (rc == -ESHUTDOWN) {
  7744. +			common->running = 0;
  7745. +			return false;
  7746. +		}
  7747. +	}
  7748.  	return true;
  7749.  }
  7750.  
  7751.  static bool start_out_transfer(struct fsg_common *common, struct fsg_buffhd *bh)
  7752.  {
  7753. +	int rc;
  7754. +
  7755.  	if (!fsg_is_set(common))
  7756.  		return false;
  7757.  	bh->state = BUF_STATE_RECEIVING;
  7758. -	if (start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq))
  7759. +	rc = start_transfer(common->fsg, common->fsg->bulk_out, bh->outreq);
  7760. +	if (rc) {
  7761.  		bh->state = BUF_STATE_FULL;
  7762. +		if (rc == -ESHUTDOWN) {
  7763. +			common->running = 0;
  7764. +			return false;
  7765. +		}
  7766. +	}
  7767.  	return true;
  7768.  }
  7769.  
  7770. diff --git drivers/usb/gadget/function/f_ncm.c drivers/usb/gadget/function/f_ncm.c
  7771. index 47d1f4e960cb..9a75e4c49976 100644
  7772. --- linux-4.14.336/drivers/usb/gadget/function/f_ncm.c
  7773. +++ linux-4.14.336/drivers/usb/gadget/function/f_ncm.c
  7774. @@ -1370,7 +1370,15 @@ parse_ntb:
  7775.  	     "Parsed NTB with %d frames\n", dgram_counter);
  7776.  
  7777.  	to_process -= block_len;
  7778. -	if (to_process != 0) {
  7779. +
  7780. +	/*
  7781. +	 * Windows NCM driver avoids USB ZLPs by adding a 1-byte
  7782. +	 * zero pad as needed.
  7783. +	 */
  7784. +	if (to_process == 1 &&
  7785. +	    (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) {
  7786. +		to_process--;
  7787. +	} else if (to_process > 0) {
  7788.  		ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
  7789.  		goto parse_ntb;
  7790.  	}
  7791. diff --git drivers/usb/mon/mon_bin.c drivers/usb/mon/mon_bin.c
  7792. index a6da9b72f46b..21b184d2170a 100644
  7793. --- linux-4.14.336/drivers/usb/mon/mon_bin.c
  7794. +++ linux-4.14.336/drivers/usb/mon/mon_bin.c
  7795. @@ -1246,14 +1246,19 @@ static int mon_bin_vma_fault(struct vm_fault *vmf)
  7796.  	struct mon_reader_bin *rp = vmf->vma->vm_private_data;
  7797.  	unsigned long offset, chunk_idx;
  7798.  	struct page *pageptr;
  7799. +	unsigned long flags;
  7800.  
  7801. +	spin_lock_irqsave(&rp->b_lock, flags);
  7802.  	offset = vmf->pgoff << PAGE_SHIFT;
  7803. -	if (offset >= rp->b_size)
  7804. +	if (offset >= rp->b_size) {
  7805. +		spin_unlock_irqrestore(&rp->b_lock, flags);
  7806.  		return VM_FAULT_SIGBUS;
  7807. +	}
  7808.  	chunk_idx = offset / CHUNK_SIZE;
  7809.  	pageptr = rp->b_vec[chunk_idx].pg;
  7810.  	get_page(pageptr);
  7811.  	vmf->page = pageptr;
  7812. +	spin_unlock_irqrestore(&rp->b_lock, flags);
  7813.  	return 0;
  7814.  }
  7815.  
  7816. diff --git drivers/usb/phy/phy-mxs-usb.c drivers/usb/phy/phy-mxs-usb.c
  7817. index 6e462a8d8309..bbfdd926bc70 100644
  7818. --- linux-4.14.336/drivers/usb/phy/phy-mxs-usb.c
  7819. +++ linux-4.14.336/drivers/usb/phy/phy-mxs-usb.c
  7820. @@ -303,8 +303,7 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
  7821.  
  7822.  static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
  7823.  {
  7824. -	return IS_ENABLED(CONFIG_USB_OTG) &&
  7825. -		mxs_phy->phy.last_event == USB_EVENT_ID;
  7826. +	return mxs_phy->phy.last_event == USB_EVENT_ID;
  7827.  }
  7828.  
  7829.  static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
  7830. diff --git drivers/usb/serial/cp210x.c drivers/usb/serial/cp210x.c
  7831. index df524ce8c050..4158432fc16f 100644
  7832. --- linux-4.14.336/drivers/usb/serial/cp210x.c
  7833. +++ linux-4.14.336/drivers/usb/serial/cp210x.c
  7834. @@ -150,6 +150,7 @@ static const struct usb_device_id id_table[] = {
  7835.  	{ USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
  7836.  	{ USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
  7837.  	{ USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
  7838. +	{ USB_DEVICE(0x10C4, 0x87ED) }, /* IMST USB-Stick for Smart Meter */
  7839.  	{ USB_DEVICE(0x10C4, 0x8856) },	/* CEL EM357 ZigBee USB Stick - LR */
  7840.  	{ USB_DEVICE(0x10C4, 0x8857) },	/* CEL EM357 ZigBee USB Stick */
  7841.  	{ USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
  7842. diff --git drivers/usb/serial/option.c drivers/usb/serial/option.c
  7843. index 902bbe52a1d6..8744d91de155 100644
  7844. --- linux-4.14.336/drivers/usb/serial/option.c
  7845. +++ linux-4.14.336/drivers/usb/serial/option.c
  7846. @@ -2271,6 +2271,7 @@ static const struct usb_device_id option_ids[] = {
  7847.  	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) },			/* Fibocom FM160 (MBIM mode) */
  7848.  	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
  7849.  	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
  7850. +	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
  7851.  	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
  7852.  	  .driver_info = RSVD(4) },
  7853.  	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
  7854. diff --git drivers/usb/serial/qcserial.c drivers/usb/serial/qcserial.c
  7855. index 6ea6cbbebfba..03dc86977e6d 100644
  7856. --- linux-4.14.336/drivers/usb/serial/qcserial.c
  7857. +++ linux-4.14.336/drivers/usb/serial/qcserial.c
  7858. @@ -188,6 +188,8 @@ static const struct usb_device_id id_table[] = {
  7859.  	{DEVICE_SWI(0x413c, 0x81d0)},   /* Dell Wireless 5819 */
  7860.  	{DEVICE_SWI(0x413c, 0x81d1)},   /* Dell Wireless 5818 */
  7861.  	{DEVICE_SWI(0x413c, 0x81d2)},   /* Dell Wireless 5818 */
  7862. +	{DEVICE_SWI(0x413c, 0x8217)},	/* Dell Wireless DW5826e */
  7863. +	{DEVICE_SWI(0x413c, 0x8218)},	/* Dell Wireless DW5826e QDL */
  7864.  
  7865.  	/* Huawei devices */
  7866.  	{DEVICE_HWI(0x03f0, 0x581d)},	/* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */
  7867. diff --git drivers/vhost/vhost.c drivers/vhost/vhost.c
  7868. index 93cdeb516594..03eb2941ff6c 100644
  7869. --- linux-4.14.336/drivers/vhost/vhost.c
  7870. +++ linux-4.14.336/drivers/vhost/vhost.c
  7871. @@ -2483,12 +2483,11 @@ EXPORT_SYMBOL_GPL(vhost_disable_notify);
  7872.  /* Create a new message. */
  7873.  struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type)
  7874.  {
  7875. -	struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL);
  7876. +	/* Make sure all padding within the structure is initialized. */
  7877. +	struct vhost_msg_node *node = kzalloc(sizeof(*node), GFP_KERNEL);
  7878.  	if (!node)
  7879.  		return NULL;
  7880.  
  7881. -	/* Make sure all padding within the structure is initialized. */
  7882. -	memset(&node->msg, 0, sizeof node->msg);
  7883.  	node->vq = vq;
  7884.  	node->msg.type = type;
  7885.  	return node;
  7886. diff --git drivers/video/fbdev/core/fb_defio.c drivers/video/fbdev/core/fb_defio.c
  7887. index 487d5e336e1b..36972138340d 100644
  7888. --- linux-4.14.336/drivers/video/fbdev/core/fb_defio.c
  7889. +++ linux-4.14.336/drivers/video/fbdev/core/fb_defio.c
  7890. @@ -78,11 +78,7 @@ int fb_deferred_io_fsync(struct file *file, loff_t start, loff_t end, int datasy
  7891.  		return 0;
  7892.  
  7893.  	inode_lock(inode);
  7894. -	/* Kill off the delayed work */
  7895. -	cancel_delayed_work_sync(&info->deferred_work);
  7896. -
  7897. -	/* Run it immediately */
  7898. -	schedule_delayed_work(&info->deferred_work, 0);
  7899. +	flush_delayed_work(&info->deferred_work);
  7900.  	inode_unlock(inode);
  7901.  
  7902.  	return 0;
  7903. diff --git drivers/video/fbdev/savage/savagefb_driver.c drivers/video/fbdev/savage/savagefb_driver.c
  7904. index c20468362f11..a4f15b9de2b6 100644
  7905. --- linux-4.14.336/drivers/video/fbdev/savage/savagefb_driver.c
  7906. +++ linux-4.14.336/drivers/video/fbdev/savage/savagefb_driver.c
  7907. @@ -869,6 +869,9 @@ static int savagefb_check_var(struct fb_var_screeninfo   *var,
  7908.  
  7909.  	DBG("savagefb_check_var");
  7910.  
  7911. +	if (!var->pixclock)
  7912. +		return -EINVAL;
  7913. +
  7914.  	var->transp.offset = 0;
  7915.  	var->transp.length = 0;
  7916.  	switch (var->bits_per_pixel) {
  7917. diff --git drivers/video/fbdev/sis/sis_main.c drivers/video/fbdev/sis/sis_main.c
  7918. index e92303823a4b..9575a481eeaf 100644
  7919. --- linux-4.14.336/drivers/video/fbdev/sis/sis_main.c
  7920. +++ linux-4.14.336/drivers/video/fbdev/sis/sis_main.c
  7921. @@ -1437,6 +1437,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
  7922.  
  7923.  	vtotal = var->upper_margin + var->lower_margin + var->vsync_len;
  7924.  
  7925. +	if (!var->pixclock)
  7926. +		return -EINVAL;
  7927.  	pixclock = var->pixclock;
  7928.  
  7929.  	if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) {
  7930. diff --git drivers/watchdog/bcm2835_wdt.c drivers/watchdog/bcm2835_wdt.c
  7931. index adb699145a07..4e653e71e232 100644
  7932. --- linux-4.14.336/drivers/watchdog/bcm2835_wdt.c
  7933. +++ linux-4.14.336/drivers/watchdog/bcm2835_wdt.c
  7934. @@ -44,6 +44,7 @@
  7935.  
  7936.  #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
  7937.  #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
  7938. +#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16)
  7939.  
  7940.  struct bcm2835_wdt {
  7941.  	void __iomem		*base;
  7942. @@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
  7943.  	.info =		&bcm2835_wdt_info,
  7944.  	.ops =		&bcm2835_wdt_ops,
  7945.  	.min_timeout =	1,
  7946. -	.max_timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
  7947. +	.max_hw_heartbeat_ms =	WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET),
  7948.  	.timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
  7949.  };
  7950.  
  7951. diff --git drivers/watchdog/watchdog_dev.c drivers/watchdog/watchdog_dev.c
  7952. index 337ca3690d62..d26fb9016a9f 100644
  7953. --- linux-4.14.336/drivers/watchdog/watchdog_dev.c
  7954. +++ linux-4.14.336/drivers/watchdog/watchdog_dev.c
  7955. @@ -956,6 +956,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
  7956.  
  7957.  	/* Fill in the data structures */
  7958.  	cdev_init(&wd_data->cdev, &watchdog_fops);
  7959. +	wd_data->cdev.owner = wdd->ops->owner;
  7960.  
  7961.  	/* Add the device */
  7962.  	err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
  7963. @@ -970,8 +971,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
  7964.  		return err;
  7965.  	}
  7966.  
  7967. -	wd_data->cdev.owner = wdd->ops->owner;
  7968. -
  7969.  	/* Record time of most recent heartbeat as 'just before now'. */
  7970.  	wd_data->last_hw_keepalive = jiffies - 1;
  7971.  
  7972. diff --git fs/aio.c fs/aio.c
  7973. index 2eb3dba5ed16..816f1443626b 100644
  7974. --- linux-4.14.336/fs/aio.c
  7975. +++ linux-4.14.336/fs/aio.c
  7976. @@ -562,6 +562,13 @@ void kiocb_set_cancel_fn(struct kiocb *iocb, kiocb_cancel_fn *cancel)
  7977.  	struct kioctx *ctx = req->ki_ctx;
  7978.  	unsigned long flags;
  7979.  
  7980. +	/*
  7981. +	 * kiocb didn't come from aio or is neither a read nor a write, hence
  7982. +	 * ignore it.
  7983. +	 */
  7984. +	if (!(iocb->ki_flags & IOCB_AIO_RW))
  7985. +		return;
  7986. +
  7987.  	spin_lock_irqsave(&ctx->ctx_lock, flags);
  7988.  
  7989.  	if (!req->ki_list.next)
  7990. @@ -1601,7 +1608,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
  7991.  	}
  7992.  	req->common.ki_pos = iocb->aio_offset;
  7993.  	req->common.ki_complete = aio_complete;
  7994. -	req->common.ki_flags = iocb_flags(req->common.ki_filp);
  7995. +	req->common.ki_flags = iocb_flags(req->common.ki_filp) | IOCB_AIO_RW;
  7996.  	req->common.ki_hint = file_write_hint(file);
  7997.  
  7998.  	if (iocb->aio_flags & IOCB_FLAG_RESFD) {
  7999. diff --git fs/btrfs/dev-replace.c fs/btrfs/dev-replace.c
  8000. index f1e9dd246ab0..3238bd9c0d39 100644
  8001. --- linux-4.14.336/fs/btrfs/dev-replace.c
  8002. +++ linux-4.14.336/fs/btrfs/dev-replace.c
  8003. @@ -426,6 +426,23 @@ leave:
  8004.  	return ret;
  8005.  }
  8006.  
  8007. +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args)
  8008. +{
  8009. +	if (args->start.srcdevid == 0) {
  8010. +		if (memchr(args->start.srcdev_name, 0,
  8011. +			   sizeof(args->start.srcdev_name)) == NULL)
  8012. +			return -ENAMETOOLONG;
  8013. +	} else {
  8014. +		args->start.srcdev_name[0] = 0;
  8015. +	}
  8016. +
  8017. +	if (memchr(args->start.tgtdev_name, 0,
  8018. +		   sizeof(args->start.tgtdev_name)) == NULL)
  8019. +	    return -ENAMETOOLONG;
  8020. +
  8021. +	return 0;
  8022. +}
  8023. +
  8024.  int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info,
  8025.  			    struct btrfs_ioctl_dev_replace_args *args)
  8026.  {
  8027. @@ -438,10 +455,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info,
  8028.  	default:
  8029.  		return -EINVAL;
  8030.  	}
  8031. -
  8032. -	if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') ||
  8033. -	    args->start.tgtdev_name[0] == '\0')
  8034. -		return -EINVAL;
  8035. +	ret = btrfs_check_replace_dev_names(args);
  8036. +	if (ret < 0)
  8037. +		return ret;
  8038.  
  8039.  	ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name,
  8040.  					args->start.srcdevid,
  8041. diff --git fs/btrfs/extent-tree.c fs/btrfs/extent-tree.c
  8042. index deb01e59da02..6741710a149e 100644
  8043. --- linux-4.14.336/fs/btrfs/extent-tree.c
  8044. +++ linux-4.14.336/fs/btrfs/extent-tree.c
  8045. @@ -2070,7 +2070,8 @@ static int btrfs_issue_discard(struct block_device *bdev, u64 start, u64 len,
  8046.  	u64 bytes_left, end;
  8047.  	u64 aligned_start = ALIGN(start, 1 << 9);
  8048.  
  8049. -	if (WARN_ON(start != aligned_start)) {
  8050. +	/* Adjust the range to be aligned to 512B sectors if necessary. */
  8051. +	if (start != aligned_start) {
  8052.  		len -= aligned_start - start;
  8053.  		len = round_down(len, 1 << 9);
  8054.  		start = aligned_start;
  8055. diff --git fs/btrfs/ioctl.c fs/btrfs/ioctl.c
  8056. index 93b83dc298ac..c8bc8cf5a41f 100644
  8057. --- linux-4.14.336/fs/btrfs/ioctl.c
  8058. +++ linux-4.14.336/fs/btrfs/ioctl.c
  8059. @@ -2668,6 +2668,10 @@ static int btrfs_ioctl_defrag(struct file *file, void __user *argp)
  8060.  				kfree(range);
  8061.  				goto out;
  8062.  			}
  8063. +			if (range->flags & ~BTRFS_DEFRAG_RANGE_FLAGS_SUPP) {
  8064. +				ret = -EOPNOTSUPP;
  8065. +				goto out;
  8066. +			}
  8067.  			/* compression requires us to start the IO */
  8068.  			if ((range->flags & BTRFS_DEFRAG_RANGE_COMPRESS)) {
  8069.  				range->flags |= BTRFS_DEFRAG_RANGE_START_IO;
  8070. diff --git fs/btrfs/send.c fs/btrfs/send.c
  8071. index f2cb7fec7547..fa9797f8501e 100644
  8072. --- linux-4.14.336/fs/btrfs/send.c
  8073. +++ linux-4.14.336/fs/btrfs/send.c
  8074. @@ -6662,7 +6662,7 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
  8075.  	}
  8076.  
  8077.  	if (arg->flags & ~BTRFS_SEND_FLAG_MASK) {
  8078. -		ret = -EINVAL;
  8079. +		ret = -EOPNOTSUPP;
  8080.  		goto out;
  8081.  	}
  8082.  
  8083. diff --git fs/cachefiles/bind.c fs/cachefiles/bind.c
  8084. index d9f001078e08..5aa9f4578f3e 100644
  8085. --- linux-4.14.336/fs/cachefiles/bind.c
  8086. +++ linux-4.14.336/fs/cachefiles/bind.c
  8087. @@ -248,6 +248,8 @@ error_open_root:
  8088.  	kmem_cache_free(cachefiles_object_jar, fsdef);
  8089.  error_root_object:
  8090.  	cachefiles_end_secure(cache, saved_cred);
  8091. +	put_cred(cache->cache_cred);
  8092. +	cache->cache_cred = NULL;
  8093.  	pr_err("Failed to register: %d\n", ret);
  8094.  	return ret;
  8095.  }
  8096. @@ -268,6 +270,7 @@ void cachefiles_daemon_unbind(struct cachefiles_cache *cache)
  8097.  
  8098.  	dput(cache->graveyard);
  8099.  	mntput(cache->mnt);
  8100. +	put_cred(cache->cache_cred);
  8101.  
  8102.  	kfree(cache->rootdirname);
  8103.  	kfree(cache->secctx);
  8104. diff --git fs/ceph/caps.c fs/ceph/caps.c
  8105. index e36786f574b8..b84ce90953c6 100644
  8106. --- linux-4.14.336/fs/ceph/caps.c
  8107. +++ linux-4.14.336/fs/ceph/caps.c
  8108. @@ -4026,12 +4026,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
  8109.  			       struct inode *dir,
  8110.  			       int mds, int drop, int unless)
  8111.  {
  8112. -	struct dentry *parent = NULL;
  8113.  	struct ceph_mds_request_release *rel = *p;
  8114.  	struct ceph_dentry_info *di = ceph_dentry(dentry);
  8115.  	int force = 0;
  8116.  	int ret;
  8117.  
  8118. +	/* This shouldn't happen */
  8119. +	BUG_ON(!dir);
  8120. +
  8121.  	/*
  8122.  	 * force an record for the directory caps if we have a dentry lease.
  8123.  	 * this is racy (can't take i_ceph_lock and d_lock together), but it
  8124. @@ -4041,14 +4043,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry,
  8125.  	spin_lock(&dentry->d_lock);
  8126.  	if (di->lease_session && di->lease_session->s_mds == mds)
  8127.  		force = 1;
  8128. -	if (!dir) {
  8129. -		parent = dget(dentry->d_parent);
  8130. -		dir = d_inode(parent);
  8131. -	}
  8132.  	spin_unlock(&dentry->d_lock);
  8133.  
  8134.  	ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force);
  8135. -	dput(parent);
  8136.  
  8137.  	spin_lock(&dentry->d_lock);
  8138.  	if (ret && di->lease_session && di->lease_session->s_mds == mds) {
  8139. diff --git fs/compat_ioctl.c fs/compat_ioctl.c
  8140. index f445bc9cdc94..74e8507419d7 100644
  8141. --- linux-4.14.336/fs/compat_ioctl.c
  8142. +++ linux-4.14.336/fs/compat_ioctl.c
  8143. @@ -1546,8 +1546,7 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd,
  8144.  	if (!f.file)
  8145.  		goto out;
  8146.  
  8147. -	/* RED-PEN how should LSM module know it's handling 32bit? */
  8148. -	error = security_file_ioctl(f.file, cmd, arg);
  8149. +	error = security_file_ioctl_compat(f.file, cmd, arg);
  8150.  	if (error)
  8151.  		goto out_fput;
  8152.  
  8153. diff --git fs/dcache.c fs/dcache.c
  8154. index 9ac1290ae44f..5a9a773ece54 100644
  8155. --- linux-4.14.336/fs/dcache.c
  8156. +++ linux-4.14.336/fs/dcache.c
  8157. @@ -709,12 +709,12 @@ static inline bool fast_dput(struct dentry *dentry)
  8158.  	 */
  8159.  	if (unlikely(ret < 0)) {
  8160.  		spin_lock(&dentry->d_lock);
  8161. -		if (dentry->d_lockref.count > 1) {
  8162. -			dentry->d_lockref.count--;
  8163. +		if (WARN_ON_ONCE(dentry->d_lockref.count <= 0)) {
  8164.  			spin_unlock(&dentry->d_lock);
  8165.  			return 1;
  8166.  		}
  8167. -		return 0;
  8168. +		dentry->d_lockref.count--;
  8169. +		goto locked;
  8170.  	}
  8171.  
  8172.  	/*
  8173. @@ -765,6 +765,7 @@ static inline bool fast_dput(struct dentry *dentry)
  8174.  	 * else could have killed it and marked it dead. Either way, we
  8175.  	 * don't need to do anything else.
  8176.  	 */
  8177. +locked:
  8178.  	if (dentry->d_lockref.count) {
  8179.  		spin_unlock(&dentry->d_lock);
  8180.  		return 1;
  8181. diff --git fs/ext4/mballoc.c fs/ext4/mballoc.c
  8182. index 91d1de198fed..64ce26ec9c68 100644
  8183. --- linux-4.14.336/fs/ext4/mballoc.c
  8184. +++ linux-4.14.336/fs/ext4/mballoc.c
  8185. @@ -1817,6 +1817,9 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
  8186.  		return err;
  8187.  
  8188.  	ext4_lock_group(ac->ac_sb, group);
  8189. +	if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
  8190. +		goto out;
  8191. +
  8192.  	max = mb_find_extent(e4b, ex.fe_start, ex.fe_len, &ex);
  8193.  
  8194.  	if (max > 0) {
  8195. @@ -1824,6 +1827,7 @@ int ext4_mb_try_best_found(struct ext4_allocation_context *ac,
  8196.  		ext4_mb_use_best_found(ac, e4b);
  8197.  	}
  8198.  
  8199. +out:
  8200.  	ext4_unlock_group(ac->ac_sb, group);
  8201.  	ext4_mb_unload_buddy(e4b);
  8202.  
  8203. @@ -1850,12 +1854,10 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
  8204.  	if (err)
  8205.  		return err;
  8206.  
  8207. -	if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) {
  8208. -		ext4_mb_unload_buddy(e4b);
  8209. -		return 0;
  8210. -	}
  8211. -
  8212.  	ext4_lock_group(ac->ac_sb, group);
  8213. +	if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)))
  8214. +		goto out;
  8215. +
  8216.  	max = mb_find_extent(e4b, ac->ac_g_ex.fe_start,
  8217.  			     ac->ac_g_ex.fe_len, &ex);
  8218.  	ex.fe_logical = 0xDEADFA11; /* debug value */
  8219. @@ -1888,6 +1890,7 @@ int ext4_mb_find_by_goal(struct ext4_allocation_context *ac,
  8220.  		ac->ac_b_ex = ex;
  8221.  		ext4_mb_use_best_found(ac, e4b);
  8222.  	}
  8223. +out:
  8224.  	ext4_unlock_group(ac->ac_sb, group);
  8225.  	ext4_mb_unload_buddy(e4b);
  8226.  
  8227. diff --git fs/ext4/move_extent.c fs/ext4/move_extent.c
  8228. index ef60f2e92da6..a10c560405b2 100644
  8229. --- linux-4.14.336/fs/ext4/move_extent.c
  8230. +++ linux-4.14.336/fs/ext4/move_extent.c
  8231. @@ -628,6 +628,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
  8232.  		goto out;
  8233.  	o_end = o_start + len;
  8234.  
  8235. +	*moved_len = 0;
  8236.  	while (o_start < o_end) {
  8237.  		struct ext4_extent *ex;
  8238.  		ext4_lblk_t cur_blk, next_blk;
  8239. @@ -683,7 +684,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
  8240.  		 */
  8241.  		ext4_double_up_write_data_sem(orig_inode, donor_inode);
  8242.  		/* Swap original branches with new branches */
  8243. -		move_extent_per_page(o_filp, donor_inode,
  8244. +		*moved_len += move_extent_per_page(o_filp, donor_inode,
  8245.  				     orig_page_index, donor_page_index,
  8246.  				     offset_in_page, cur_len,
  8247.  				     unwritten, &ret);
  8248. @@ -693,9 +694,6 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk,
  8249.  		o_start += cur_len;
  8250.  		d_start += cur_len;
  8251.  	}
  8252. -	*moved_len = o_start - orig_blk;
  8253. -	if (*moved_len > len)
  8254. -		*moved_len = len;
  8255.  
  8256.  out:
  8257.  	if (*moved_len) {
  8258. diff --git fs/ext4/resize.c fs/ext4/resize.c
  8259. index f0b27be5892a..47ecf0826899 100644
  8260. --- linux-4.14.336/fs/ext4/resize.c
  8261. +++ linux-4.14.336/fs/ext4/resize.c
  8262. @@ -237,7 +237,7 @@ struct ext4_new_flex_group_data {
  8263.   *
  8264.   * Returns NULL on failure otherwise address of the allocated structure.
  8265.   */
  8266. -static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
  8267. +static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned int flexbg_size)
  8268.  {
  8269.  	struct ext4_new_flex_group_data *flex_gd;
  8270.  
  8271. @@ -290,7 +290,7 @@ static void free_flex_gd(struct ext4_new_flex_group_data *flex_gd)
  8272.   */
  8273.  static int ext4_alloc_group_tables(struct super_block *sb,
  8274.  				struct ext4_new_flex_group_data *flex_gd,
  8275. -				int flexbg_size)
  8276. +				unsigned int flexbg_size)
  8277.  {
  8278.  	struct ext4_new_group_data *group_data = flex_gd->groups;
  8279.  	ext4_fsblk_t start_blk;
  8280. @@ -383,12 +383,12 @@ next_group:
  8281.  		group = group_data[0].group;
  8282.  
  8283.  		printk(KERN_DEBUG "EXT4-fs: adding a flex group with "
  8284. -		       "%d groups, flexbg size is %d:\n", flex_gd->count,
  8285. +		       "%u groups, flexbg size is %u:\n", flex_gd->count,
  8286.  		       flexbg_size);
  8287.  
  8288.  		for (i = 0; i < flex_gd->count; i++) {
  8289.  			printk(KERN_DEBUG "adding %s group %u: %u "
  8290. -			       "blocks (%d free)\n",
  8291. +			       "blocks (%u free)\n",
  8292.  			       ext4_bg_has_super(sb, group + i) ? "normal" :
  8293.  			       "no-super", group + i,
  8294.  			       group_data[i].blocks_count,
  8295. @@ -1558,7 +1558,7 @@ exit:
  8296.  static int ext4_setup_next_flex_gd(struct super_block *sb,
  8297.  				    struct ext4_new_flex_group_data *flex_gd,
  8298.  				    ext4_fsblk_t n_blocks_count,
  8299. -				    unsigned long flexbg_size)
  8300. +				    unsigned int flexbg_size)
  8301.  {
  8302.  	struct ext4_super_block *es = EXT4_SB(sb)->s_es;
  8303.  	struct ext4_new_group_data *group_data = flex_gd->groups;
  8304. @@ -1935,8 +1935,9 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
  8305.  	ext4_fsblk_t o_blocks_count;
  8306.  	ext4_fsblk_t n_blocks_count_retry = 0;
  8307.  	unsigned long last_update_time = 0;
  8308. -	int err = 0, flexbg_size = 1 << sbi->s_log_groups_per_flex;
  8309. +	int err = 0;
  8310.  	int meta_bg;
  8311. +	unsigned int flexbg_size = ext4_flex_bg_size(sbi);
  8312.  
  8313.  	/* See if the device is actually as big as what was requested */
  8314.  	bh = sb_bread(sb, n_blocks_count - 1);
  8315. diff --git fs/f2fs/namei.c fs/f2fs/namei.c
  8316. index 9fb98fce7096..eb9db586c01d 100644
  8317. --- linux-4.14.336/fs/f2fs/namei.c
  8318. +++ linux-4.14.336/fs/f2fs/namei.c
  8319. @@ -882,7 +882,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
  8320.  	}
  8321.  
  8322.  	if (old_dir_entry) {
  8323. -		if (old_dir != new_dir && !whiteout) {
  8324. +		if (old_dir != new_dir) {
  8325.  			f2fs_set_link(old_inode, old_dir_entry,
  8326.  						old_dir_page, new_dir);
  8327.  		} else {
  8328. diff --git fs/f2fs/xattr.c fs/f2fs/xattr.c
  8329. index b3c64ab0d5a5..f52c01804f81 100644
  8330. --- linux-4.14.336/fs/f2fs/xattr.c
  8331. +++ linux-4.14.336/fs/f2fs/xattr.c
  8332. @@ -695,6 +695,12 @@ static int __f2fs_setxattr(struct inode *inode, int index,
  8333.  		memcpy(pval, value, size);
  8334.  		last->e_value_size = cpu_to_le16(size);
  8335.  		new_hsize += newsize;
  8336. +		/*
  8337. +		 * Explicitly add the null terminator.  The unused xattr space
  8338. +		 * is supposed to always be zeroed, which would make this
  8339. +		 * unnecessary, but don't depend on that.
  8340. +		 */
  8341. +		*(u32 *)((u8 *)last + newsize) = 0;
  8342.  	}
  8343.  
  8344.  	error = write_all_xattrs(inode, new_hsize, base_addr, ipage);
  8345. diff --git fs/fuse/dir.c fs/fuse/dir.c
  8346. index 8e5125904762..bd602b7e8e46 100644
  8347. --- linux-4.14.336/fs/fuse/dir.c
  8348. +++ linux-4.14.336/fs/fuse/dir.c
  8349. @@ -1299,8 +1299,16 @@ retry:
  8350.  			dput(dentry);
  8351.  			dentry = alias;
  8352.  		}
  8353. -		if (IS_ERR(dentry))
  8354. +		if (IS_ERR(dentry)) {
  8355. +			if (!IS_ERR(inode)) {
  8356. +				struct fuse_inode *fi = get_fuse_inode(inode);
  8357. +
  8358. +				spin_lock(&fc->lock);
  8359. +				fi->nlookup--;
  8360. +				spin_unlock(&fc->lock);
  8361. +			}
  8362.  			return PTR_ERR(dentry);
  8363. +		}
  8364.  	}
  8365.  	if (fc->readdirplus_auto)
  8366.  		set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
  8367. diff --git fs/jbd2/journal.c fs/jbd2/journal.c
  8368. index 93a466cf58ba..ee114f0b625a 100644
  8369. --- linux-4.14.336/fs/jbd2/journal.c
  8370. +++ linux-4.14.336/fs/jbd2/journal.c
  8371. @@ -1361,9 +1361,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
  8372.  		return -EIO;
  8373.  	}
  8374.  
  8375. -	trace_jbd2_write_superblock(journal, write_flags);
  8376.  	if (!(journal->j_flags & JBD2_BARRIER))
  8377.  		write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
  8378. +
  8379. +	trace_jbd2_write_superblock(journal, write_flags);
  8380. +
  8381.  	if (buffer_write_io_error(bh)) {
  8382.  		/*
  8383.  		 * Oh, dear.  A previous attempt to write the journal
  8384. diff --git fs/jfs/jfs_dmap.c fs/jfs/jfs_dmap.c
  8385. index ed7989d7b2ba..6c6efb5a168b 100644
  8386. --- linux-4.14.336/fs/jfs/jfs_dmap.c
  8387. +++ linux-4.14.336/fs/jfs/jfs_dmap.c
  8388. @@ -76,10 +76,10 @@
  8389.   */
  8390.  static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8391.  			int nblocks);
  8392. -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval);
  8393. -static int dbBackSplit(dmtree_t * tp, int leafno);
  8394. -static int dbJoin(dmtree_t * tp, int leafno, int newval);
  8395. -static void dbAdjTree(dmtree_t * tp, int leafno, int newval);
  8396. +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl);
  8397. +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl);
  8398. +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl);
  8399. +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl);
  8400.  static int dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc,
  8401.  		    int level);
  8402.  static int dbAllocAny(struct bmap * bmp, s64 nblocks, int l2nb, s64 * results);
  8403. @@ -2184,7 +2184,7 @@ static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8404.  		 * system.
  8405.  		 */
  8406.  		if (dp->tree.stree[word] == NOFREE)
  8407. -			dbBackSplit((dmtree_t *) & dp->tree, word);
  8408. +			dbBackSplit((dmtree_t *)&dp->tree, word, false);
  8409.  
  8410.  		dbAllocBits(bmp, dp, blkno, nblocks);
  8411.  	}
  8412. @@ -2270,7 +2270,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8413.  			 * the binary system of the leaves if need be.
  8414.  			 */
  8415.  			dbSplit(tp, word, BUDMIN,
  8416. -				dbMaxBud((u8 *) & dp->wmap[word]));
  8417. +				dbMaxBud((u8 *)&dp->wmap[word]), false);
  8418.  
  8419.  			word += 1;
  8420.  		} else {
  8421. @@ -2310,7 +2310,7 @@ static void dbAllocBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8422.  				 * system of the leaves to reflect the current
  8423.  				 * allocation (size).
  8424.  				 */
  8425. -				dbSplit(tp, word, size, NOFREE);
  8426. +				dbSplit(tp, word, size, NOFREE, false);
  8427.  
  8428.  				/* get the number of dmap words handled */
  8429.  				nw = BUDSIZE(size, BUDMIN);
  8430. @@ -2417,7 +2417,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8431.  			/* update the leaf for this dmap word.
  8432.  			 */
  8433.  			rc = dbJoin(tp, word,
  8434. -				    dbMaxBud((u8 *) & dp->wmap[word]));
  8435. +				    dbMaxBud((u8 *)&dp->wmap[word]), false);
  8436.  			if (rc)
  8437.  				return rc;
  8438.  
  8439. @@ -2450,7 +2450,7 @@ static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno,
  8440.  
  8441.  				/* update the leaf.
  8442.  				 */
  8443. -				rc = dbJoin(tp, word, size);
  8444. +				rc = dbJoin(tp, word, size, false);
  8445.  				if (rc)
  8446.  					return rc;
  8447.  
  8448. @@ -2602,14 +2602,14 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
  8449.  		 * that it is at the front of a binary buddy system.
  8450.  		 */
  8451.  		if (oldval == NOFREE) {
  8452. -			rc = dbBackSplit((dmtree_t *) dcp, leafno);
  8453. +			rc = dbBackSplit((dmtree_t *)dcp, leafno, true);
  8454.  			if (rc)
  8455.  				return rc;
  8456.  			oldval = dcp->stree[ti];
  8457.  		}
  8458. -		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval);
  8459. +		dbSplit((dmtree_t *) dcp, leafno, dcp->budmin, newval, true);
  8460.  	} else {
  8461. -		rc = dbJoin((dmtree_t *) dcp, leafno, newval);
  8462. +		rc = dbJoin((dmtree_t *) dcp, leafno, newval, true);
  8463.  		if (rc)
  8464.  			return rc;
  8465.  	}
  8466. @@ -2638,7 +2638,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
  8467.  				 */
  8468.  				if (alloc) {
  8469.  					dbJoin((dmtree_t *) dcp, leafno,
  8470. -					       oldval);
  8471. +					       oldval, true);
  8472.  				} else {
  8473.  					/* the dbJoin() above might have
  8474.  					 * caused a larger binary buddy system
  8475. @@ -2648,9 +2648,9 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
  8476.  					 */
  8477.  					if (dcp->stree[ti] == NOFREE)
  8478.  						dbBackSplit((dmtree_t *)
  8479. -							    dcp, leafno);
  8480. +							    dcp, leafno, true);
  8481.  					dbSplit((dmtree_t *) dcp, leafno,
  8482. -						dcp->budmin, oldval);
  8483. +						dcp->budmin, oldval, true);
  8484.  				}
  8485.  
  8486.  				/* release the buffer and return the error.
  8487. @@ -2698,7 +2698,7 @@ dbAdjCtl(struct bmap * bmp, s64 blkno, int newval, int alloc, int level)
  8488.   *
  8489.   * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  8490.   */
  8491. -static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  8492. +static void dbSplit(dmtree_t *tp, int leafno, int splitsz, int newval, bool is_ctl)
  8493.  {
  8494.  	int budsz;
  8495.  	int cursz;
  8496. @@ -2720,7 +2720,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  8497.  		while (cursz >= splitsz) {
  8498.  			/* update the buddy's leaf with its new value.
  8499.  			 */
  8500. -			dbAdjTree(tp, leafno ^ budsz, cursz);
  8501. +			dbAdjTree(tp, leafno ^ budsz, cursz, is_ctl);
  8502.  
  8503.  			/* on to the next size and buddy.
  8504.  			 */
  8505. @@ -2732,7 +2732,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  8506.  	/* adjust the dmap tree to reflect the specified leaf's new
  8507.  	 * value.
  8508.  	 */
  8509. -	dbAdjTree(tp, leafno, newval);
  8510. +	dbAdjTree(tp, leafno, newval, is_ctl);
  8511.  }
  8512.  
  8513.  
  8514. @@ -2763,7 +2763,7 @@ static void dbSplit(dmtree_t * tp, int leafno, int splitsz, int newval)
  8515.   *
  8516.   * serialization: IREAD_LOCK(ipbmap) or IWRITE_LOCK(ipbmap) held on entry/exit;
  8517.   */
  8518. -static int dbBackSplit(dmtree_t * tp, int leafno)
  8519. +static int dbBackSplit(dmtree_t *tp, int leafno, bool is_ctl)
  8520.  {
  8521.  	int budsz, bud, w, bsz, size;
  8522.  	int cursz;
  8523. @@ -2814,7 +2814,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
  8524.  				 * system in two.
  8525.  				 */
  8526.  				cursz = leaf[bud] - 1;
  8527. -				dbSplit(tp, bud, cursz, cursz);
  8528. +				dbSplit(tp, bud, cursz, cursz, is_ctl);
  8529.  				break;
  8530.  			}
  8531.  		}
  8532. @@ -2842,7 +2842,7 @@ static int dbBackSplit(dmtree_t * tp, int leafno)
  8533.   *
  8534.   * RETURN VALUES: none
  8535.   */
  8536. -static int dbJoin(dmtree_t * tp, int leafno, int newval)
  8537. +static int dbJoin(dmtree_t *tp, int leafno, int newval, bool is_ctl)
  8538.  {
  8539.  	int budsz, buddy;
  8540.  	s8 *leaf;
  8541. @@ -2897,12 +2897,12 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
  8542.  			if (leafno < buddy) {
  8543.  				/* leafno is the left buddy.
  8544.  				 */
  8545. -				dbAdjTree(tp, buddy, NOFREE);
  8546. +				dbAdjTree(tp, buddy, NOFREE, is_ctl);
  8547.  			} else {
  8548.  				/* buddy is the left buddy and becomes
  8549.  				 * leafno.
  8550.  				 */
  8551. -				dbAdjTree(tp, leafno, NOFREE);
  8552. +				dbAdjTree(tp, leafno, NOFREE, is_ctl);
  8553.  				leafno = buddy;
  8554.  			}
  8555.  
  8556. @@ -2915,7 +2915,7 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
  8557.  
  8558.  	/* update the leaf value.
  8559.  	 */
  8560. -	dbAdjTree(tp, leafno, newval);
  8561. +	dbAdjTree(tp, leafno, newval, is_ctl);
  8562.  
  8563.  	return 0;
  8564.  }
  8565. @@ -2936,15 +2936,20 @@ static int dbJoin(dmtree_t * tp, int leafno, int newval)
  8566.   *
  8567.   * RETURN VALUES: none
  8568.   */
  8569. -static void dbAdjTree(dmtree_t * tp, int leafno, int newval)
  8570. +static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)
  8571.  {
  8572.  	int lp, pp, k;
  8573. -	int max;
  8574. +	int max, size;
  8575. +
  8576. +	size = is_ctl ? CTLTREESIZE : TREESIZE;
  8577.  
  8578.  	/* pick up the index of the leaf for this leafno.
  8579.  	 */
  8580.  	lp = leafno + le32_to_cpu(tp->dmt_leafidx);
  8581.  
  8582. +	if (WARN_ON_ONCE(lp >= size || lp < 0))
  8583. +		return;
  8584. +
  8585.  	/* is the current value the same as the old value ?  if so,
  8586.  	 * there is nothing to do.
  8587.  	 */
  8588. diff --git fs/jfs/jfs_dtree.c fs/jfs/jfs_dtree.c
  8589. index de2bcb36e079..14a16bb906e8 100644
  8590. --- linux-4.14.336/fs/jfs/jfs_dtree.c
  8591. +++ linux-4.14.336/fs/jfs/jfs_dtree.c
  8592. @@ -645,6 +645,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data,
  8593.  		for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) {
  8594.  			index = base + (lim >> 1);
  8595.  
  8596. +			if (stbl[index] < 0) {
  8597. +				rc = -EIO;
  8598. +				goto out;
  8599. +			}
  8600. +
  8601.  			if (p->header.flag & BT_LEAF) {
  8602.  				/* uppercase leaf name to compare */
  8603.  				cmp =
  8604. @@ -1982,7 +1987,7 @@ static int dtSplitRoot(tid_t tid,
  8605.  		do {
  8606.  			f = &rp->slot[fsi];
  8607.  			fsi = f->next;
  8608. -		} while (fsi != -1);
  8609. +		} while (fsi >= 0);
  8610.  
  8611.  		f->next = n;
  8612.  	}
  8613. diff --git fs/jfs/jfs_imap.c fs/jfs/jfs_imap.c
  8614. index 131dce5316ac..5cdcf68a4803 100644
  8615. --- linux-4.14.336/fs/jfs/jfs_imap.c
  8616. +++ linux-4.14.336/fs/jfs/jfs_imap.c
  8617. @@ -2200,6 +2200,9 @@ static int diNewExt(struct inomap * imap, struct iag * iagp, int extno)
  8618.  	/* get the ag and iag numbers for this iag.
  8619.  	 */
  8620.  	agno = BLKTOAG(le64_to_cpu(iagp->agstart), sbi);
  8621. +	if (agno >= MAXAG || agno < 0)
  8622. +		return -EIO;
  8623. +
  8624.  	iagno = le32_to_cpu(iagp->iagnum);
  8625.  
  8626.  	/* check if this is the last free extent within the
  8627. diff --git fs/jfs/jfs_mount.c fs/jfs/jfs_mount.c
  8628. index f1a705d15904..97d91c1686b8 100644
  8629. --- linux-4.14.336/fs/jfs/jfs_mount.c
  8630. +++ linux-4.14.336/fs/jfs/jfs_mount.c
  8631. @@ -184,15 +184,15 @@ int jfs_mount(struct super_block *sb)
  8632.  	}
  8633.  	jfs_info("jfs_mount: ipimap:0x%p", ipimap);
  8634.  
  8635. -	/* map further access of per fileset inodes by the fileset inode */
  8636. -	sbi->ipimap = ipimap;
  8637. -
  8638.  	/* initialize fileset inode allocation map */
  8639.  	if ((rc = diMount(ipimap))) {
  8640.  		jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
  8641.  		goto err_ipimap;
  8642.  	}
  8643.  
  8644. +	/* map further access of per fileset inodes by the fileset inode */
  8645. +	sbi->ipimap = ipimap;
  8646. +
  8647.  	return rc;
  8648.  
  8649.  	/*
  8650. diff --git fs/nfs/nfs4proc.c fs/nfs/nfs4proc.c
  8651. index ff41d726f758..77c207a0fb81 100644
  8652. --- linux-4.14.336/fs/nfs/nfs4proc.c
  8653. +++ linux-4.14.336/fs/nfs/nfs4proc.c
  8654. @@ -161,6 +161,7 @@ static int nfs4_map_errors(int err)
  8655.  	case -NFS4ERR_RESOURCE:
  8656.  	case -NFS4ERR_LAYOUTTRYLATER:
  8657.  	case -NFS4ERR_RECALLCONFLICT:
  8658. +	case -NFS4ERR_RETURNCONFLICT:
  8659.  		return -EREMOTEIO;
  8660.  	case -NFS4ERR_WRONGSEC:
  8661.  	case -NFS4ERR_WRONG_CRED:
  8662. @@ -472,6 +473,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
  8663.  		case -NFS4ERR_GRACE:
  8664.  		case -NFS4ERR_LAYOUTTRYLATER:
  8665.  		case -NFS4ERR_RECALLCONFLICT:
  8666. +		case -NFS4ERR_RETURNCONFLICT:
  8667.  			exception->delay = 1;
  8668.  			return 0;
  8669.  
  8670. @@ -8540,6 +8542,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
  8671.  		status = -EBUSY;
  8672.  		break;
  8673.  	case -NFS4ERR_RECALLCONFLICT:
  8674. +	case -NFS4ERR_RETURNCONFLICT:
  8675.  		status = -ERECALLCONFLICT;
  8676.  		break;
  8677.  	case -NFS4ERR_DELEG_REVOKED:
  8678. diff --git fs/nfsd/nfs4state.c fs/nfsd/nfs4state.c
  8679. index 2adbf471d107..6720c82ac351 100644
  8680. --- linux-4.14.336/fs/nfsd/nfs4state.c
  8681. +++ linux-4.14.336/fs/nfsd/nfs4state.c
  8682. @@ -6351,12 +6351,16 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp,
  8683.  		if (sop->so_is_open_owner || !same_owner_str(sop, owner))
  8684.  			continue;
  8685.  
  8686. -		if (atomic_read(&sop->so_count) != 1) {
  8687. -			spin_unlock(&clp->cl_lock);
  8688. -			return nfserr_locks_held;
  8689. +		/* see if there are still any locks associated with it */
  8690. +		lo = lockowner(sop);
  8691. +		list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
  8692. +			if (check_for_locks(stp->st_stid.sc_file, lo)) {
  8693. +				status = nfserr_locks_held;
  8694. +				spin_unlock(&clp->cl_lock);
  8695. +				return status;
  8696. +			}
  8697.  		}
  8698.  
  8699. -		lo = lockowner(sop);
  8700.  		nfs4_get_stateowner(sop);
  8701.  		break;
  8702.  	}
  8703. diff --git fs/nilfs2/dat.c fs/nilfs2/dat.c
  8704. index 185db3c3033b..63bd20032fa7 100644
  8705. --- linux-4.14.336/fs/nilfs2/dat.c
  8706. +++ linux-4.14.336/fs/nilfs2/dat.c
  8707. @@ -49,8 +49,21 @@ static inline struct nilfs_dat_info *NILFS_DAT_I(struct inode *dat)
  8708.  static int nilfs_dat_prepare_entry(struct inode *dat,
  8709.  				   struct nilfs_palloc_req *req, int create)
  8710.  {
  8711. -	return nilfs_palloc_get_entry_block(dat, req->pr_entry_nr,
  8712. -					    create, &req->pr_entry_bh);
  8713. +	int ret;
  8714. +
  8715. +	ret = nilfs_palloc_get_entry_block(dat, req->pr_entry_nr,
  8716. +					   create, &req->pr_entry_bh);
  8717. +	if (unlikely(ret == -ENOENT)) {
  8718. +		nilfs_msg(dat->i_sb, KERN_ERR,
  8719. +			  "DAT doesn't have a block to manage vblocknr = %llu",
  8720. +			  (unsigned long long)req->pr_entry_nr);
  8721. +		/*
  8722. +		 * Return internal code -EINVAL to notify bmap layer of
  8723. +		 * metadata corruption.
  8724. +		 */
  8725. +		ret = -EINVAL;
  8726. +	}
  8727. +	return ret;
  8728.  }
  8729.  
  8730.  static void nilfs_dat_commit_entry(struct inode *dat,
  8731. @@ -132,11 +145,7 @@ static void nilfs_dat_commit_free(struct inode *dat,
  8732.  
  8733.  int nilfs_dat_prepare_start(struct inode *dat, struct nilfs_palloc_req *req)
  8734.  {
  8735. -	int ret;
  8736. -
  8737. -	ret = nilfs_dat_prepare_entry(dat, req, 0);
  8738. -	WARN_ON(ret == -ENOENT);
  8739. -	return ret;
  8740. +	return nilfs_dat_prepare_entry(dat, req, 0);
  8741.  }
  8742.  
  8743.  void nilfs_dat_commit_start(struct inode *dat, struct nilfs_palloc_req *req,
  8744. @@ -163,10 +172,8 @@ int nilfs_dat_prepare_end(struct inode *dat, struct nilfs_palloc_req *req)
  8745.  	int ret;
  8746.  
  8747.  	ret = nilfs_dat_prepare_entry(dat, req, 0);
  8748. -	if (ret < 0) {
  8749. -		WARN_ON(ret == -ENOENT);
  8750. +	if (ret < 0)
  8751.  		return ret;
  8752. -	}
  8753.  
  8754.  	kaddr = kmap_atomic(req->pr_entry_bh->b_page);
  8755.  	entry = nilfs_palloc_block_get_entry(dat, req->pr_entry_nr,
  8756. diff --git fs/nilfs2/file.c fs/nilfs2/file.c
  8757. index c5fa3dee72fc..43501da7ef66 100644
  8758. --- linux-4.14.336/fs/nilfs2/file.c
  8759. +++ linux-4.14.336/fs/nilfs2/file.c
  8760. @@ -114,7 +114,13 @@ static int nilfs_page_mkwrite(struct vm_fault *vmf)
  8761.  	nilfs_transaction_commit(inode->i_sb);
  8762.  
  8763.   mapped:
  8764. -	wait_for_stable_page(page);
  8765. +	/*
  8766. +	 * Since checksumming including data blocks is performed to determine
  8767. +	 * the validity of the log to be written and used for recovery, it is
  8768. +	 * necessary to wait for writeback to finish here, regardless of the
  8769. +	 * stable write requirement of the backing device.
  8770. +	 */
  8771. +	wait_on_page_writeback(page);
  8772.   out:
  8773.  	sb_end_pagefault(inode->i_sb);
  8774.  	return block_page_mkwrite_return(ret);
  8775. diff --git fs/nilfs2/recovery.c fs/nilfs2/recovery.c
  8776. index 5139efed1888..cff597333afe 100644
  8777. --- linux-4.14.336/fs/nilfs2/recovery.c
  8778. +++ linux-4.14.336/fs/nilfs2/recovery.c
  8779. @@ -481,9 +481,10 @@ static int nilfs_prepare_segment_for_recovery(struct the_nilfs *nilfs,
  8780.  
  8781.  static int nilfs_recovery_copy_block(struct the_nilfs *nilfs,
  8782.  				     struct nilfs_recovery_block *rb,
  8783. -				     struct page *page)
  8784. +				     loff_t pos, struct page *page)
  8785.  {
  8786.  	struct buffer_head *bh_org;
  8787. +	size_t from = pos & ~PAGE_MASK;
  8788.  	void *kaddr;
  8789.  
  8790.  	bh_org = __bread(nilfs->ns_bdev, rb->blocknr, nilfs->ns_blocksize);
  8791. @@ -491,7 +492,7 @@ static int nilfs_recovery_copy_block(struct the_nilfs *nilfs,
  8792.  		return -EIO;
  8793.  
  8794.  	kaddr = kmap_atomic(page);
  8795. -	memcpy(kaddr + bh_offset(bh_org), bh_org->b_data, bh_org->b_size);
  8796. +	memcpy(kaddr + from, bh_org->b_data, bh_org->b_size);
  8797.  	kunmap_atomic(kaddr);
  8798.  	brelse(bh_org);
  8799.  	return 0;
  8800. @@ -530,7 +531,7 @@ static int nilfs_recover_dsync_blocks(struct the_nilfs *nilfs,
  8801.  			goto failed_inode;
  8802.  		}
  8803.  
  8804. -		err = nilfs_recovery_copy_block(nilfs, rb, page);
  8805. +		err = nilfs_recovery_copy_block(nilfs, rb, pos, page);
  8806.  		if (unlikely(err))
  8807.  			goto failed_page;
  8808.  
  8809. diff --git fs/nilfs2/segment.c fs/nilfs2/segment.c
  8810. index ca4b1675c147..b9fd60e07701 100644
  8811. --- linux-4.14.336/fs/nilfs2/segment.c
  8812. +++ linux-4.14.336/fs/nilfs2/segment.c
  8813. @@ -1715,7 +1715,6 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
  8814.  
  8815.  		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
  8816.  				    b_assoc_buffers) {
  8817. -			set_buffer_async_write(bh);
  8818.  			if (bh == segbuf->sb_super_root) {
  8819.  				if (bh->b_page != bd_page) {
  8820.  					lock_page(bd_page);
  8821. @@ -1726,6 +1725,7 @@ static void nilfs_segctor_prepare_write(struct nilfs_sc_info *sci)
  8822.  				}
  8823.  				break;
  8824.  			}
  8825. +			set_buffer_async_write(bh);
  8826.  			if (bh->b_page != fs_page) {
  8827.  				nilfs_begin_page_io(fs_page);
  8828.  				fs_page = bh->b_page;
  8829. @@ -1811,7 +1811,6 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
  8830.  
  8831.  		list_for_each_entry(bh, &segbuf->sb_payload_buffers,
  8832.  				    b_assoc_buffers) {
  8833. -			clear_buffer_async_write(bh);
  8834.  			if (bh == segbuf->sb_super_root) {
  8835.  				clear_buffer_uptodate(bh);
  8836.  				if (bh->b_page != bd_page) {
  8837. @@ -1820,6 +1819,7 @@ static void nilfs_abort_logs(struct list_head *logs, int err)
  8838.  				}
  8839.  				break;
  8840.  			}
  8841. +			clear_buffer_async_write(bh);
  8842.  			if (bh->b_page != fs_page) {
  8843.  				nilfs_end_page_io(fs_page, err);
  8844.  				fs_page = bh->b_page;
  8845. @@ -1907,8 +1907,9 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
  8846.  				 BIT(BH_Delay) | BIT(BH_NILFS_Volatile) |
  8847.  				 BIT(BH_NILFS_Redirected));
  8848.  
  8849. -			set_mask_bits(&bh->b_state, clear_bits, set_bits);
  8850.  			if (bh == segbuf->sb_super_root) {
  8851. +				set_buffer_uptodate(bh);
  8852. +				clear_buffer_dirty(bh);
  8853.  				if (bh->b_page != bd_page) {
  8854.  					end_page_writeback(bd_page);
  8855.  					bd_page = bh->b_page;
  8856. @@ -1916,6 +1917,7 @@ static void nilfs_segctor_complete_write(struct nilfs_sc_info *sci)
  8857.  				update_sr = true;
  8858.  				break;
  8859.  			}
  8860. +			set_mask_bits(&bh->b_state, clear_bits, set_bits);
  8861.  			if (bh->b_page != fs_page) {
  8862.  				nilfs_end_page_io(fs_page, 0);
  8863.  				fs_page = bh->b_page;
  8864. diff --git fs/pstore/ram.c fs/pstore/ram.c
  8865. index dc5a40058c2f..bbd90fef7fcd 100644
  8866. --- linux-4.14.336/fs/pstore/ram.c
  8867. +++ linux-4.14.336/fs/pstore/ram.c
  8868. @@ -586,6 +586,7 @@ static int ramoops_init_przs(const char *name,
  8869.  	}
  8870.  
  8871.  	zone_sz = mem_sz / *cnt;
  8872. +	zone_sz = ALIGN_DOWN(zone_sz, 2);
  8873.  	if (!zone_sz) {
  8874.  		dev_err(dev, "%s zone size == 0\n", name);
  8875.  		goto fail;
  8876. diff --git fs/pstore/ram_core.c fs/pstore/ram_core.c
  8877. index 58ac4e1a61a3..a323ed939aa8 100644
  8878. --- linux-4.14.336/fs/pstore/ram_core.c
  8879. +++ linux-4.14.336/fs/pstore/ram_core.c
  8880. @@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
  8881.  {
  8882.  	int numerr;
  8883.  	struct persistent_ram_buffer *buffer = prz->buffer;
  8884. -	int ecc_blocks;
  8885. +	size_t ecc_blocks;
  8886.  	size_t ecc_total;
  8887.  
  8888.  	if (!ecc_info || !ecc_info->ecc_size)
  8889. diff --git include/crypto/if_alg.h include/crypto/if_alg.h
  8890. index 2ea6a95ca825..f803dc8c45ad 100644
  8891. --- linux-4.14.336/include/crypto/if_alg.h
  8892. +++ linux-4.14.336/include/crypto/if_alg.h
  8893. @@ -146,6 +146,7 @@ struct af_alg_async_req {
  8894.   * @enc:		Cryptographic operation to be performed when
  8895.   *			recvmsg is invoked.
  8896.   * @len:		Length of memory allocated for this data structure.
  8897. + * @inflight:		Non-zero when AIO requests are in flight.
  8898.   */
  8899.  struct af_alg_ctx {
  8900.  	struct list_head tsgl_list;
  8901. @@ -163,6 +164,8 @@ struct af_alg_ctx {
  8902.  	bool enc;
  8903.  
  8904.  	unsigned int len;
  8905. +
  8906. +	unsigned int inflight;
  8907.  };
  8908.  
  8909.  int af_alg_register_type(const struct af_alg_type *type);
  8910. diff --git include/drm/drm_bridge.h include/drm/drm_bridge.h
  8911. index 6522d4cbc9d9..bfbd38c0b609 100644
  8912. --- linux-4.14.336/include/drm/drm_bridge.h
  8913. +++ linux-4.14.336/include/drm/drm_bridge.h
  8914. @@ -161,7 +161,7 @@ struct drm_bridge_funcs {
  8915.  	 * or &drm_encoder_helper_funcs.dpms hook.
  8916.  	 *
  8917.  	 * The bridge must assume that the display pipe (i.e. clocks and timing
  8918. -	 * singals) feeding it is no longer running when this callback is
  8919. +	 * signals) feeding it is no longer running when this callback is
  8920.  	 * called.
  8921.  	 *
  8922.  	 * The post_disable callback is optional.
  8923. diff --git include/drm/drm_mipi_dsi.h include/drm/drm_mipi_dsi.h
  8924. index 689f615471ab..a059f1d968b7 100644
  8925. --- linux-4.14.336/include/drm/drm_mipi_dsi.h
  8926. +++ linux-4.14.336/include/drm/drm_mipi_dsi.h
  8927. @@ -163,6 +163,7 @@ struct mipi_dsi_device_info {
  8928.   * struct mipi_dsi_device - DSI peripheral device
  8929.   * @host: DSI host for this peripheral
  8930.   * @dev: driver model device node for this peripheral
  8931. + * @attached: the DSI device has been successfully attached
  8932.   * @name: DSI peripheral chip type
  8933.   * @channel: virtual channel assigned to the peripheral
  8934.   * @format: pixel format for video mode
  8935. @@ -172,6 +173,7 @@ struct mipi_dsi_device_info {
  8936.  struct mipi_dsi_device {
  8937.  	struct mipi_dsi_host *host;
  8938.  	struct device dev;
  8939. +	bool attached;
  8940.  
  8941.  	char name[DSI_DEV_NAME_SIZE];
  8942.  	unsigned int channel;
  8943. diff --git include/linux/bpf.h include/linux/bpf.h
  8944. index 3aa05ea79ba1..0d7a61df056b 100644
  8945. --- linux-4.14.336/include/linux/bpf.h
  8946. +++ linux-4.14.336/include/linux/bpf.h
  8947. @@ -38,7 +38,11 @@ struct bpf_map_ops {
  8948.  	/* funcs called by prog_array and perf_event_array map */
  8949.  	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
  8950.  				int fd);
  8951. -	void (*map_fd_put_ptr)(void *ptr);
  8952. +	/* If need_defer is true, the implementation should guarantee that
  8953. +	 * the to-be-put element is still alive before the bpf program, which
  8954. +	 * may manipulate it, exists.
  8955. +	 */
  8956. +	void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
  8957.  	u32 (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
  8958.  	u32 (*map_fd_sys_lookup_elem)(void *ptr);
  8959.  };
  8960. diff --git include/linux/device.h include/linux/device.h
  8961. index 65e06a066b67..27b70b810463 100644
  8962. --- linux-4.14.336/include/linux/device.h
  8963. +++ linux-4.14.336/include/linux/device.h
  8964. @@ -1474,6 +1474,9 @@ do {									\
  8965.  	WARN_ONCE(condition, "%s %s: " format, \
  8966.  			dev_driver_string(dev), dev_name(dev), ## arg)
  8967.  
  8968. +extern __printf(3, 4)
  8969. +int dev_err_probe(const struct device *dev, int err, const char *fmt, ...);
  8970. +
  8971.  /* Create alias, so I can be autoloaded. */
  8972.  #define MODULE_ALIAS_CHARDEV(major,minor) \
  8973.  	MODULE_ALIAS("char-major-" __stringify(major) "-" __stringify(minor))
  8974. diff --git include/linux/dmaengine.h include/linux/dmaengine.h
  8975. index 8089e28539f1..d5a7d320e05c 100644
  8976. --- linux-4.14.336/include/linux/dmaengine.h
  8977. +++ linux-4.14.336/include/linux/dmaengine.h
  8978. @@ -816,7 +816,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan,
  8979.  
  8980.  static inline bool is_slave_direction(enum dma_transfer_direction direction)
  8981.  {
  8982. -	return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM);
  8983. +	return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) ||
  8984. +	       (direction == DMA_DEV_TO_DEV);
  8985.  }
  8986.  
  8987.  static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single(
  8988. diff --git include/linux/fs.h include/linux/fs.h
  8989. index ff0a992846a3..bd6072556269 100644
  8990. --- linux-4.14.336/include/linux/fs.h
  8991. +++ linux-4.14.336/include/linux/fs.h
  8992. @@ -296,6 +296,8 @@ enum rw_hint {
  8993.  #define IOCB_SYNC		(1 << 5)
  8994.  #define IOCB_WRITE		(1 << 6)
  8995.  #define IOCB_NOWAIT		(1 << 7)
  8996. +/* kiocb is a read or write operation submitted by fs/aio.c. */
  8997. +#define IOCB_AIO_RW		(1 << 23)
  8998.  
  8999.  struct kiocb {
  9000.  	struct file		*ki_filp;
  9001. diff --git include/linux/lsm_hooks.h include/linux/lsm_hooks.h
  9002. index 569debc49f3d..28ff40daccff 100644
  9003. --- linux-4.14.336/include/linux/lsm_hooks.h
  9004. +++ linux-4.14.336/include/linux/lsm_hooks.h
  9005. @@ -466,6 +466,12 @@
  9006.   *	simple integer value.  When @arg represents a user space pointer, it
  9007.   *	should never be used by the security module.
  9008.   *	Return 0 if permission is granted.
  9009. + * @file_ioctl_compat:
  9010. + *	@file contains the file structure.
  9011. + *	@cmd contains the operation to perform.
  9012. + *	@arg contains the operational arguments.
  9013. + *	Check permission for a compat ioctl operation on @file.
  9014. + *	Return 0 if permission is granted.
  9015.   * @mmap_addr :
  9016.   *	Check permissions for a mmap operation at @addr.
  9017.   *	@addr contains virtual address that will be used for the operation.
  9018. @@ -1486,6 +1492,8 @@ union security_list_options {
  9019.  	void (*file_free_security)(struct file *file);
  9020.  	int (*file_ioctl)(struct file *file, unsigned int cmd,
  9021.  				unsigned long arg);
  9022. +	int (*file_ioctl_compat)(struct file *file, unsigned int cmd,
  9023. +				unsigned long arg);
  9024.  	int (*mmap_addr)(unsigned long addr);
  9025.  	int (*mmap_file)(struct file *file, unsigned long reqprot,
  9026.  				unsigned long prot, unsigned long flags);
  9027. @@ -1764,6 +1772,7 @@ struct security_hook_heads {
  9028.  	struct list_head file_alloc_security;
  9029.  	struct list_head file_free_security;
  9030.  	struct list_head file_ioctl;
  9031. +	struct list_head file_ioctl_compat;
  9032.  	struct list_head mmap_addr;
  9033.  	struct list_head mmap_file;
  9034.  	struct list_head file_mprotect;
  9035. diff --git include/linux/pci_ids.h include/linux/pci_ids.h
  9036. index 83f576d45d78..c977e636a1dd 100644
  9037. --- linux-4.14.336/include/linux/pci_ids.h
  9038. +++ linux-4.14.336/include/linux/pci_ids.h
  9039. @@ -2953,6 +2953,7 @@
  9040.  #define PCI_DEVICE_ID_INTEL_82443GX_0	0x71a0
  9041.  #define PCI_DEVICE_ID_INTEL_82443GX_2	0x71a2
  9042.  #define PCI_DEVICE_ID_INTEL_82372FB_1	0x7601
  9043. +#define PCI_DEVICE_ID_INTEL_HDA_ARL	0x7728
  9044.  #define PCI_DEVICE_ID_INTEL_SCH_LPC	0x8119
  9045.  #define PCI_DEVICE_ID_INTEL_SCH_IDE	0x811a
  9046.  #define PCI_DEVICE_ID_INTEL_E6XX_CU	0x8183
  9047. diff --git include/linux/security.h include/linux/security.h
  9048. index 1c8968a267c2..cf77cd971795 100644
  9049. --- linux-4.14.336/include/linux/security.h
  9050. +++ linux-4.14.336/include/linux/security.h
  9051. @@ -306,6 +306,8 @@ int security_file_permission(struct file *file, int mask);
  9052.  int security_file_alloc(struct file *file);
  9053.  void security_file_free(struct file *file);
  9054.  int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  9055. +int security_file_ioctl_compat(struct file *file, unsigned int cmd,
  9056. +			       unsigned long arg);
  9057.  int security_mmap_file(struct file *file, unsigned long prot,
  9058.  			unsigned long flags);
  9059.  int security_mmap_addr(unsigned long addr);
  9060. @@ -827,6 +829,13 @@ static inline int security_file_ioctl(struct file *file, unsigned int cmd,
  9061.  	return 0;
  9062.  }
  9063.  
  9064. +static inline int security_file_ioctl_compat(struct file *file,
  9065. +					     unsigned int cmd,
  9066. +					     unsigned long arg)
  9067. +{
  9068. +	return 0;
  9069. +}
  9070. +
  9071.  static inline int security_mmap_file(struct file *file, unsigned long prot,
  9072.  				     unsigned long flags)
  9073.  {
  9074. diff --git include/linux/spi/spi.h include/linux/spi/spi.h
  9075. index a8f6606dd498..5c7741ca3b99 100644
  9076. --- linux-4.14.336/include/linux/spi/spi.h
  9077. +++ linux-4.14.336/include/linux/spi/spi.h
  9078. @@ -153,6 +153,7 @@ struct spi_device {
  9079.  #define	SPI_MODE_1	(0|SPI_CPHA)
  9080.  #define	SPI_MODE_2	(SPI_CPOL|0)
  9081.  #define	SPI_MODE_3	(SPI_CPOL|SPI_CPHA)
  9082. +#define	SPI_MODE_X_MASK	(SPI_CPOL|SPI_CPHA)
  9083.  #define	SPI_CS_HIGH	0x04			/* chipselect active high? */
  9084.  #define	SPI_LSB_FIRST	0x08			/* per-word bits-on-wire */
  9085.  #define	SPI_3WIRE	0x10			/* SI/SO signals shared */
  9086. diff --git include/linux/units.h include/linux/units.h
  9087. new file mode 100644
  9088. index 000000000000..a0af6d2ef4e5
  9089. --- linux-4.14.336//dev/null
  9090. +++ linux-4.14.336/include/linux/units.h
  9091. @@ -0,0 +1,92 @@
  9092. +/* SPDX-License-Identifier: GPL-2.0 */
  9093. +#ifndef _LINUX_UNITS_H
  9094. +#define _LINUX_UNITS_H
  9095. +
  9096. +#include <linux/kernel.h>
  9097. +
  9098. +#define HZ_PER_KHZ		1000UL
  9099. +#define KHZ_PER_MHZ		1000UL
  9100. +#define HZ_PER_MHZ		1000000UL
  9101. +
  9102. +#define MILLIWATT_PER_WATT	1000UL
  9103. +#define MICROWATT_PER_MILLIWATT	1000UL
  9104. +#define MICROWATT_PER_WATT	1000000UL
  9105. +
  9106. +#define ABSOLUTE_ZERO_MILLICELSIUS -273150
  9107. +
  9108. +static inline long milli_kelvin_to_millicelsius(long t)
  9109. +{
  9110. +	return t + ABSOLUTE_ZERO_MILLICELSIUS;
  9111. +}
  9112. +
  9113. +static inline long millicelsius_to_milli_kelvin(long t)
  9114. +{
  9115. +	return t - ABSOLUTE_ZERO_MILLICELSIUS;
  9116. +}
  9117. +
  9118. +#define MILLIDEGREE_PER_DEGREE 1000
  9119. +#define MILLIDEGREE_PER_DECIDEGREE 100
  9120. +
  9121. +static inline long kelvin_to_millicelsius(long t)
  9122. +{
  9123. +	return milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DEGREE);
  9124. +}
  9125. +
  9126. +static inline long millicelsius_to_kelvin(long t)
  9127. +{
  9128. +	t = millicelsius_to_milli_kelvin(t);
  9129. +
  9130. +	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DEGREE);
  9131. +}
  9132. +
  9133. +static inline long deci_kelvin_to_celsius(long t)
  9134. +{
  9135. +	t = milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DECIDEGREE);
  9136. +
  9137. +	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DEGREE);
  9138. +}
  9139. +
  9140. +static inline long celsius_to_deci_kelvin(long t)
  9141. +{
  9142. +	t = millicelsius_to_milli_kelvin(t * MILLIDEGREE_PER_DEGREE);
  9143. +
  9144. +	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DECIDEGREE);
  9145. +}
  9146. +
  9147. +/**
  9148. + * deci_kelvin_to_millicelsius_with_offset - convert Kelvin to Celsius
  9149. + * @t: temperature value in decidegrees Kelvin
  9150. + * @offset: difference between Kelvin and Celsius in millidegrees
  9151. + *
  9152. + * Return: temperature value in millidegrees Celsius
  9153. + */
  9154. +static inline long deci_kelvin_to_millicelsius_with_offset(long t, long offset)
  9155. +{
  9156. +	return t * MILLIDEGREE_PER_DECIDEGREE - offset;
  9157. +}
  9158. +
  9159. +static inline long deci_kelvin_to_millicelsius(long t)
  9160. +{
  9161. +	return milli_kelvin_to_millicelsius(t * MILLIDEGREE_PER_DECIDEGREE);
  9162. +}
  9163. +
  9164. +static inline long millicelsius_to_deci_kelvin(long t)
  9165. +{
  9166. +	t = millicelsius_to_milli_kelvin(t);
  9167. +
  9168. +	return DIV_ROUND_CLOSEST(t, MILLIDEGREE_PER_DECIDEGREE);
  9169. +}
  9170. +
  9171. +static inline long kelvin_to_celsius(long t)
  9172. +{
  9173. +	return t + DIV_ROUND_CLOSEST(ABSOLUTE_ZERO_MILLICELSIUS,
  9174. +				     MILLIDEGREE_PER_DEGREE);
  9175. +}
  9176. +
  9177. +static inline long celsius_to_kelvin(long t)
  9178. +{
  9179. +	return t - DIV_ROUND_CLOSEST(ABSOLUTE_ZERO_MILLICELSIUS,
  9180. +				     MILLIDEGREE_PER_DEGREE);
  9181. +}
  9182. +
  9183. +#endif /* _LINUX_UNITS_H */
  9184. diff --git include/net/af_unix.h include/net/af_unix.h
  9185. index 7ec1cdb66be8..e514508bdc92 100644
  9186. --- linux-4.14.336/include/net/af_unix.h
  9187. +++ linux-4.14.336/include/net/af_unix.h
  9188. @@ -43,12 +43,6 @@ struct unix_skb_parms {
  9189.  
  9190.  #define UNIXCB(skb) 	(*(struct unix_skb_parms *)&((skb)->cb))
  9191.  
  9192. -#define unix_state_lock(s)	spin_lock(&unix_sk(s)->lock)
  9193. -#define unix_state_unlock(s)	spin_unlock(&unix_sk(s)->lock)
  9194. -#define unix_state_lock_nested(s) \
  9195. -				spin_lock_nested(&unix_sk(s)->lock, \
  9196. -				SINGLE_DEPTH_NESTING)
  9197. -
  9198.  /* The AF_UNIX socket */
  9199.  struct unix_sock {
  9200.  	/* WARNING: sk has to be the first member */
  9201. @@ -72,6 +66,20 @@ static inline struct unix_sock *unix_sk(const struct sock *sk)
  9202.  	return (struct unix_sock *)sk;
  9203.  }
  9204.  
  9205. +#define unix_state_lock(s)	spin_lock(&unix_sk(s)->lock)
  9206. +#define unix_state_unlock(s)	spin_unlock(&unix_sk(s)->lock)
  9207. +enum unix_socket_lock_class {
  9208. +	U_LOCK_NORMAL,
  9209. +	U_LOCK_SECOND,	/* for double locking, see unix_state_double_lock(). */
  9210. +	U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */
  9211. +};
  9212. +
  9213. +static inline void unix_state_lock_nested(struct sock *sk,
  9214. +				   enum unix_socket_lock_class subclass)
  9215. +{
  9216. +	spin_lock_nested(&unix_sk(sk)->lock, subclass);
  9217. +}
  9218. +
  9219.  #define peer_wait peer_wq.wait
  9220.  
  9221.  long unix_inq_len(struct sock *sk);
  9222. diff --git include/net/bluetooth/hci_core.h include/net/bluetooth/hci_core.h
  9223. index 8f899ad4a754..bac3d79139b2 100644
  9224. --- linux-4.14.336/include/net/bluetooth/hci_core.h
  9225. +++ linux-4.14.336/include/net/bluetooth/hci_core.h
  9226. @@ -647,7 +647,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);
  9227.  /* ----- HCI Connections ----- */
  9228.  enum {
  9229.  	HCI_CONN_AUTH_PEND,
  9230. -	HCI_CONN_REAUTH_PEND,
  9231.  	HCI_CONN_ENCRYPT_PEND,
  9232.  	HCI_CONN_RSWITCH_PEND,
  9233.  	HCI_CONN_MODE_CHANGE_PEND,
  9234. diff --git include/net/dst_ops.h include/net/dst_ops.h
  9235. index 443863c7b8da..632086b2f644 100644
  9236. --- linux-4.14.336/include/net/dst_ops.h
  9237. +++ linux-4.14.336/include/net/dst_ops.h
  9238. @@ -16,7 +16,7 @@ struct dst_ops {
  9239.  	unsigned short		family;
  9240.  	unsigned int		gc_thresh;
  9241.  
  9242. -	int			(*gc)(struct dst_ops *ops);
  9243. +	void			(*gc)(struct dst_ops *ops);
  9244.  	struct dst_entry *	(*check)(struct dst_entry *, __u32 cookie);
  9245.  	unsigned int		(*default_advmss)(const struct dst_entry *);
  9246.  	unsigned int		(*mtu)(const struct dst_entry *);
  9247. @@ -53,9 +53,11 @@ static inline int dst_entries_get_slow(struct dst_ops *dst)
  9248.  	return percpu_counter_sum_positive(&dst->pcpuc_entries);
  9249.  }
  9250.  
  9251. +#define DST_PERCPU_COUNTER_BATCH 32
  9252.  static inline void dst_entries_add(struct dst_ops *dst, int val)
  9253.  {
  9254. -	percpu_counter_add(&dst->pcpuc_entries, val);
  9255. +	percpu_counter_add_batch(&dst->pcpuc_entries, val,
  9256. +				 DST_PERCPU_COUNTER_BATCH);
  9257.  }
  9258.  
  9259.  static inline int dst_entries_init(struct dst_ops *dst)
  9260. diff --git include/net/llc_pdu.h include/net/llc_pdu.h
  9261. index 49aa79c7b278..581cd37aa98b 100644
  9262. --- linux-4.14.336/include/net/llc_pdu.h
  9263. +++ linux-4.14.336/include/net/llc_pdu.h
  9264. @@ -262,8 +262,7 @@ static inline void llc_pdu_header_init(struct sk_buff *skb, u8 type,
  9265.   */
  9266.  static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
  9267.  {
  9268. -	if (skb->protocol == htons(ETH_P_802_2))
  9269. -		memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
  9270. +	memcpy(sa, eth_hdr(skb)->h_source, ETH_ALEN);
  9271.  }
  9272.  
  9273.  /**
  9274. @@ -275,8 +274,7 @@ static inline void llc_pdu_decode_sa(struct sk_buff *skb, u8 *sa)
  9275.   */
  9276.  static inline void llc_pdu_decode_da(struct sk_buff *skb, u8 *da)
  9277.  {
  9278. -	if (skb->protocol == htons(ETH_P_802_2))
  9279. -		memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
  9280. +	memcpy(da, eth_hdr(skb)->h_dest, ETH_ALEN);
  9281.  }
  9282.  
  9283.  /**
  9284. diff --git include/net/netns/ipv6.h include/net/netns/ipv6.h
  9285. index c004d051c2d3..290ca18589ee 100644
  9286. --- linux-4.14.336/include/net/netns/ipv6.h
  9287. +++ linux-4.14.336/include/net/netns/ipv6.h
  9288. @@ -64,8 +64,8 @@ struct netns_ipv6 {
  9289.  	struct dst_ops		ip6_dst_ops;
  9290.  	rwlock_t		fib6_walker_lock;
  9291.  	spinlock_t		fib6_gc_lock;
  9292. -	unsigned int		 ip6_rt_gc_expire;
  9293. -	unsigned long		 ip6_rt_last_gc;
  9294. +	atomic_t		ip6_rt_gc_expire;
  9295. +	unsigned long		ip6_rt_last_gc;
  9296.  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  9297.  	bool			 fib6_has_custom_rules;
  9298.  	struct rt6_info         *ip6_prohibit_entry;
  9299. diff --git include/uapi/linux/btrfs.h include/uapi/linux/btrfs.h
  9300. index 86d2a52b4665..ee7a34c237a5 100644
  9301. --- linux-4.14.336/include/uapi/linux/btrfs.h
  9302. +++ linux-4.14.336/include/uapi/linux/btrfs.h
  9303. @@ -522,6 +522,9 @@ struct btrfs_ioctl_clone_range_args {
  9304.   */
  9305.  #define BTRFS_DEFRAG_RANGE_COMPRESS 1
  9306.  #define BTRFS_DEFRAG_RANGE_START_IO 2
  9307. +#define BTRFS_DEFRAG_RANGE_FLAGS_SUPP	(BTRFS_DEFRAG_RANGE_COMPRESS |		\
  9308. +					 BTRFS_DEFRAG_RANGE_START_IO)
  9309. +
  9310.  struct btrfs_ioctl_defrag_range_args {
  9311.  	/* start of the defrag operation */
  9312.  	__u64 start;
  9313. diff --git include/uapi/linux/netfilter/nf_tables.h include/uapi/linux/netfilter/nf_tables.h
  9314. index c7bb18ea4962..835e9f345f35 100644
  9315. --- linux-4.14.336/include/uapi/linux/netfilter/nf_tables.h
  9316. +++ linux-4.14.336/include/uapi/linux/netfilter/nf_tables.h
  9317. @@ -229,9 +229,11 @@ enum nft_rule_attributes {
  9318.  /**
  9319.   * enum nft_rule_compat_flags - nf_tables rule compat flags
  9320.   *
  9321. + * @NFT_RULE_COMPAT_F_UNUSED: unused
  9322.   * @NFT_RULE_COMPAT_F_INV: invert the check result
  9323.   */
  9324.  enum nft_rule_compat_flags {
  9325. +	NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
  9326.  	NFT_RULE_COMPAT_F_INV	= (1 << 1),
  9327.  	NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,
  9328.  };
  9329. diff --git kernel/audit.c kernel/audit.c
  9330. index b694a265533f..819bdf0b6e5f 100644
  9331. --- linux-4.14.336/kernel/audit.c
  9332. +++ linux-4.14.336/kernel/audit.c
  9333. @@ -458,15 +458,19 @@ static int audit_set_failure(u32 state)
  9334.   * @pid: auditd PID
  9335.   * @portid: auditd netlink portid
  9336.   * @net: auditd network namespace pointer
  9337. + * @skb: the netlink command from the audit daemon
  9338. + * @ack: netlink ack flag, cleared if ack'd here
  9339.   *
  9340.   * Description:
  9341.   * This function will obtain and drop network namespace references as
  9342.   * necessary.  Returns zero on success, negative values on failure.
  9343.   */
  9344. -static int auditd_set(struct pid *pid, u32 portid, struct net *net)
  9345. +static int auditd_set(struct pid *pid, u32 portid, struct net *net,
  9346. +		      struct sk_buff *skb, bool *ack)
  9347.  {
  9348.  	unsigned long flags;
  9349.  	struct auditd_connection *ac_old, *ac_new;
  9350. +	struct nlmsghdr *nlh;
  9351.  
  9352.  	if (!pid || !net)
  9353.  		return -EINVAL;
  9354. @@ -478,6 +482,13 @@ static int auditd_set(struct pid *pid, u32 portid, struct net *net)
  9355.  	ac_new->portid = portid;
  9356.  	ac_new->net = get_net(net);
  9357.  
  9358. +	/* send the ack now to avoid a race with the queue backlog */
  9359. +	if (*ack) {
  9360. +		nlh = nlmsg_hdr(skb);
  9361. +		netlink_ack(skb, nlh, 0, NULL);
  9362. +		*ack = false;
  9363. +	}
  9364. +
  9365.  	spin_lock_irqsave(&auditd_conn_lock, flags);
  9366.  	ac_old = rcu_dereference_protected(auditd_conn,
  9367.  					   lockdep_is_held(&auditd_conn_lock));
  9368. @@ -1165,7 +1176,8 @@ static int audit_replace(struct pid *pid)
  9369.  	return auditd_send_unicast_skb(skb);
  9370.  }
  9371.  
  9372. -static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  9373. +static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
  9374. +			     bool *ack)
  9375.  {
  9376.  	u32			seq;
  9377.  	void			*data;
  9378. @@ -1257,7 +1269,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  9379.  				/* register a new auditd connection */
  9380.  				err = auditd_set(req_pid,
  9381.  						 NETLINK_CB(skb).portid,
  9382. -						 sock_net(NETLINK_CB(skb).sk));
  9383. +						 sock_net(NETLINK_CB(skb).sk),
  9384. +						 skb, ack);
  9385.  				if (audit_enabled != AUDIT_OFF)
  9386.  					audit_log_config_change("audit_pid",
  9387.  								new_pid,
  9388. @@ -1490,9 +1503,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  9389.   * Parse the provided skb and deal with any messages that may be present,
  9390.   * malformed skbs are discarded.
  9391.   */
  9392. -static void audit_receive(struct sk_buff  *skb)
  9393. +static void audit_receive(struct sk_buff *skb)
  9394.  {
  9395.  	struct nlmsghdr *nlh;
  9396. +	bool ack;
  9397.  	/*
  9398.  	 * len MUST be signed for nlmsg_next to be able to dec it below 0
  9399.  	 * if the nlmsg_len was not aligned
  9400. @@ -1505,9 +1519,12 @@ static void audit_receive(struct sk_buff  *skb)
  9401.  
  9402.  	mutex_lock(&audit_cmd_mutex);
  9403.  	while (nlmsg_ok(nlh, len)) {
  9404. -		err = audit_receive_msg(skb, nlh);
  9405. -		/* if err or if this message says it wants a response */
  9406. -		if (err || (nlh->nlmsg_flags & NLM_F_ACK))
  9407. +		ack = nlh->nlmsg_flags & NLM_F_ACK;
  9408. +		err = audit_receive_msg(skb, nlh, &ack);
  9409. +
  9410. +		/* send an ack if the user asked for one and audit_receive_msg
  9411. +		 * didn't already do it, or if there was an error. */
  9412. +		if (ack || err)
  9413.  			netlink_ack(skb, nlh, err, NULL);
  9414.  
  9415.  		nlh = nlmsg_next(nlh, &len);
  9416. diff --git kernel/bpf/arraymap.c kernel/bpf/arraymap.c
  9417. index a8f55ea4146b..3291c856cea9 100644
  9418. --- linux-4.14.336/kernel/bpf/arraymap.c
  9419. +++ linux-4.14.336/kernel/bpf/arraymap.c
  9420. @@ -416,7 +416,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
  9421.  
  9422.  	old_ptr = xchg(array->ptrs + index, new_ptr);
  9423.  	if (old_ptr)
  9424. -		map->ops->map_fd_put_ptr(old_ptr);
  9425. +		map->ops->map_fd_put_ptr(map, old_ptr, true);
  9426.  
  9427.  	return 0;
  9428.  }
  9429. @@ -432,7 +432,7 @@ static int fd_array_map_delete_elem(struct bpf_map *map, void *key)
  9430.  
  9431.  	old_ptr = xchg(array->ptrs + index, NULL);
  9432.  	if (old_ptr) {
  9433. -		map->ops->map_fd_put_ptr(old_ptr);
  9434. +		map->ops->map_fd_put_ptr(map, old_ptr, true);
  9435.  		return 0;
  9436.  	} else {
  9437.  		return -ENOENT;
  9438. @@ -456,8 +456,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
  9439.  	return prog;
  9440.  }
  9441.  
  9442. -static void prog_fd_array_put_ptr(void *ptr)
  9443. +static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
  9444.  {
  9445. +	/* bpf_prog is freed after one RCU or tasks trace grace period */
  9446.  	bpf_prog_put(ptr);
  9447.  }
  9448.  
  9449. @@ -543,8 +544,9 @@ err_out:
  9450.  	return ee;
  9451.  }
  9452.  
  9453. -static void perf_event_fd_array_put_ptr(void *ptr)
  9454. +static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
  9455.  {
  9456. +	/* bpf_perf_event is freed after one RCU grace period */
  9457.  	bpf_event_entry_free_rcu(ptr);
  9458.  }
  9459.  
  9460. @@ -583,7 +585,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map,
  9461.  	return cgroup_get_from_fd(fd);
  9462.  }
  9463.  
  9464. -static void cgroup_fd_array_put_ptr(void *ptr)
  9465. +static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
  9466.  {
  9467.  	/* cgroup_put free cgrp after a rcu grace period */
  9468.  	cgroup_put(ptr);
  9469. diff --git kernel/bpf/hashtab.c kernel/bpf/hashtab.c
  9470. index ecc58137525b..db2c3e019daf 100644
  9471. --- linux-4.14.336/kernel/bpf/hashtab.c
  9472. +++ linux-4.14.336/kernel/bpf/hashtab.c
  9473. @@ -655,7 +655,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
  9474.  
  9475.  	if (map->ops->map_fd_put_ptr) {
  9476.  		ptr = fd_htab_map_get_ptr(map, l);
  9477. -		map->ops->map_fd_put_ptr(ptr);
  9478. +		map->ops->map_fd_put_ptr(map, ptr, true);
  9479.  	}
  9480.  }
  9481.  
  9482. @@ -1288,7 +1288,7 @@ static void fd_htab_map_free(struct bpf_map *map)
  9483.  		hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
  9484.  			void *ptr = fd_htab_map_get_ptr(map, l);
  9485.  
  9486. -			map->ops->map_fd_put_ptr(ptr);
  9487. +			map->ops->map_fd_put_ptr(map, ptr, false);
  9488.  		}
  9489.  	}
  9490.  
  9491. @@ -1329,7 +1329,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
  9492.  
  9493.  	ret = htab_map_update_elem(map, key, &ptr, map_flags);
  9494.  	if (ret)
  9495. -		map->ops->map_fd_put_ptr(ptr);
  9496. +		map->ops->map_fd_put_ptr(map, ptr, false);
  9497.  
  9498.  	return ret;
  9499.  }
  9500. diff --git kernel/bpf/lpm_trie.c kernel/bpf/lpm_trie.c
  9501. index c28c584b734e..ef324c9c1eca 100644
  9502. --- linux-4.14.336/kernel/bpf/lpm_trie.c
  9503. +++ linux-4.14.336/kernel/bpf/lpm_trie.c
  9504. @@ -192,6 +192,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)
  9505.  	struct lpm_trie_node *node, *found = NULL;
  9506.  	struct bpf_lpm_trie_key *key = _key;
  9507.  
  9508. +	if (key->prefixlen > trie->max_prefixlen)
  9509. +		return NULL;
  9510. +
  9511.  	/* Start walking the trie from the root node ... */
  9512.  
  9513.  	for (node = rcu_dereference(trie->root); node;) {
  9514. diff --git kernel/bpf/map_in_map.c kernel/bpf/map_in_map.c
  9515. index c0c494b7647b..1878aace6a5c 100644
  9516. --- linux-4.14.336/kernel/bpf/map_in_map.c
  9517. +++ linux-4.14.336/kernel/bpf/map_in_map.c
  9518. @@ -101,7 +101,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
  9519.  	return inner_map;
  9520.  }
  9521.  
  9522. -void bpf_map_fd_put_ptr(void *ptr)
  9523. +void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
  9524.  {
  9525.  	/* ptr->ops->map_free() has to go through one
  9526.  	 * rcu grace period by itself.
  9527. diff --git kernel/bpf/map_in_map.h kernel/bpf/map_in_map.h
  9528. index 6183db9ec08c..1e652a7bf60e 100644
  9529. --- linux-4.14.336/kernel/bpf/map_in_map.h
  9530. +++ linux-4.14.336/kernel/bpf/map_in_map.h
  9531. @@ -18,7 +18,7 @@ bool bpf_map_meta_equal(const struct bpf_map *meta0,
  9532.  			const struct bpf_map *meta1);
  9533.  void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file,
  9534.  			 int ufd);
  9535. -void bpf_map_fd_put_ptr(void *ptr);
  9536. +void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer);
  9537.  u32 bpf_map_fd_sys_lookup_elem(void *ptr);
  9538.  
  9539.  #endif
  9540. diff --git kernel/debug/kdb/kdb_main.c kernel/debug/kdb/kdb_main.c
  9541. index 15d902daeef6..01a4312ede49 100644
  9542. --- linux-4.14.336/kernel/debug/kdb/kdb_main.c
  9543. +++ linux-4.14.336/kernel/debug/kdb/kdb_main.c
  9544. @@ -399,6 +399,13 @@ int kdb_set(int argc, const char **argv)
  9545.  	if (argc != 2)
  9546.  		return KDB_ARGCOUNT;
  9547.  
  9548. +	/*
  9549. +	 * Censor sensitive variables
  9550. +	 */
  9551. +	if (strcmp(argv[1], "PROMPT") == 0 &&
  9552. +	    !kdb_check_flags(KDB_ENABLE_MEM_READ, kdb_cmd_enabled, false))
  9553. +		return KDB_NOPERM;
  9554. +
  9555.  	/*
  9556.  	 * Check for internal variables
  9557.  	 */
  9558. @@ -1289,14 +1296,9 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
  9559.  		*(cmd_hist[cmd_head]) = '\0';
  9560.  
  9561.  do_full_getstr:
  9562. -#if defined(CONFIG_SMP)
  9563. +		/* PROMPT can only be set if we have MEM_READ permission. */
  9564.  		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
  9565.  			 raw_smp_processor_id());
  9566. -#else
  9567. -		snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"));
  9568. -#endif
  9569. -		if (defcmd_in_progress)
  9570. -			strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
  9571.  
  9572.  		/*
  9573.  		 * Fetch command from keyboard
  9574. diff --git kernel/power/swap.c kernel/power/swap.c
  9575. index 8b37085a6690..b62a56de91d6 100644
  9576. --- linux-4.14.336/kernel/power/swap.c
  9577. +++ linux-4.14.336/kernel/power/swap.c
  9578. @@ -595,11 +595,11 @@ static int crc32_threadfn(void *data)
  9579.  	unsigned i;
  9580.  
  9581.  	while (1) {
  9582. -		wait_event(d->go, atomic_read(&d->ready) ||
  9583. +		wait_event(d->go, atomic_read_acquire(&d->ready) ||
  9584.  		                  kthread_should_stop());
  9585.  		if (kthread_should_stop()) {
  9586.  			d->thr = NULL;
  9587. -			atomic_set(&d->stop, 1);
  9588. +			atomic_set_release(&d->stop, 1);
  9589.  			wake_up(&d->done);
  9590.  			break;
  9591.  		}
  9592. @@ -608,7 +608,7 @@ static int crc32_threadfn(void *data)
  9593.  		for (i = 0; i < d->run_threads; i++)
  9594.  			*d->crc32 = crc32_le(*d->crc32,
  9595.  			                     d->unc[i], *d->unc_len[i]);
  9596. -		atomic_set(&d->stop, 1);
  9597. +		atomic_set_release(&d->stop, 1);
  9598.  		wake_up(&d->done);
  9599.  	}
  9600.  	return 0;
  9601. @@ -638,12 +638,12 @@ static int lzo_compress_threadfn(void *data)
  9602.  	struct cmp_data *d = data;
  9603.  
  9604.  	while (1) {
  9605. -		wait_event(d->go, atomic_read(&d->ready) ||
  9606. +		wait_event(d->go, atomic_read_acquire(&d->ready) ||
  9607.  		                  kthread_should_stop());
  9608.  		if (kthread_should_stop()) {
  9609.  			d->thr = NULL;
  9610.  			d->ret = -1;
  9611. -			atomic_set(&d->stop, 1);
  9612. +			atomic_set_release(&d->stop, 1);
  9613.  			wake_up(&d->done);
  9614.  			break;
  9615.  		}
  9616. @@ -652,7 +652,7 @@ static int lzo_compress_threadfn(void *data)
  9617.  		d->ret = lzo1x_1_compress(d->unc, d->unc_len,
  9618.  		                          d->cmp + LZO_HEADER, &d->cmp_len,
  9619.  		                          d->wrk);
  9620. -		atomic_set(&d->stop, 1);
  9621. +		atomic_set_release(&d->stop, 1);
  9622.  		wake_up(&d->done);
  9623.  	}
  9624.  	return 0;
  9625. @@ -794,7 +794,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
  9626.  
  9627.  			data[thr].unc_len = off;
  9628.  
  9629. -			atomic_set(&data[thr].ready, 1);
  9630. +			atomic_set_release(&data[thr].ready, 1);
  9631.  			wake_up(&data[thr].go);
  9632.  		}
  9633.  
  9634. @@ -802,12 +802,12 @@ static int save_image_lzo(struct swap_map_handle *handle,
  9635.  			break;
  9636.  
  9637.  		crc->run_threads = thr;
  9638. -		atomic_set(&crc->ready, 1);
  9639. +		atomic_set_release(&crc->ready, 1);
  9640.  		wake_up(&crc->go);
  9641.  
  9642.  		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
  9643.  			wait_event(data[thr].done,
  9644. -			           atomic_read(&data[thr].stop));
  9645. +				atomic_read_acquire(&data[thr].stop));
  9646.  			atomic_set(&data[thr].stop, 0);
  9647.  
  9648.  			ret = data[thr].ret;
  9649. @@ -847,7 +847,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
  9650.  			}
  9651.  		}
  9652.  
  9653. -		wait_event(crc->done, atomic_read(&crc->stop));
  9654. +		wait_event(crc->done, atomic_read_acquire(&crc->stop));
  9655.  		atomic_set(&crc->stop, 0);
  9656.  	}
  9657.  
  9658. @@ -1129,12 +1129,12 @@ static int lzo_decompress_threadfn(void *data)
  9659.  	struct dec_data *d = data;
  9660.  
  9661.  	while (1) {
  9662. -		wait_event(d->go, atomic_read(&d->ready) ||
  9663. +		wait_event(d->go, atomic_read_acquire(&d->ready) ||
  9664.  		                  kthread_should_stop());
  9665.  		if (kthread_should_stop()) {
  9666.  			d->thr = NULL;
  9667.  			d->ret = -1;
  9668. -			atomic_set(&d->stop, 1);
  9669. +			atomic_set_release(&d->stop, 1);
  9670.  			wake_up(&d->done);
  9671.  			break;
  9672.  		}
  9673. @@ -1147,7 +1147,7 @@ static int lzo_decompress_threadfn(void *data)
  9674.  			flush_icache_range((unsigned long)d->unc,
  9675.  					   (unsigned long)d->unc + d->unc_len);
  9676.  
  9677. -		atomic_set(&d->stop, 1);
  9678. +		atomic_set_release(&d->stop, 1);
  9679.  		wake_up(&d->done);
  9680.  	}
  9681.  	return 0;
  9682. @@ -1338,7 +1338,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
  9683.  		}
  9684.  
  9685.  		if (crc->run_threads) {
  9686. -			wait_event(crc->done, atomic_read(&crc->stop));
  9687. +			wait_event(crc->done, atomic_read_acquire(&crc->stop));
  9688.  			atomic_set(&crc->stop, 0);
  9689.  			crc->run_threads = 0;
  9690.  		}
  9691. @@ -1375,7 +1375,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
  9692.  					pg = 0;
  9693.  			}
  9694.  
  9695. -			atomic_set(&data[thr].ready, 1);
  9696. +			atomic_set_release(&data[thr].ready, 1);
  9697.  			wake_up(&data[thr].go);
  9698.  		}
  9699.  
  9700. @@ -1394,7 +1394,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
  9701.  
  9702.  		for (run_threads = thr, thr = 0; thr < run_threads; thr++) {
  9703.  			wait_event(data[thr].done,
  9704. -			           atomic_read(&data[thr].stop));
  9705. +				atomic_read_acquire(&data[thr].stop));
  9706.  			atomic_set(&data[thr].stop, 0);
  9707.  
  9708.  			ret = data[thr].ret;
  9709. @@ -1429,7 +1429,7 @@ static int load_image_lzo(struct swap_map_handle *handle,
  9710.  				ret = snapshot_write_next(snapshot);
  9711.  				if (ret <= 0) {
  9712.  					crc->run_threads = thr + 1;
  9713. -					atomic_set(&crc->ready, 1);
  9714. +					atomic_set_release(&crc->ready, 1);
  9715.  					wake_up(&crc->go);
  9716.  					goto out_finish;
  9717.  				}
  9718. @@ -1437,13 +1437,13 @@ static int load_image_lzo(struct swap_map_handle *handle,
  9719.  		}
  9720.  
  9721.  		crc->run_threads = thr;
  9722. -		atomic_set(&crc->ready, 1);
  9723. +		atomic_set_release(&crc->ready, 1);
  9724.  		wake_up(&crc->go);
  9725.  	}
  9726.  
  9727.  out_finish:
  9728.  	if (crc->run_threads) {
  9729. -		wait_event(crc->done, atomic_read(&crc->stop));
  9730. +		wait_event(crc->done, atomic_read_acquire(&crc->stop));
  9731.  		atomic_set(&crc->stop, 0);
  9732.  	}
  9733.  	stop = ktime_get();
  9734. diff --git kernel/sched/membarrier.c kernel/sched/membarrier.c
  9735. index 9bcbacba82a8..d936a130814e 100644
  9736. --- linux-4.14.336/kernel/sched/membarrier.c
  9737. +++ linux-4.14.336/kernel/sched/membarrier.c
  9738. @@ -30,6 +30,8 @@
  9739.  	(MEMBARRIER_CMD_SHARED | MEMBARRIER_CMD_PRIVATE_EXPEDITED	\
  9740.  	| MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED)
  9741.  
  9742. +static DEFINE_MUTEX(membarrier_ipi_mutex);
  9743. +
  9744.  static void ipi_mb(void *info)
  9745.  {
  9746.  	smp_mb();	/* IPIs should be serializing but paranoid. */
  9747. @@ -64,6 +66,7 @@ static int membarrier_private_expedited(void)
  9748.  		fallback = true;
  9749.  	}
  9750.  
  9751. +	mutex_lock(&membarrier_ipi_mutex);
  9752.  	cpus_read_lock();
  9753.  	for_each_online_cpu(cpu) {
  9754.  		struct task_struct *p;
  9755. @@ -102,6 +105,7 @@ static int membarrier_private_expedited(void)
  9756.  	 * rq->curr modification in scheduler.
  9757.  	 */
  9758.  	smp_mb();	/* exit from system call is not a mb */
  9759. +	mutex_unlock(&membarrier_ipi_mutex);
  9760.  	return 0;
  9761.  }
  9762.  
  9763. diff --git kernel/sched/rt.c kernel/sched/rt.c
  9764. index c093bb0f52eb..85cc7ab4f38d 100644
  9765. --- linux-4.14.336/kernel/sched/rt.c
  9766. +++ linux-4.14.336/kernel/sched/rt.c
  9767. @@ -10,7 +10,7 @@
  9768.  #include <linux/irq_work.h>
  9769.  
  9770.  int sched_rr_timeslice = RR_TIMESLICE;
  9771. -int sysctl_sched_rr_timeslice = (MSEC_PER_SEC / HZ) * RR_TIMESLICE;
  9772. +int sysctl_sched_rr_timeslice = (MSEC_PER_SEC * RR_TIMESLICE) / HZ;
  9773.  
  9774.  static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun);
  9775.  
  9776. @@ -2626,9 +2626,6 @@ static int sched_rt_global_constraints(void)
  9777.  
  9778.  static int sched_rt_global_validate(void)
  9779.  {
  9780. -	if (sysctl_sched_rt_period <= 0)
  9781. -		return -EINVAL;
  9782. -
  9783.  	if ((sysctl_sched_rt_runtime != RUNTIME_INF) &&
  9784.  		(sysctl_sched_rt_runtime > sysctl_sched_rt_period))
  9785.  		return -EINVAL;
  9786. @@ -2658,7 +2655,7 @@ int sched_rt_handler(struct ctl_table *table, int write,
  9787.  	old_period = sysctl_sched_rt_period;
  9788.  	old_runtime = sysctl_sched_rt_runtime;
  9789.  
  9790. -	ret = proc_dointvec(table, write, buffer, lenp, ppos);
  9791. +	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
  9792.  
  9793.  	if (!ret && write) {
  9794.  		ret = sched_rt_global_validate();
  9795. @@ -2703,6 +2700,9 @@ int sched_rr_handler(struct ctl_table *table, int write,
  9796.  		sched_rr_timeslice =
  9797.  			sysctl_sched_rr_timeslice <= 0 ? RR_TIMESLICE :
  9798.  			msecs_to_jiffies(sysctl_sched_rr_timeslice);
  9799. +
  9800. +		if (sysctl_sched_rr_timeslice <= 0)
  9801. +			sysctl_sched_rr_timeslice = jiffies_to_msecs(RR_TIMESLICE);
  9802.  	}
  9803.  	mutex_unlock(&mutex);
  9804.  	return ret;
  9805. diff --git kernel/sysctl.c kernel/sysctl.c
  9806. index de4a197570b1..5bee2eb28ff6 100644
  9807. --- linux-4.14.336/kernel/sysctl.c
  9808. +++ linux-4.14.336/kernel/sysctl.c
  9809. @@ -124,6 +124,7 @@ static int zero;
  9810.  static int __maybe_unused one = 1;
  9811.  static int __maybe_unused two = 2;
  9812.  static int __maybe_unused four = 4;
  9813. +static int int_max = INT_MAX;
  9814.  static unsigned long zero_ul;
  9815.  static unsigned long one_ul = 1;
  9816.  static unsigned long long_max = LONG_MAX;
  9817. @@ -460,6 +461,8 @@ static struct ctl_table kern_table[] = {
  9818.  		.maxlen		= sizeof(unsigned int),
  9819.  		.mode		= 0644,
  9820.  		.proc_handler	= sched_rt_handler,
  9821. +		.extra1		= &one,
  9822. +		.extra2		= &int_max,
  9823.  	},
  9824.  	{
  9825.  		.procname	= "sched_rt_runtime_us",
  9826. @@ -467,6 +470,8 @@ static struct ctl_table kern_table[] = {
  9827.  		.maxlen		= sizeof(int),
  9828.  		.mode		= 0644,
  9829.  		.proc_handler	= sched_rt_handler,
  9830. +		.extra1		= &neg_one,
  9831. +		.extra2		= &int_max,
  9832.  	},
  9833.  	{
  9834.  		.procname	= "sched_rr_timeslice_ms",
  9835. diff --git kernel/time/tick-sched.c kernel/time/tick-sched.c
  9836. index 3c7b400512eb..387de1b6dd93 100644
  9837. --- linux-4.14.336/kernel/time/tick-sched.c
  9838. +++ linux-4.14.336/kernel/time/tick-sched.c
  9839. @@ -1278,13 +1278,23 @@ void tick_setup_sched_timer(void)
  9840.  void tick_cancel_sched_timer(int cpu)
  9841.  {
  9842.  	struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
  9843. +	ktime_t idle_sleeptime, iowait_sleeptime;
  9844. +	unsigned long idle_calls, idle_sleeps;
  9845.  
  9846.  # ifdef CONFIG_HIGH_RES_TIMERS
  9847.  	if (ts->sched_timer.base)
  9848.  		hrtimer_cancel(&ts->sched_timer);
  9849.  # endif
  9850.  
  9851. +	idle_sleeptime = ts->idle_sleeptime;
  9852. +	iowait_sleeptime = ts->iowait_sleeptime;
  9853. +	idle_calls = ts->idle_calls;
  9854. +	idle_sleeps = ts->idle_sleeps;
  9855.  	memset(ts, 0, sizeof(*ts));
  9856. +	ts->idle_sleeptime = idle_sleeptime;
  9857. +	ts->iowait_sleeptime = iowait_sleeptime;
  9858. +	ts->idle_calls = idle_calls;
  9859. +	ts->idle_sleeps = idle_sleeps;
  9860.  }
  9861.  #endif
  9862.  
  9863. diff --git kernel/trace/ring_buffer.c kernel/trace/ring_buffer.c
  9864. index 3fc09d765f2a..8c09e8ca1561 100644
  9865. --- linux-4.14.336/kernel/trace/ring_buffer.c
  9866. +++ linux-4.14.336/kernel/trace/ring_buffer.c
  9867. @@ -2776,6 +2776,12 @@ rb_reserve_next_event(struct ring_buffer *buffer,
  9868.  	int nr_loops = 0;
  9869.  	u64 diff;
  9870.  
  9871. +	/* ring buffer does cmpxchg, make sure it is safe in NMI context */
  9872. +	if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) &&
  9873. +	    (unlikely(in_nmi()))) {
  9874. +		return NULL;
  9875. +	}
  9876. +
  9877.  	rb_start_commit(cpu_buffer);
  9878.  
  9879.  #ifdef CONFIG_RING_BUFFER_ALLOW_SWAP
  9880. diff --git kernel/trace/trace.c kernel/trace/trace.c
  9881. index c5fe020336be..755d6146c738 100644
  9882. --- linux-4.14.336/kernel/trace/trace.c
  9883. +++ linux-4.14.336/kernel/trace/trace.c
  9884. @@ -3826,7 +3826,11 @@ static int s_show(struct seq_file *m, void *v)
  9885.  		iter->leftover = ret;
  9886.  
  9887.  	} else {
  9888. -		print_trace_line(iter);
  9889. +		ret = print_trace_line(iter);
  9890. +		if (ret == TRACE_TYPE_PARTIAL_LINE) {
  9891. +			iter->seq.full = 0;
  9892. +			trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
  9893. +		}
  9894.  		ret = trace_print_seq(m, &iter->seq);
  9895.  		/*
  9896.  		 * If we overflow the seq_file buffer, then it will
  9897. diff --git kernel/trace/trace_events_trigger.c kernel/trace/trace_events_trigger.c
  9898. index 40c1a2dd48f0..871ea0fa78bb 100644
  9899. --- linux-4.14.336/kernel/trace/trace_events_trigger.c
  9900. +++ linux-4.14.336/kernel/trace/trace_events_trigger.c
  9901. @@ -1127,8 +1127,10 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops,
  9902.  			  struct event_trigger_data *data,
  9903.  			  struct trace_event_file *file)
  9904.  {
  9905. -	if (tracing_alloc_snapshot_instance(file->tr) != 0)
  9906. -		return 0;
  9907. +	int ret = tracing_alloc_snapshot_instance(file->tr);
  9908. +
  9909. +	if (ret < 0)
  9910. +		return ret;
  9911.  
  9912.  	return register_trigger(glob, ops, data, file);
  9913.  }
  9914. diff --git kernel/trace/trace_output.c kernel/trace/trace_output.c
  9915. index e3ab66e6fd85..3ca9ddfef2b8 100644
  9916. --- linux-4.14.336/kernel/trace/trace_output.c
  9917. +++ linux-4.14.336/kernel/trace/trace_output.c
  9918. @@ -1319,11 +1319,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter,
  9919.  {
  9920.  	struct print_entry *field;
  9921.  	struct trace_seq *s = &iter->seq;
  9922. +	int max = iter->ent_size - offsetof(struct print_entry, buf);
  9923.  
  9924.  	trace_assign_type(field, iter->ent);
  9925.  
  9926.  	seq_print_ip_sym(s, field->ip, flags);
  9927. -	trace_seq_printf(s, ": %s", field->buf);
  9928. +	trace_seq_printf(s, ": %.*s", max, field->buf);
  9929.  
  9930.  	return trace_handle_return(s);
  9931.  }
  9932. @@ -1332,10 +1333,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags,
  9933.  					 struct trace_event *event)
  9934.  {
  9935.  	struct print_entry *field;
  9936. +	int max = iter->ent_size - offsetof(struct print_entry, buf);
  9937.  
  9938.  	trace_assign_type(field, iter->ent);
  9939.  
  9940. -	trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf);
  9941. +	trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf);
  9942.  
  9943.  	return trace_handle_return(&iter->seq);
  9944.  }
  9945. diff --git mm/memcontrol.c mm/memcontrol.c
  9946. index 22d13c98e274..e6a351e69ac3 100644
  9947. --- linux-4.14.336/mm/memcontrol.c
  9948. +++ linux-4.14.336/mm/memcontrol.c
  9949. @@ -1747,6 +1747,9 @@ static void drain_stock(struct memcg_stock_pcp *stock)
  9950.  {
  9951.  	struct mem_cgroup *old = stock->cached;
  9952.  
  9953. +	if (!old)
  9954. +		return;
  9955. +
  9956.  	if (stock->nr_pages) {
  9957.  		page_counter_uncharge(&old->memory, stock->nr_pages);
  9958.  		if (do_memsw_account())
  9959. @@ -1754,6 +1757,8 @@ static void drain_stock(struct memcg_stock_pcp *stock)
  9960.  		css_put_many(&old->css, stock->nr_pages);
  9961.  		stock->nr_pages = 0;
  9962.  	}
  9963. +
  9964. +	css_put(&old->css);
  9965.  	stock->cached = NULL;
  9966.  }
  9967.  
  9968. @@ -1789,6 +1794,7 @@ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
  9969.  	stock = this_cpu_ptr(&memcg_stock);
  9970.  	if (stock->cached != memcg) { /* reset if necessary */
  9971.  		drain_stock(stock);
  9972. +		css_get(&memcg->css);
  9973.  		stock->cached = memcg;
  9974.  	}
  9975.  	stock->nr_pages += nr_pages;
  9976. @@ -1820,21 +1826,22 @@ static void drain_all_stock(struct mem_cgroup *root_memcg)
  9977.  	for_each_online_cpu(cpu) {
  9978.  		struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu);
  9979.  		struct mem_cgroup *memcg;
  9980. +		bool flush = false;
  9981.  
  9982. +		rcu_read_lock();
  9983.  		memcg = stock->cached;
  9984. -		if (!memcg || !stock->nr_pages || !css_tryget(&memcg->css))
  9985. -			continue;
  9986. -		if (!mem_cgroup_is_descendant(memcg, root_memcg)) {
  9987. -			css_put(&memcg->css);
  9988. -			continue;
  9989. -		}
  9990. -		if (!test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) {
  9991. +		if (memcg && stock->nr_pages &&
  9992. +		    mem_cgroup_is_descendant(memcg, root_memcg))
  9993. +			flush = true;
  9994. +		rcu_read_unlock();
  9995. +
  9996. +		if (flush &&
  9997. +		    !test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) {
  9998.  			if (cpu == curcpu)
  9999.  				drain_local_stock(&stock->work);
  10000.  			else
  10001.  				schedule_work_on(cpu, &stock->work);
  10002.  		}
  10003. -		css_put(&memcg->css);
  10004.  	}
  10005.  	put_cpu();
  10006.  	mutex_unlock(&percpu_charge_mutex);
  10007. diff --git mm/memory-failure.c mm/memory-failure.c
  10008. index e7827b9e6397..e179ffa15026 100644
  10009. --- linux-4.14.336/mm/memory-failure.c
  10010. +++ linux-4.14.336/mm/memory-failure.c
  10011. @@ -952,7 +952,7 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
  10012.  	 * This check implies we don't kill processes if their pages
  10013.  	 * are in the swap cache early. Those are always late kills.
  10014.  	 */
  10015. -	if (!page_mapped(hpage))
  10016. +	if (!page_mapped(p))
  10017.  		return true;
  10018.  
  10019.  	if (PageKsm(p)) {
  10020. @@ -996,10 +996,10 @@ static bool hwpoison_user_mappings(struct page *p, unsigned long pfn,
  10021.  	if (kill)
  10022.  		collect_procs(hpage, &tokill, flags & MF_ACTION_REQUIRED);
  10023.  
  10024. -	unmap_success = try_to_unmap(hpage, ttu);
  10025. +	unmap_success = try_to_unmap(p, ttu);
  10026.  	if (!unmap_success)
  10027.  		pr_err("Memory failure: %#lx: failed to unmap page (mapcount=%d)\n",
  10028. -		       pfn, page_mapcount(hpage));
  10029. +		       pfn, page_mapcount(p));
  10030.  
  10031.  	/*
  10032.  	 * try_to_unmap() might put mlocked page in lru cache, so call
  10033. diff --git mm/memory.c mm/memory.c
  10034. index 0136af15ba18..aa0c46997ce8 100644
  10035. --- linux-4.14.336/mm/memory.c
  10036. +++ linux-4.14.336/mm/memory.c
  10037. @@ -2958,8 +2958,8 @@ void unmap_mapping_range(struct address_space *mapping,
  10038.  		loff_t const holebegin, loff_t const holelen, int even_cows)
  10039.  {
  10040.  	struct zap_details details = { };
  10041. -	pgoff_t hba = holebegin >> PAGE_SHIFT;
  10042. -	pgoff_t hlen = (holelen + PAGE_SIZE - 1) >> PAGE_SHIFT;
  10043. +	pgoff_t hba = (pgoff_t)(holebegin) >> PAGE_SHIFT;
  10044. +	pgoff_t hlen = ((pgoff_t)(holelen) + PAGE_SIZE - 1) >> PAGE_SHIFT;
  10045.  
  10046.  	/* Check for overflow. */
  10047.  	if (sizeof(holelen) > sizeof(hlen)) {
  10048. diff --git mm/page-writeback.c mm/page-writeback.c
  10049. index 29f9980c13ac..2193086847b3 100644
  10050. --- linux-4.14.336/mm/page-writeback.c
  10051. +++ linux-4.14.336/mm/page-writeback.c
  10052. @@ -1531,7 +1531,7 @@ static inline void wb_dirty_limits(struct dirty_throttle_control *dtc)
  10053.  	 */
  10054.  	dtc->wb_thresh = __wb_calc_thresh(dtc);
  10055.  	dtc->wb_bg_thresh = dtc->thresh ?
  10056. -		div_u64((u64)dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
  10057. +		div64_u64(dtc->wb_thresh * dtc->bg_thresh, dtc->thresh) : 0;
  10058.  
  10059.  	/*
  10060.  	 * In order to avoid the stacked BDI deadlock we need
  10061. diff --git net/8021q/vlan_netlink.c net/8021q/vlan_netlink.c
  10062. index fdf39dd5e755..aad09715ac49 100644
  10063. --- linux-4.14.336/net/8021q/vlan_netlink.c
  10064. +++ linux-4.14.336/net/8021q/vlan_netlink.c
  10065. @@ -105,12 +105,16 @@ static int vlan_changelink(struct net_device *dev, struct nlattr *tb[],
  10066.  	}
  10067.  	if (data[IFLA_VLAN_INGRESS_QOS]) {
  10068.  		nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) {
  10069. +			if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING)
  10070. +				continue;
  10071.  			m = nla_data(attr);
  10072.  			vlan_dev_set_ingress_priority(dev, m->to, m->from);
  10073.  		}
  10074.  	}
  10075.  	if (data[IFLA_VLAN_EGRESS_QOS]) {
  10076.  		nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) {
  10077. +			if (nla_type(attr) != IFLA_VLAN_QOS_MAPPING)
  10078. +				continue;
  10079.  			m = nla_data(attr);
  10080.  			err = vlan_dev_set_egress_priority(dev, m->from, m->to);
  10081.  			if (err)
  10082. diff --git net/bluetooth/hci_conn.c net/bluetooth/hci_conn.c
  10083. index ce4bbc426946..017abffccc15 100644
  10084. --- linux-4.14.336/net/bluetooth/hci_conn.c
  10085. +++ linux-4.14.336/net/bluetooth/hci_conn.c
  10086. @@ -1221,12 +1221,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
  10087.  		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
  10088.  			     sizeof(cp), &cp);
  10089.  
  10090. -		/* If we're already encrypted set the REAUTH_PEND flag,
  10091. -		 * otherwise set the ENCRYPT_PEND.
  10092. +		/* Set the ENCRYPT_PEND to trigger encryption after
  10093. +		 * authentication.
  10094.  		 */
  10095. -		if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
  10096. -			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
  10097. -		else
  10098. +		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
  10099.  			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
  10100.  	}
  10101.  
  10102. diff --git net/bluetooth/hci_core.c net/bluetooth/hci_core.c
  10103. index 2bf0bdee7186..8faecd94bf5a 100644
  10104. --- linux-4.14.336/net/bluetooth/hci_core.c
  10105. +++ linux-4.14.336/net/bluetooth/hci_core.c
  10106. @@ -2167,6 +2167,7 @@ static void hci_error_reset(struct work_struct *work)
  10107.  {
  10108.  	struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
  10109.  
  10110. +	hci_dev_hold(hdev);
  10111.  	BT_DBG("%s", hdev->name);
  10112.  
  10113.  	if (hdev->hw_error)
  10114. @@ -2175,10 +2176,10 @@ static void hci_error_reset(struct work_struct *work)
  10115.  		BT_ERR("%s hardware error 0x%2.2x", hdev->name,
  10116.  		       hdev->hw_error_code);
  10117.  
  10118. -	if (hci_dev_do_close(hdev))
  10119. -		return;
  10120. +	if (!hci_dev_do_close(hdev))
  10121. +		hci_dev_do_open(hdev);
  10122.  
  10123. -	hci_dev_do_open(hdev);
  10124. +	hci_dev_put(hdev);
  10125.  }
  10126.  
  10127.  void hci_uuids_clear(struct hci_dev *hdev)
  10128. diff --git net/bluetooth/hci_event.c net/bluetooth/hci_event.c
  10129. index 07605fcc9091..987ba33375c9 100644
  10130. --- linux-4.14.336/net/bluetooth/hci_event.c
  10131. +++ linux-4.14.336/net/bluetooth/hci_event.c
  10132. @@ -2459,14 +2459,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  10133.  
  10134.  	if (!ev->status) {
  10135.  		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
  10136. -
  10137. -		if (!hci_conn_ssp_enabled(conn) &&
  10138. -		    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
  10139. -			BT_INFO("re-auth of legacy device is not possible.");
  10140. -		} else {
  10141. -			set_bit(HCI_CONN_AUTH, &conn->flags);
  10142. -			conn->sec_level = conn->pending_sec_level;
  10143. -		}
  10144. +		set_bit(HCI_CONN_AUTH, &conn->flags);
  10145. +		conn->sec_level = conn->pending_sec_level;
  10146.  	} else {
  10147.  		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
  10148.  			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
  10149. @@ -2475,7 +2469,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  10150.  	}
  10151.  
  10152.  	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
  10153. -	clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
  10154.  
  10155.  	if (conn->state == BT_CONFIG) {
  10156.  		if (!ev->status && hci_conn_ssp_enabled(conn)) {
  10157. @@ -4022,9 +4015,12 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  10158.  	hci_dev_lock(hdev);
  10159.  
  10160.  	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  10161. -	if (!conn || !hci_conn_ssp_enabled(conn))
  10162. +	if (!conn || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
  10163.  		goto unlock;
  10164.  
  10165. +	/* Assume remote supports SSP since it has triggered this event */
  10166. +	set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  10167. +
  10168.  	hci_conn_hold(conn);
  10169.  
  10170.  	if (!hci_dev_test_flag(hdev, HCI_MGMT))
  10171. @@ -5148,6 +5144,10 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
  10172.  		return send_conn_param_neg_reply(hdev, handle,
  10173.  						 HCI_ERROR_UNKNOWN_CONN_ID);
  10174.  
  10175. +	if (max > hcon->le_conn_max_interval)
  10176. +		return send_conn_param_neg_reply(hdev, handle,
  10177. +						 HCI_ERROR_INVALID_LL_PARAMS);
  10178. +
  10179.  	if (hci_check_conn_params(min, max, latency, timeout))
  10180.  		return send_conn_param_neg_reply(hdev, handle,
  10181.  						 HCI_ERROR_INVALID_LL_PARAMS);
  10182. diff --git net/bluetooth/l2cap_core.c net/bluetooth/l2cap_core.c
  10183. index 6bae68b5d439..e52657f05f78 100644
  10184. --- linux-4.14.336/net/bluetooth/l2cap_core.c
  10185. +++ linux-4.14.336/net/bluetooth/l2cap_core.c
  10186. @@ -5313,7 +5313,13 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
  10187.  
  10188.  	memset(&rsp, 0, sizeof(rsp));
  10189.  
  10190. -	err = hci_check_conn_params(min, max, latency, to_multiplier);
  10191. +	if (max > hcon->le_conn_max_interval) {
  10192. +		BT_DBG("requested connection interval exceeds current bounds.");
  10193. +		err = -EINVAL;
  10194. +	} else {
  10195. +		err = hci_check_conn_params(min, max, latency, to_multiplier);
  10196. +	}
  10197. +
  10198.  	if (err)
  10199.  		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
  10200.  	else
  10201. diff --git net/core/dst.c net/core/dst.c
  10202. index a6c47da7d0f8..2d121958d5b0 100644
  10203. --- linux-4.14.336/net/core/dst.c
  10204. +++ linux-4.14.336/net/core/dst.c
  10205. @@ -99,10 +99,10 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
  10206.  {
  10207.  	struct dst_entry *dst;
  10208.  
  10209. -	if (ops->gc && dst_entries_get_fast(ops) > ops->gc_thresh) {
  10210. -		if (ops->gc(ops))
  10211. -			return NULL;
  10212. -	}
  10213. +	if (ops->gc &&
  10214. +	    !(flags & DST_NOCOUNT) &&
  10215. +	    dst_entries_get_fast(ops) > ops->gc_thresh)
  10216. +		ops->gc(ops);
  10217.  
  10218.  	dst = kmem_cache_alloc(ops->kmem_cachep, GFP_ATOMIC);
  10219.  	if (!dst)
  10220. diff --git net/ipv4/af_inet.c net/ipv4/af_inet.c
  10221. index 1eee002b12d2..5feb84c43564 100644
  10222. --- linux-4.14.336/net/ipv4/af_inet.c
  10223. +++ linux-4.14.336/net/ipv4/af_inet.c
  10224. @@ -1480,10 +1480,12 @@ EXPORT_SYMBOL(inet_current_timestamp);
  10225.  
  10226.  int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
  10227.  {
  10228. -	if (sk->sk_family == AF_INET)
  10229. +	unsigned int family = READ_ONCE(sk->sk_family);
  10230. +
  10231. +	if (family == AF_INET)
  10232.  		return ip_recv_error(sk, msg, len, addr_len);
  10233.  #if IS_ENABLED(CONFIG_IPV6)
  10234. -	if (sk->sk_family == AF_INET6)
  10235. +	if (family == AF_INET6)
  10236.  		return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
  10237.  #endif
  10238.  	return -EINVAL;
  10239. diff --git net/ipv4/ip_output.c net/ipv4/ip_output.c
  10240. index c242c412dabc..947655e4ab5c 100644
  10241. --- linux-4.14.336/net/ipv4/ip_output.c
  10242. +++ linux-4.14.336/net/ipv4/ip_output.c
  10243. @@ -1114,6 +1114,16 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
  10244.  	struct ip_options_rcu *opt;
  10245.  	struct rtable *rt;
  10246.  
  10247. +	rt = *rtp;
  10248. +	if (unlikely(!rt))
  10249. +		return -EFAULT;
  10250. +
  10251. +	cork->fragsize = ip_sk_use_pmtu(sk) ?
  10252. +			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
  10253. +
  10254. +	if (!inetdev_valid_mtu(cork->fragsize))
  10255. +		return -ENETUNREACH;
  10256. +
  10257.  	/*
  10258.  	 * setup for corking.
  10259.  	 */
  10260. @@ -1129,15 +1139,6 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
  10261.  		cork->flags |= IPCORK_OPT;
  10262.  		cork->addr = ipc->addr;
  10263.  	}
  10264. -	rt = *rtp;
  10265. -	if (unlikely(!rt))
  10266. -		return -EFAULT;
  10267. -
  10268. -	cork->fragsize = ip_sk_use_pmtu(sk) ?
  10269. -			 dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
  10270. -
  10271. -	if (!inetdev_valid_mtu(cork->fragsize))
  10272. -		return -ENETUNREACH;
  10273.  
  10274.  	cork->dst = &rt->dst;
  10275.  	/* We stole this route, caller should not release it. */
  10276. diff --git net/ipv4/tcp.c net/ipv4/tcp.c
  10277. index 0859f968c9b2..eb5458cbdc1c 100644
  10278. --- linux-4.14.336/net/ipv4/tcp.c
  10279. +++ linux-4.14.336/net/ipv4/tcp.c
  10280. @@ -701,6 +701,7 @@ static void tcp_push(struct sock *sk, int flags, int mss_now,
  10281.  		if (!test_bit(TSQ_THROTTLED, &sk->sk_tsq_flags)) {
  10282.  			NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
  10283.  			set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
  10284. +			smp_mb__after_atomic();
  10285.  		}
  10286.  		/* It is possible TX completion already happened
  10287.  		 * before we set TSQ_THROTTLED.
  10288. diff --git net/ipv6/addrconf_core.c net/ipv6/addrconf_core.c
  10289. index e6c5a4b5921d..f5a267972c57 100644
  10290. --- linux-4.14.336/net/ipv6/addrconf_core.c
  10291. +++ linux-4.14.336/net/ipv6/addrconf_core.c
  10292. @@ -140,19 +140,26 @@ const struct ipv6_stub *ipv6_stub __read_mostly = &(struct ipv6_stub) {
  10293.  EXPORT_SYMBOL_GPL(ipv6_stub);
  10294.  
  10295.  /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
  10296. -const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
  10297. +const struct in6_addr in6addr_loopback __aligned(BITS_PER_LONG/8)
  10298. +	= IN6ADDR_LOOPBACK_INIT;
  10299.  EXPORT_SYMBOL(in6addr_loopback);
  10300. -const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
  10301. +const struct in6_addr in6addr_any __aligned(BITS_PER_LONG/8)
  10302. +	= IN6ADDR_ANY_INIT;
  10303.  EXPORT_SYMBOL(in6addr_any);
  10304. -const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
  10305. +const struct in6_addr in6addr_linklocal_allnodes __aligned(BITS_PER_LONG/8)
  10306. +	= IN6ADDR_LINKLOCAL_ALLNODES_INIT;
  10307.  EXPORT_SYMBOL(in6addr_linklocal_allnodes);
  10308. -const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
  10309. +const struct in6_addr in6addr_linklocal_allrouters __aligned(BITS_PER_LONG/8)
  10310. +	= IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
  10311.  EXPORT_SYMBOL(in6addr_linklocal_allrouters);
  10312. -const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
  10313. +const struct in6_addr in6addr_interfacelocal_allnodes __aligned(BITS_PER_LONG/8)
  10314. +	= IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
  10315.  EXPORT_SYMBOL(in6addr_interfacelocal_allnodes);
  10316. -const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
  10317. +const struct in6_addr in6addr_interfacelocal_allrouters __aligned(BITS_PER_LONG/8)
  10318. +	= IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
  10319.  EXPORT_SYMBOL(in6addr_interfacelocal_allrouters);
  10320. -const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
  10321. +const struct in6_addr in6addr_sitelocal_allrouters __aligned(BITS_PER_LONG/8)
  10322. +	= IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
  10323.  EXPORT_SYMBOL(in6addr_sitelocal_allrouters);
  10324.  
  10325.  static void snmp6_free_dev(struct inet6_dev *idev)
  10326. diff --git net/ipv6/ip6_tunnel.c net/ipv6/ip6_tunnel.c
  10327. index d59bf0da2912..cfe3a72a1159 100644
  10328. --- linux-4.14.336/net/ipv6/ip6_tunnel.c
  10329. +++ linux-4.14.336/net/ipv6/ip6_tunnel.c
  10330. @@ -404,7 +404,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
  10331.  	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
  10332.  	unsigned int nhoff = raw - skb->data;
  10333.  	unsigned int off = nhoff + sizeof(*ipv6h);
  10334. -	u8 next, nexthdr = ipv6h->nexthdr;
  10335. +	u8 nexthdr = ipv6h->nexthdr;
  10336.  
  10337.  	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
  10338.  		struct ipv6_opt_hdr *hdr;
  10339. @@ -415,25 +415,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
  10340.  
  10341.  		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
  10342.  		if (nexthdr == NEXTHDR_FRAGMENT) {
  10343. -			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
  10344. -			if (frag_hdr->frag_off)
  10345. -				break;
  10346.  			optlen = 8;
  10347.  		} else if (nexthdr == NEXTHDR_AUTH) {
  10348.  			optlen = (hdr->hdrlen + 2) << 2;
  10349.  		} else {
  10350.  			optlen = ipv6_optlen(hdr);
  10351.  		}
  10352. -		/* cache hdr->nexthdr, since pskb_may_pull() might
  10353. -		 * invalidate hdr
  10354. -		 */
  10355. -		next = hdr->nexthdr;
  10356. -		if (nexthdr == NEXTHDR_DEST) {
  10357. -			u16 i = 2;
  10358.  
  10359. -			/* Remember : hdr is no longer valid at this point. */
  10360. -			if (!pskb_may_pull(skb, off + optlen))
  10361. +		if (!pskb_may_pull(skb, off + optlen))
  10362. +			break;
  10363. +
  10364. +		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
  10365. +		if (nexthdr == NEXTHDR_FRAGMENT) {
  10366. +			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
  10367. +
  10368. +			if (frag_hdr->frag_off)
  10369.  				break;
  10370. +		}
  10371. +		if (nexthdr == NEXTHDR_DEST) {
  10372. +			u16 i = 2;
  10373.  
  10374.  			while (1) {
  10375.  				struct ipv6_tlv_tnl_enc_lim *tel;
  10376. @@ -454,7 +454,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
  10377.  					i++;
  10378.  			}
  10379.  		}
  10380. -		nexthdr = next;
  10381. +		nexthdr = hdr->nexthdr;
  10382.  		off += optlen;
  10383.  	}
  10384.  	return 0;
  10385. diff --git net/ipv6/route.c net/ipv6/route.c
  10386. index 79b67f8048b5..6e4d31524268 100644
  10387. --- linux-4.14.336/net/ipv6/route.c
  10388. +++ linux-4.14.336/net/ipv6/route.c
  10389. @@ -85,7 +85,7 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *);
  10390.  static void		ip6_dst_destroy(struct dst_entry *);
  10391.  static void		ip6_dst_ifdown(struct dst_entry *,
  10392.  				       struct net_device *dev, int how);
  10393. -static int		 ip6_dst_gc(struct dst_ops *ops);
  10394. +static void		 ip6_dst_gc(struct dst_ops *ops);
  10395.  
  10396.  static int		ip6_pkt_discard(struct sk_buff *skb);
  10397.  static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
  10398. @@ -1792,29 +1792,30 @@ out:
  10399.  	return dst;
  10400.  }
  10401.  
  10402. -static int ip6_dst_gc(struct dst_ops *ops)
  10403. +static void ip6_dst_gc(struct dst_ops *ops)
  10404.  {
  10405.  	struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
  10406.  	int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
  10407. -	int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
  10408.  	int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
  10409.  	int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
  10410.  	unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
  10411. +	unsigned int val;
  10412.  	int entries;
  10413.  
  10414.  	entries = dst_entries_get_fast(ops);
  10415. -	if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
  10416. -	    entries <= rt_max_size)
  10417. +	if (entries > ops->gc_thresh)
  10418. +		entries = dst_entries_get_slow(ops);
  10419. +
  10420. +	if (time_after(rt_last_gc + rt_min_interval, jiffies))
  10421.  		goto out;
  10422.  
  10423. -	net->ipv6.ip6_rt_gc_expire++;
  10424. -	fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
  10425. +	fib6_run_gc(atomic_inc_return(&net->ipv6.ip6_rt_gc_expire), net, true);
  10426.  	entries = dst_entries_get_slow(ops);
  10427.  	if (entries < ops->gc_thresh)
  10428. -		net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
  10429. +		atomic_set(&net->ipv6.ip6_rt_gc_expire, rt_gc_timeout >> 1);
  10430.  out:
  10431. -	net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
  10432. -	return entries > rt_max_size;
  10433. +	val = atomic_read(&net->ipv6.ip6_rt_gc_expire);
  10434. +	atomic_set(&net->ipv6.ip6_rt_gc_expire, val - (val >> rt_elasticity));
  10435.  }
  10436.  
  10437.  static int ip6_convert_metrics(struct mx6_config *mxc,
  10438. @@ -4091,7 +4092,7 @@ static int __net_init ip6_route_net_init(struct net *net)
  10439.  #endif
  10440.  
  10441.  	net->ipv6.sysctl.flush_delay = 0;
  10442. -	net->ipv6.sysctl.ip6_rt_max_size = 4096;
  10443. +	net->ipv6.sysctl.ip6_rt_max_size = INT_MAX;
  10444.  	net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2;
  10445.  	net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ;
  10446.  	net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ;
  10447. @@ -4099,7 +4100,7 @@ static int __net_init ip6_route_net_init(struct net *net)
  10448.  	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
  10449.  	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
  10450.  
  10451. -	net->ipv6.ip6_rt_gc_expire = 30*HZ;
  10452. +	atomic_set(&net->ipv6.ip6_rt_gc_expire, 30*HZ);
  10453.  
  10454.  	ret = 0;
  10455.  out:
  10456. diff --git net/ipv6/seg6.c net/ipv6/seg6.c
  10457. index 9c45165fe79b..b785bf569049 100644
  10458. --- linux-4.14.336/net/ipv6/seg6.c
  10459. +++ linux-4.14.336/net/ipv6/seg6.c
  10460. @@ -447,22 +447,24 @@ int __init seg6_init(void)
  10461.  {
  10462.  	int err = -ENOMEM;
  10463.  
  10464. -	err = genl_register_family(&seg6_genl_family);
  10465. +	err = register_pernet_subsys(&ip6_segments_ops);
  10466.  	if (err)
  10467.  		goto out;
  10468.  
  10469. -	err = register_pernet_subsys(&ip6_segments_ops);
  10470. +	err = genl_register_family(&seg6_genl_family);
  10471.  	if (err)
  10472. -		goto out_unregister_genl;
  10473. +		goto out_unregister_pernet;
  10474.  
  10475.  #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
  10476.  	err = seg6_iptunnel_init();
  10477.  	if (err)
  10478. -		goto out_unregister_pernet;
  10479. +		goto out_unregister_genl;
  10480.  
  10481.  	err = seg6_local_init();
  10482. -	if (err)
  10483. -		goto out_unregister_pernet;
  10484. +	if (err) {
  10485. +		seg6_iptunnel_exit();
  10486. +		goto out_unregister_genl;
  10487. +	}
  10488.  #endif
  10489.  
  10490.  #ifdef CONFIG_IPV6_SEG6_HMAC
  10491. @@ -483,11 +485,11 @@ out_unregister_iptun:
  10492.  #endif
  10493.  #endif
  10494.  #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
  10495. -out_unregister_pernet:
  10496. -	unregister_pernet_subsys(&ip6_segments_ops);
  10497. -#endif
  10498.  out_unregister_genl:
  10499.  	genl_unregister_family(&seg6_genl_family);
  10500. +#endif
  10501. +out_unregister_pernet:
  10502. +	unregister_pernet_subsys(&ip6_segments_ops);
  10503.  	goto out;
  10504.  }
  10505.  
  10506. diff --git net/iucv/af_iucv.c net/iucv/af_iucv.c
  10507. index 07e397a5edc6..d7dd92274957 100644
  10508. --- linux-4.14.336/net/iucv/af_iucv.c
  10509. +++ linux-4.14.336/net/iucv/af_iucv.c
  10510. @@ -2458,7 +2458,7 @@ static int __init afiucv_init(void)
  10511.  {
  10512.  	int err;
  10513.  
  10514. -	if (MACHINE_IS_VM) {
  10515. +	if (MACHINE_IS_VM && IS_ENABLED(CONFIG_IUCV)) {
  10516.  		cpcmd("QUERY USERID", iucv_userid, sizeof(iucv_userid), &err);
  10517.  		if (unlikely(err)) {
  10518.  			WARN_ON(err);
  10519. @@ -2466,11 +2466,7 @@ static int __init afiucv_init(void)
  10520.  			goto out;
  10521.  		}
  10522.  
  10523. -		pr_iucv = try_then_request_module(symbol_get(iucv_if), "iucv");
  10524. -		if (!pr_iucv) {
  10525. -			printk(KERN_WARNING "iucv_if lookup failed\n");
  10526. -			memset(&iucv_userid, 0, sizeof(iucv_userid));
  10527. -		}
  10528. +		pr_iucv = &iucv_if;
  10529.  	} else {
  10530.  		memset(&iucv_userid, 0, sizeof(iucv_userid));
  10531.  		pr_iucv = NULL;
  10532. @@ -2504,17 +2500,13 @@ out_sock:
  10533.  out_proto:
  10534.  	proto_unregister(&iucv_proto);
  10535.  out:
  10536. -	if (pr_iucv)
  10537. -		symbol_put(iucv_if);
  10538.  	return err;
  10539.  }
  10540.  
  10541.  static void __exit afiucv_exit(void)
  10542.  {
  10543. -	if (pr_iucv) {
  10544. +	if (pr_iucv)
  10545.  		afiucv_iucv_exit();
  10546. -		symbol_put(iucv_if);
  10547. -	}
  10548.  
  10549.  	unregister_netdevice_notifier(&afiucv_netdev_notifier);
  10550.  	dev_remove_pack(&iucv_packet_type);
  10551. diff --git net/l2tp/l2tp_ip6.c net/l2tp/l2tp_ip6.c
  10552. index d797708a1a5e..4a5f6ca12342 100644
  10553. --- linux-4.14.336/net/l2tp/l2tp_ip6.c
  10554. +++ linux-4.14.336/net/l2tp/l2tp_ip6.c
  10555. @@ -658,7 +658,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
  10556.  
  10557.  back_from_confirm:
  10558.  	lock_sock(sk);
  10559. -	ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0;
  10560. +	ulen = len + (skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0);
  10561.  	err = ip6_append_data(sk, ip_generic_getfrag, msg,
  10562.  			      ulen, transhdrlen, &ipc6,
  10563.  			      &fl6, (struct rt6_info *)dst,
  10564. diff --git net/llc/af_llc.c net/llc/af_llc.c
  10565. index 1e20b719fb3c..727af511297c 100644
  10566. --- linux-4.14.336/net/llc/af_llc.c
  10567. +++ linux-4.14.336/net/llc/af_llc.c
  10568. @@ -227,6 +227,8 @@ static int llc_ui_release(struct socket *sock)
  10569.  	if (llc->dev)
  10570.  		dev_put(llc->dev);
  10571.  	sock_put(sk);
  10572. +	sock_orphan(sk);
  10573. +	sock->sk = NULL;
  10574.  	llc_sk_free(sk);
  10575.  out:
  10576.  	return 0;
  10577. @@ -926,14 +928,15 @@ copy_uaddr:
  10578.   */
  10579.  static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
  10580.  {
  10581. +	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
  10582.  	struct sock *sk = sock->sk;
  10583.  	struct llc_sock *llc = llc_sk(sk);
  10584. -	DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
  10585.  	int flags = msg->msg_flags;
  10586.  	int noblock = flags & MSG_DONTWAIT;
  10587. +	int rc = -EINVAL, copied = 0, hdrlen, hh_len;
  10588.  	struct sk_buff *skb = NULL;
  10589. +	struct net_device *dev;
  10590.  	size_t size = 0;
  10591. -	int rc = -EINVAL, copied = 0, hdrlen;
  10592.  
  10593.  	dprintk("%s: sending from %02X to %02X\n", __func__,
  10594.  		llc->laddr.lsap, llc->daddr.lsap);
  10595. @@ -953,22 +956,29 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
  10596.  		if (rc)
  10597.  			goto out;
  10598.  	}
  10599. -	hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
  10600. +	dev = llc->dev;
  10601. +	hh_len = LL_RESERVED_SPACE(dev);
  10602. +	hdrlen = llc_ui_header_len(sk, addr);
  10603.  	size = hdrlen + len;
  10604. -	if (size > llc->dev->mtu)
  10605. -		size = llc->dev->mtu;
  10606. +	size = min_t(size_t, size, READ_ONCE(dev->mtu));
  10607.  	copied = size - hdrlen;
  10608.  	rc = -EINVAL;
  10609.  	if (copied < 0)
  10610.  		goto out;
  10611.  	release_sock(sk);
  10612. -	skb = sock_alloc_send_skb(sk, size, noblock, &rc);
  10613. +	skb = sock_alloc_send_skb(sk, hh_len + size, noblock, &rc);
  10614.  	lock_sock(sk);
  10615.  	if (!skb)
  10616.  		goto out;
  10617. -	skb->dev      = llc->dev;
  10618. +	if (sock_flag(sk, SOCK_ZAPPED) ||
  10619. +	    llc->dev != dev ||
  10620. +	    hdrlen != llc_ui_header_len(sk, addr) ||
  10621. +	    hh_len != LL_RESERVED_SPACE(dev) ||
  10622. +	    size > READ_ONCE(dev->mtu))
  10623. +		goto out;
  10624. +	skb->dev      = dev;
  10625.  	skb->protocol = llc_proto_type(addr->sllc_arphrd);
  10626. -	skb_reserve(skb, hdrlen);
  10627. +	skb_reserve(skb, hh_len + hdrlen);
  10628.  	rc = memcpy_from_msg(skb_put(skb, copied), msg, copied);
  10629.  	if (rc)
  10630.  		goto out;
  10631. diff --git net/llc/llc_core.c net/llc/llc_core.c
  10632. index 64d4bef04e73..4900a27b5176 100644
  10633. --- linux-4.14.336/net/llc/llc_core.c
  10634. +++ linux-4.14.336/net/llc/llc_core.c
  10635. @@ -135,22 +135,15 @@ static struct packet_type llc_packet_type __read_mostly = {
  10636.  	.func = llc_rcv,
  10637.  };
  10638.  
  10639. -static struct packet_type llc_tr_packet_type __read_mostly = {
  10640. -	.type = cpu_to_be16(ETH_P_TR_802_2),
  10641. -	.func = llc_rcv,
  10642. -};
  10643. -
  10644.  static int __init llc_init(void)
  10645.  {
  10646.  	dev_add_pack(&llc_packet_type);
  10647. -	dev_add_pack(&llc_tr_packet_type);
  10648.  	return 0;
  10649.  }
  10650.  
  10651.  static void __exit llc_exit(void)
  10652.  {
  10653.  	dev_remove_pack(&llc_packet_type);
  10654. -	dev_remove_pack(&llc_tr_packet_type);
  10655.  }
  10656.  
  10657.  module_init(llc_init);
  10658. diff --git net/mac80211/sta_info.c net/mac80211/sta_info.c
  10659. index 4e406cd11573..f2663c0a1e6f 100644
  10660. --- linux-4.14.336/net/mac80211/sta_info.c
  10661. +++ linux-4.14.336/net/mac80211/sta_info.c
  10662. @@ -602,6 +602,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
  10663.  	if (ieee80211_vif_is_mesh(&sdata->vif))
  10664.  		mesh_accept_plinks_update(sdata);
  10665.  
  10666. +	ieee80211_check_fast_xmit(sta);
  10667. +
  10668.  	return 0;
  10669.   out_remove:
  10670.  	sta_info_hash_del(local, sta);
  10671. diff --git net/mac80211/tx.c net/mac80211/tx.c
  10672. index 3914214dee05..995b0f444351 100644
  10673. --- linux-4.14.336/net/mac80211/tx.c
  10674. +++ linux-4.14.336/net/mac80211/tx.c
  10675. @@ -2808,7 +2808,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta)
  10676.  	    sdata->vif.type == NL80211_IFTYPE_STATION)
  10677.  		goto out;
  10678.  
  10679. -	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
  10680. +	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded)
  10681.  		goto out;
  10682.  
  10683.  	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
  10684. diff --git net/ncsi/internal.h net/ncsi/internal.h
  10685. index 8055e3965cef..2477caf9c967 100644
  10686. --- linux-4.14.336/net/ncsi/internal.h
  10687. +++ linux-4.14.336/net/ncsi/internal.h
  10688. @@ -69,9 +69,12 @@ enum {
  10689.  };
  10690.  
  10691.  struct ncsi_channel_version {
  10692. -	u32 version;		/* Supported BCD encoded NCSI version */
  10693. -	u32 alpha2;		/* Supported BCD encoded NCSI version */
  10694. -	u8  fw_name[12];	/* Firware name string                */
  10695. +	u8   major;		/* NCSI version major */
  10696. +	u8   minor;		/* NCSI version minor */
  10697. +	u8   update;		/* NCSI version update */
  10698. +	char alpha1;		/* NCSI version alpha1 */
  10699. +	char alpha2;		/* NCSI version alpha2 */
  10700. +	u8  fw_name[12];	/* Firmware name string                */
  10701.  	u32 fw_version;		/* Firmware version                   */
  10702.  	u16 pci_ids[4];		/* PCI identification                 */
  10703.  	u32 mf_id;		/* Manufacture ID                     */
  10704. diff --git net/ncsi/ncsi-netlink.c net/ncsi/ncsi-netlink.c
  10705. index 9073911ac97b..5c88201ec9d8 100644
  10706. --- linux-4.14.336/net/ncsi/ncsi-netlink.c
  10707. +++ linux-4.14.336/net/ncsi/ncsi-netlink.c
  10708. @@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,
  10709.  	if (ndp->force_channel == nc)
  10710.  		nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED);
  10711.  
  10712. -	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version);
  10713. -	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2);
  10714. +	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major);
  10715. +	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor);
  10716.  	nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name);
  10717.  
  10718.  	vid_nest = nla_nest_start(skb, NCSI_CHANNEL_ATTR_VLAN_LIST);
  10719. diff --git net/ncsi/ncsi-pkt.h net/ncsi/ncsi-pkt.h
  10720. index 91b4b66438df..0bf62b4883d4 100644
  10721. --- linux-4.14.336/net/ncsi/ncsi-pkt.h
  10722. +++ linux-4.14.336/net/ncsi/ncsi-pkt.h
  10723. @@ -164,9 +164,12 @@ struct ncsi_rsp_gls_pkt {
  10724.  /* Get Version ID */
  10725.  struct ncsi_rsp_gvi_pkt {
  10726.  	struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
  10727. -	__be32                  ncsi_version; /* NCSI version    */
  10728. +	unsigned char           major;        /* NCSI version major */
  10729. +	unsigned char           minor;        /* NCSI version minor */
  10730. +	unsigned char           update;       /* NCSI version update */
  10731. +	unsigned char           alpha1;       /* NCSI version alpha1 */
  10732.  	unsigned char           reserved[3];  /* Reserved        */
  10733. -	unsigned char           alpha2;       /* NCSI version    */
  10734. +	unsigned char           alpha2;       /* NCSI version alpha2 */
  10735.  	unsigned char           fw_name[12];  /* f/w name string */
  10736.  	__be32                  fw_version;   /* f/w version     */
  10737.  	__be16                  pci_ids[4];   /* PCI IDs         */
  10738. diff --git net/ncsi/ncsi-rsp.c net/ncsi/ncsi-rsp.c
  10739. index 42878d843c3c..1ae1de24b202 100644
  10740. --- linux-4.14.336/net/ncsi/ncsi-rsp.c
  10741. +++ linux-4.14.336/net/ncsi/ncsi-rsp.c
  10742. @@ -20,6 +20,19 @@
  10743.  #include "internal.h"
  10744.  #include "ncsi-pkt.h"
  10745.  
  10746. +/* Nibbles within [0xA, 0xF] add zero "0" to the returned value.
  10747. + * Optional fields (encoded as 0xFF) will default to zero.
  10748. + */
  10749. +static u8 decode_bcd_u8(u8 x)
  10750. +{
  10751. +	int lo = x & 0xF;
  10752. +	int hi = x >> 4;
  10753. +
  10754. +	lo = lo < 0xA ? lo : 0;
  10755. +	hi = hi < 0xA ? hi : 0;
  10756. +	return lo + hi * 10;
  10757. +}
  10758. +
  10759.  static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
  10760.  				 unsigned short payload)
  10761.  {
  10762. @@ -610,9 +623,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
  10763.  	if (!nc)
  10764.  		return -ENODEV;
  10765.  
  10766. -	/* Update to channel's version info */
  10767. +	/* Update channel's version info
  10768. +	 *
  10769. +	 * Major, minor, and update fields are supposed to be
  10770. +	 * unsigned integers encoded as packed BCD.
  10771. +	 *
  10772. +	 * Alpha1 and alpha2 are ISO/IEC 8859-1 characters.
  10773. +	 */
  10774.  	ncv = &nc->version;
  10775. -	ncv->version = ntohl(rsp->ncsi_version);
  10776. +	ncv->major = decode_bcd_u8(rsp->major);
  10777. +	ncv->minor = decode_bcd_u8(rsp->minor);
  10778. +	ncv->update = decode_bcd_u8(rsp->update);
  10779. +	ncv->alpha1 = rsp->alpha1;
  10780.  	ncv->alpha2 = rsp->alpha2;
  10781.  	memcpy(ncv->fw_name, rsp->fw_name, 12);
  10782.  	ncv->fw_version = ntohl(rsp->fw_version);
  10783. diff --git net/netfilter/ipvs/ip_vs_xmit.c net/netfilter/ipvs/ip_vs_xmit.c
  10784. index 97d411033f8a..8792cad28e29 100644
  10785. --- linux-4.14.336/net/netfilter/ipvs/ip_vs_xmit.c
  10786. +++ linux-4.14.336/net/netfilter/ipvs/ip_vs_xmit.c
  10787. @@ -270,8 +270,8 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
  10788.  			skb->dev = dst->dev;
  10789.  			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
  10790.  				    ICMPV6_EXC_HOPLIMIT, 0);
  10791. -			__IP6_INC_STATS(net, ip6_dst_idev(dst),
  10792. -					IPSTATS_MIB_INHDRERRORS);
  10793. +			IP6_INC_STATS(net, ip6_dst_idev(dst),
  10794. +				      IPSTATS_MIB_INHDRERRORS);
  10795.  
  10796.  			return false;
  10797.  		}
  10798. @@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
  10799.  	{
  10800.  		if (ip_hdr(skb)->ttl <= 1) {
  10801.  			/* Tell the sender its packet died... */
  10802. -			__IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
  10803. +			IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
  10804.  			icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
  10805.  			return false;
  10806.  		}
  10807. diff --git net/netfilter/nf_log.c net/netfilter/nf_log.c
  10808. index cdc744aa5889..a16156598905 100644
  10809. --- linux-4.14.336/net/netfilter/nf_log.c
  10810. +++ linux-4.14.336/net/netfilter/nf_log.c
  10811. @@ -202,11 +202,12 @@ void nf_logger_put(int pf, enum nf_log_type type)
  10812.  		return;
  10813.  	}
  10814.  
  10815. -	BUG_ON(loggers[pf][type] == NULL);
  10816. -
  10817.  	rcu_read_lock();
  10818.  	logger = rcu_dereference(loggers[pf][type]);
  10819. -	module_put(logger->me);
  10820. +	if (!logger)
  10821. +		WARN_ON_ONCE(1);
  10822. +	else
  10823. +		module_put(logger->me);
  10824.  	rcu_read_unlock();
  10825.  }
  10826.  EXPORT_SYMBOL_GPL(nf_logger_put);
  10827. diff --git net/netfilter/nf_tables_api.c net/netfilter/nf_tables_api.c
  10828. index 27c24c99d23b..407346ba89d4 100644
  10829. --- linux-4.14.336/net/netfilter/nf_tables_api.c
  10830. +++ linux-4.14.336/net/netfilter/nf_tables_api.c
  10831. @@ -22,6 +22,8 @@
  10832.  #include <net/net_namespace.h>
  10833.  #include <net/sock.h>
  10834.  
  10835. +#define NFT_SET_MAX_ANONLEN 16
  10836. +
  10837.  static LIST_HEAD(nf_tables_expressions);
  10838.  static LIST_HEAD(nf_tables_objects);
  10839.  
  10840. @@ -744,6 +746,30 @@ err:
  10841.  	return ret;
  10842.  }
  10843.  
  10844. +static bool nft_supported_family(u8 family)
  10845. +{
  10846. +	return false
  10847. +#ifdef CONFIG_NF_TABLES_INET
  10848. +		|| family == NFPROTO_INET
  10849. +#endif
  10850. +#ifdef CONFIG_NF_TABLES_IPV4
  10851. +		|| family == NFPROTO_IPV4
  10852. +#endif
  10853. +#ifdef CONFIG_NF_TABLES_ARP
  10854. +		|| family == NFPROTO_ARP
  10855. +#endif
  10856. +#ifdef CONFIG_NF_TABLES_NETDEV
  10857. +		|| family == NFPROTO_NETDEV
  10858. +#endif
  10859. +#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
  10860. +		|| family == NFPROTO_BRIDGE
  10861. +#endif
  10862. +#ifdef CONFIG_NF_TABLES_IPV6
  10863. +		|| family == NFPROTO_IPV6
  10864. +#endif
  10865. +		;
  10866. +}
  10867. +
  10868.  static int nf_tables_newtable(struct net *net, struct sock *nlsk,
  10869.  			      struct sk_buff *skb, const struct nlmsghdr *nlh,
  10870.  			      const struct nlattr * const nla[],
  10871. @@ -759,6 +785,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
  10872.  	struct nft_ctx ctx;
  10873.  	int err;
  10874.  
  10875. +	if (!nft_supported_family(family))
  10876. +		return -EOPNOTSUPP;
  10877. +
  10878.  	afi = nf_tables_afinfo_lookup(net, family, true);
  10879.  	if (IS_ERR(afi))
  10880.  		return PTR_ERR(afi);
  10881. @@ -2817,6 +2846,9 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set,
  10882.  		if (p[1] != 'd' || strchr(p + 2, '%'))
  10883.  			return -EINVAL;
  10884.  
  10885. +		if (strnlen(name, NFT_SET_MAX_ANONLEN) >= NFT_SET_MAX_ANONLEN)
  10886. +			return -EINVAL;
  10887. +
  10888.  		inuse = (unsigned long *)get_zeroed_page(GFP_KERNEL);
  10889.  		if (inuse == NULL)
  10890.  			return -ENOMEM;
  10891. @@ -5889,16 +5921,10 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
  10892.  	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
  10893.  
  10894.  	switch (data->verdict.code) {
  10895. -	default:
  10896. -		switch (data->verdict.code & NF_VERDICT_MASK) {
  10897. -		case NF_ACCEPT:
  10898. -		case NF_DROP:
  10899. -		case NF_QUEUE:
  10900. -			break;
  10901. -		default:
  10902. -			return -EINVAL;
  10903. -		}
  10904. -		/* fall through */
  10905. +	case NF_ACCEPT:
  10906. +	case NF_DROP:
  10907. +	case NF_QUEUE:
  10908. +		break;
  10909.  	case NFT_CONTINUE:
  10910.  	case NFT_BREAK:
  10911.  	case NFT_RETURN:
  10912. @@ -5918,6 +5944,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
  10913.  
  10914.  		data->verdict.chain = chain;
  10915.  		break;
  10916. +	default:
  10917. +		return -EINVAL;
  10918.  	}
  10919.  
  10920.  	desc->len = sizeof(data->verdict);
  10921. diff --git net/netfilter/nft_byteorder.c net/netfilter/nft_byteorder.c
  10922. index dba16126c7ee..8c4ee49a80fb 100644
  10923. --- linux-4.14.336/net/netfilter/nft_byteorder.c
  10924. +++ linux-4.14.336/net/netfilter/nft_byteorder.c
  10925. @@ -41,19 +41,20 @@ static void nft_byteorder_eval(const struct nft_expr *expr,
  10926.  
  10927.  	switch (priv->size) {
  10928.  	case 8: {
  10929. +		u64 *dst64 = (void *)dst;
  10930.  		u64 src64;
  10931.  
  10932.  		switch (priv->op) {
  10933.  		case NFT_BYTEORDER_NTOH:
  10934.  			for (i = 0; i < priv->len / 8; i++) {
  10935.  				src64 = get_unaligned((u64 *)&src[i]);
  10936. -				put_unaligned_be64(src64, &dst[i]);
  10937. +				put_unaligned_be64(src64, &dst64[i]);
  10938.  			}
  10939.  			break;
  10940.  		case NFT_BYTEORDER_HTON:
  10941.  			for (i = 0; i < priv->len / 8; i++) {
  10942.  				src64 = get_unaligned_be64(&src[i]);
  10943. -				put_unaligned(src64, (u64 *)&dst[i]);
  10944. +				put_unaligned(src64, &dst64[i]);
  10945.  			}
  10946.  			break;
  10947.  		}
  10948. diff --git net/netfilter/nft_compat.c net/netfilter/nft_compat.c
  10949. index 8281656808ae..b87b7338266c 100644
  10950. --- linux-4.14.336/net/netfilter/nft_compat.c
  10951. +++ linux-4.14.336/net/netfilter/nft_compat.c
  10952. @@ -214,6 +214,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
  10953.  static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
  10954.  {
  10955.  	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
  10956. +	u32 l4proto;
  10957.  	u32 flags;
  10958.  	int err;
  10959.  
  10960. @@ -226,12 +227,18 @@ static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
  10961.  		return -EINVAL;
  10962.  
  10963.  	flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS]));
  10964. -	if (flags & ~NFT_RULE_COMPAT_F_MASK)
  10965. +	if (flags & NFT_RULE_COMPAT_F_UNUSED ||
  10966. +	    flags & ~NFT_RULE_COMPAT_F_MASK)
  10967.  		return -EINVAL;
  10968.  	if (flags & NFT_RULE_COMPAT_F_INV)
  10969.  		*inv = true;
  10970.  
  10971. -	*proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
  10972. +	l4proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
  10973. +	if (l4proto > U16_MAX)
  10974. +		return -EINVAL;
  10975. +
  10976. +	*proto = l4proto;
  10977. +
  10978.  	return 0;
  10979.  }
  10980.  
  10981. diff --git net/netlabel/netlabel_calipso.c net/netlabel/netlabel_calipso.c
  10982. index d177dd066504..e0d63fb927bd 100644
  10983. --- linux-4.14.336/net/netlabel/netlabel_calipso.c
  10984. +++ linux-4.14.336/net/netlabel/netlabel_calipso.c
  10985. @@ -68,6 +68,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
  10986.  	[NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
  10987.  };
  10988.  
  10989. +static const struct netlbl_calipso_ops *calipso_ops;
  10990. +
  10991. +/**
  10992. + * netlbl_calipso_ops_register - Register the CALIPSO operations
  10993. + * @ops: ops to register
  10994. + *
  10995. + * Description:
  10996. + * Register the CALIPSO packet engine operations.
  10997. + *
  10998. + */
  10999. +const struct netlbl_calipso_ops *
  11000. +netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
  11001. +{
  11002. +	return xchg(&calipso_ops, ops);
  11003. +}
  11004. +EXPORT_SYMBOL(netlbl_calipso_ops_register);
  11005. +
  11006. +static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
  11007. +{
  11008. +	return ACCESS_ONCE(calipso_ops);
  11009. +}
  11010. +
  11011.  /* NetLabel Command Handlers
  11012.   */
  11013.  /**
  11014. @@ -110,16 +132,19 @@ static int netlbl_calipso_add_pass(struct genl_info *info,
  11015.   *
  11016.   */
  11017.  static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
  11018. -
  11019.  {
  11020.  	int ret_val = -EINVAL;
  11021.  	struct netlbl_audit audit_info;
  11022. +	const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  11023.  
  11024.  	if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
  11025.  	    !info->attrs[NLBL_CALIPSO_A_MTYPE])
  11026.  		return -EINVAL;
  11027.  
  11028. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11029. +	if (!ops)
  11030. +		return -EOPNOTSUPP;
  11031. +
  11032. +	netlbl_netlink_auditinfo(&audit_info);
  11033.  	switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
  11034.  	case CALIPSO_MAP_PASS:
  11035.  		ret_val = netlbl_calipso_add_pass(info, &audit_info);
  11036. @@ -301,7 +326,7 @@ static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
  11037.  	if (!info->attrs[NLBL_CALIPSO_A_DOI])
  11038.  		return -EINVAL;
  11039.  
  11040. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11041. +	netlbl_netlink_auditinfo(&audit_info);
  11042.  	cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
  11043.  	cb_arg.audit_info = &audit_info;
  11044.  	ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
  11045. @@ -375,27 +400,6 @@ int __init netlbl_calipso_genl_init(void)
  11046.  	return genl_register_family(&netlbl_calipso_gnl_family);
  11047.  }
  11048.  
  11049. -static const struct netlbl_calipso_ops *calipso_ops;
  11050. -
  11051. -/**
  11052. - * netlbl_calipso_ops_register - Register the CALIPSO operations
  11053. - *
  11054. - * Description:
  11055. - * Register the CALIPSO packet engine operations.
  11056. - *
  11057. - */
  11058. -const struct netlbl_calipso_ops *
  11059. -netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
  11060. -{
  11061. -	return xchg(&calipso_ops, ops);
  11062. -}
  11063. -EXPORT_SYMBOL(netlbl_calipso_ops_register);
  11064. -
  11065. -static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
  11066. -{
  11067. -	return ACCESS_ONCE(calipso_ops);
  11068. -}
  11069. -
  11070.  /**
  11071.   * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
  11072.   * @doi_def: the DOI structure
  11073. diff --git net/netlabel/netlabel_cipso_v4.c net/netlabel/netlabel_cipso_v4.c
  11074. index e252f62bb8c2..a0a145db3fc7 100644
  11075. --- linux-4.14.336/net/netlabel/netlabel_cipso_v4.c
  11076. +++ linux-4.14.336/net/netlabel/netlabel_cipso_v4.c
  11077. @@ -420,7 +420,7 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
  11078.  	    !info->attrs[NLBL_CIPSOV4_A_MTYPE])
  11079.  		return -EINVAL;
  11080.  
  11081. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11082. +	netlbl_netlink_auditinfo(&audit_info);
  11083.  	switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
  11084.  	case CIPSO_V4_MAP_TRANS:
  11085.  		ret_val = netlbl_cipsov4_add_std(info, &audit_info);
  11086. @@ -715,7 +715,7 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
  11087.  	if (!info->attrs[NLBL_CIPSOV4_A_DOI])
  11088.  		return -EINVAL;
  11089.  
  11090. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11091. +	netlbl_netlink_auditinfo(&audit_info);
  11092.  	cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  11093.  	cb_arg.audit_info = &audit_info;
  11094.  	ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
  11095. diff --git net/netlabel/netlabel_mgmt.c net/netlabel/netlabel_mgmt.c
  11096. index 71ba69cb50c9..43c51242dcd2 100644
  11097. --- linux-4.14.336/net/netlabel/netlabel_mgmt.c
  11098. +++ linux-4.14.336/net/netlabel/netlabel_mgmt.c
  11099. @@ -447,7 +447,7 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
  11100.  	     (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
  11101.  		return -EINVAL;
  11102.  
  11103. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11104. +	netlbl_netlink_auditinfo(&audit_info);
  11105.  
  11106.  	return netlbl_mgmt_add_common(info, &audit_info);
  11107.  }
  11108. @@ -470,7 +470,7 @@ static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)
  11109.  	if (!info->attrs[NLBL_MGMT_A_DOMAIN])
  11110.  		return -EINVAL;
  11111.  
  11112. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11113. +	netlbl_netlink_auditinfo(&audit_info);
  11114.  
  11115.  	domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]);
  11116.  	return netlbl_domhsh_remove(domain, AF_UNSPEC, &audit_info);
  11117. @@ -570,7 +570,7 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
  11118.  	     (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
  11119.  		return -EINVAL;
  11120.  
  11121. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11122. +	netlbl_netlink_auditinfo(&audit_info);
  11123.  
  11124.  	return netlbl_mgmt_add_common(info, &audit_info);
  11125.  }
  11126. @@ -589,7 +589,7 @@ static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info)
  11127.  {
  11128.  	struct netlbl_audit audit_info;
  11129.  
  11130. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11131. +	netlbl_netlink_auditinfo(&audit_info);
  11132.  
  11133.  	return netlbl_domhsh_remove_default(AF_UNSPEC, &audit_info);
  11134.  }
  11135. diff --git net/netlabel/netlabel_unlabeled.c net/netlabel/netlabel_unlabeled.c
  11136. index 0067f472367b..ff52ff2278ed 100644
  11137. --- linux-4.14.336/net/netlabel/netlabel_unlabeled.c
  11138. +++ linux-4.14.336/net/netlabel/netlabel_unlabeled.c
  11139. @@ -827,7 +827,7 @@ static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
  11140.  	if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
  11141.  		value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
  11142.  		if (value == 1 || value == 0) {
  11143. -			netlbl_netlink_auditinfo(skb, &audit_info);
  11144. +			netlbl_netlink_auditinfo(&audit_info);
  11145.  			netlbl_unlabel_acceptflg_set(value, &audit_info);
  11146.  			return 0;
  11147.  		}
  11148. @@ -910,7 +910,7 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb,
  11149.  	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  11150.  		return -EINVAL;
  11151.  
  11152. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11153. +	netlbl_netlink_auditinfo(&audit_info);
  11154.  
  11155.  	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  11156.  	if (ret_val != 0)
  11157. @@ -960,7 +960,7 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
  11158.  	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  11159.  		return -EINVAL;
  11160.  
  11161. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11162. +	netlbl_netlink_auditinfo(&audit_info);
  11163.  
  11164.  	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  11165.  	if (ret_val != 0)
  11166. @@ -1007,7 +1007,7 @@ static int netlbl_unlabel_staticremove(struct sk_buff *skb,
  11167.  	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  11168.  		return -EINVAL;
  11169.  
  11170. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11171. +	netlbl_netlink_auditinfo(&audit_info);
  11172.  
  11173.  	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  11174.  	if (ret_val != 0)
  11175. @@ -1047,7 +1047,7 @@ static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
  11176.  	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  11177.  		return -EINVAL;
  11178.  
  11179. -	netlbl_netlink_auditinfo(skb, &audit_info);
  11180. +	netlbl_netlink_auditinfo(&audit_info);
  11181.  
  11182.  	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  11183.  	if (ret_val != 0)
  11184. diff --git net/netlabel/netlabel_user.h net/netlabel/netlabel_user.h
  11185. index 4a397cde1a48..2c608677b43b 100644
  11186. --- linux-4.14.336/net/netlabel/netlabel_user.h
  11187. +++ linux-4.14.336/net/netlabel/netlabel_user.h
  11188. @@ -42,11 +42,9 @@
  11189.  
  11190.  /**
  11191.   * netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg
  11192. - * @skb: the packet
  11193.   * @audit_info: NetLabel audit information
  11194.   */
  11195. -static inline void netlbl_netlink_auditinfo(struct sk_buff *skb,
  11196. -					    struct netlbl_audit *audit_info)
  11197. +static inline void netlbl_netlink_auditinfo(struct netlbl_audit *audit_info)
  11198.  {
  11199.  	security_task_getsecid(current, &audit_info->secid);
  11200.  	audit_info->loginuid = audit_get_loginuid(current);
  11201. diff --git net/netlink/af_netlink.c net/netlink/af_netlink.c
  11202. index 89ece1f093e2..ee42244aada1 100644
  11203. --- linux-4.14.336/net/netlink/af_netlink.c
  11204. +++ linux-4.14.336/net/netlink/af_netlink.c
  11205. @@ -162,7 +162,7 @@ static inline u32 netlink_group_mask(u32 group)
  11206.  static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb,
  11207.  					   gfp_t gfp_mask)
  11208.  {
  11209. -	unsigned int len = skb_end_offset(skb);
  11210. +	unsigned int len = skb->len;
  11211.  	struct sk_buff *new;
  11212.  
  11213.  	new = alloc_skb(len, gfp_mask);
  11214. @@ -342,7 +342,7 @@ static void netlink_skb_destructor(struct sk_buff *skb)
  11215.  	if (is_vmalloc_addr(skb->head)) {
  11216.  		if (!skb->cloned ||
  11217.  		    !atomic_dec_return(&(skb_shinfo(skb)->dataref)))
  11218. -			vfree(skb->head);
  11219. +			vfree_atomic(skb->head);
  11220.  
  11221.  		skb->head = NULL;
  11222.  	}
  11223. diff --git net/nfc/nci/core.c net/nfc/nci/core.c
  11224. index d42c603dd635..2d9934dbbead 100644
  11225. --- linux-4.14.336/net/nfc/nci/core.c
  11226. +++ linux-4.14.336/net/nfc/nci/core.c
  11227. @@ -1209,6 +1209,10 @@ void nci_free_device(struct nci_dev *ndev)
  11228.  {
  11229.  	nfc_free_device(ndev->nfc_dev);
  11230.  	nci_hci_deallocate(ndev);
  11231. +
  11232. +	/* drop partial rx data packet if present */
  11233. +	if (ndev->rx_data_reassembly)
  11234. +		kfree_skb(ndev->rx_data_reassembly);
  11235.  	kfree(ndev);
  11236.  }
  11237.  EXPORT_SYMBOL(nci_free_device);
  11238. diff --git net/packet/af_packet.c net/packet/af_packet.c
  11239. index ea29453fcf7a..6a02cf8d7141 100644
  11240. --- linux-4.14.336/net/packet/af_packet.c
  11241. +++ linux-4.14.336/net/packet/af_packet.c
  11242. @@ -1890,7 +1890,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
  11243.  	 */
  11244.  
  11245.  	spkt->spkt_family = dev->type;
  11246. -	strlcpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
  11247. +	strscpy(spkt->spkt_device, dev->name, sizeof(spkt->spkt_device));
  11248.  	spkt->spkt_protocol = skb->protocol;
  11249.  
  11250.  	/*
  11251. @@ -3537,7 +3537,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
  11252.  	rcu_read_lock();
  11253.  	dev = dev_get_by_index_rcu(sock_net(sk), READ_ONCE(pkt_sk(sk)->ifindex));
  11254.  	if (dev)
  11255. -		strlcpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
  11256. +		strscpy(uaddr->sa_data, dev->name, sizeof(uaddr->sa_data));
  11257.  	rcu_read_unlock();
  11258.  	*uaddr_len = sizeof(*uaddr);
  11259.  
  11260. diff --git net/rds/af_rds.c net/rds/af_rds.c
  11261. index b405f77d664c..2628c1d3844e 100644
  11262. --- linux-4.14.336/net/rds/af_rds.c
  11263. +++ linux-4.14.336/net/rds/af_rds.c
  11264. @@ -315,7 +315,7 @@ static int rds_recv_track_latency(struct rds_sock *rs, char __user *optval,
  11265.  
  11266.  	rs->rs_rx_traces = trace.rx_traces;
  11267.  	for (i = 0; i < rs->rs_rx_traces; i++) {
  11268. -		if (trace.rx_trace_pos[i] > RDS_MSG_RX_DGRAM_TRACE_MAX) {
  11269. +		if (trace.rx_trace_pos[i] >= RDS_MSG_RX_DGRAM_TRACE_MAX) {
  11270.  			rs->rs_rx_traces = 0;
  11271.  			return -EFAULT;
  11272.  		}
  11273. diff --git net/rxrpc/conn_event.c net/rxrpc/conn_event.c
  11274. index 2432c118397f..8d14aebae621 100644
  11275. --- linux-4.14.336/net/rxrpc/conn_event.c
  11276. +++ linux-4.14.336/net/rxrpc/conn_event.c
  11277. @@ -48,6 +48,14 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
  11278.  
  11279.  	_enter("%d", conn->debug_id);
  11280.  
  11281. +	if (sp && sp->hdr.type == RXRPC_PACKET_TYPE_ACK) {
  11282. +		if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header),
  11283. +				  &pkt.ack, sizeof(pkt.ack)) < 0)
  11284. +			return;
  11285. +		if (pkt.ack.reason == RXRPC_ACK_PING_RESPONSE)
  11286. +			return;
  11287. +	}
  11288. +
  11289.  	chan = &conn->channels[sp->hdr.cid & RXRPC_CHANNELMASK];
  11290.  
  11291.  	/* If the last call got moved on whilst we were waiting to run, just
  11292. diff --git net/rxrpc/conn_service.c net/rxrpc/conn_service.c
  11293. index f6fcdb3130a1..7c5745997cd4 100644
  11294. --- linux-4.14.336/net/rxrpc/conn_service.c
  11295. +++ linux-4.14.336/net/rxrpc/conn_service.c
  11296. @@ -29,7 +29,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
  11297.  	struct rxrpc_conn_proto k;
  11298.  	struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
  11299.  	struct rb_node *p;
  11300. -	unsigned int seq = 0;
  11301. +	unsigned int seq = 1;
  11302.  
  11303.  	k.epoch	= sp->hdr.epoch;
  11304.  	k.cid	= sp->hdr.cid & RXRPC_CIDMASK;
  11305. @@ -39,6 +39,7 @@ struct rxrpc_connection *rxrpc_find_service_conn_rcu(struct rxrpc_peer *peer,
  11306.  		 * under just the RCU read lock, so we have to check for
  11307.  		 * changes.
  11308.  		 */
  11309. +		seq++; /* 2 on the 1st/lockless path, otherwise odd */
  11310.  		read_seqbegin_or_lock(&peer->service_conn_lock, &seq);
  11311.  
  11312.  		p = rcu_dereference_raw(peer->service_conns.rb_node);
  11313. diff --git net/sched/Kconfig net/sched/Kconfig
  11314. index 782114a230ae..1a3ee928c57c 100644
  11315. --- linux-4.14.336/net/sched/Kconfig
  11316. +++ linux-4.14.336/net/sched/Kconfig
  11317. @@ -44,23 +44,6 @@ if NET_SCHED
  11318.  
  11319.  comment "Queueing/Scheduling"
  11320.  
  11321. -config NET_SCH_CBQ
  11322. -	tristate "Class Based Queueing (CBQ)"
  11323. -	---help---
  11324. -	  Say Y here if you want to use the Class-Based Queueing (CBQ) packet
  11325. -	  scheduling algorithm. This algorithm classifies the waiting packets
  11326. -	  into a tree-like hierarchy of classes; the leaves of this tree are
  11327. -	  in turn scheduled by separate algorithms.
  11328. -
  11329. -	  See the top of <file:net/sched/sch_cbq.c> for more details.
  11330. -
  11331. -	  CBQ is a commonly used scheduler, so if you're unsure, you should
  11332. -	  say Y here. Then say Y to all the queueing algorithms below that you
  11333. -	  want to use as leaf disciplines.
  11334. -
  11335. -	  To compile this code as a module, choose M here: the
  11336. -	  module will be called sch_cbq.
  11337. -
  11338.  config NET_SCH_HTB
  11339.  	tristate "Hierarchical Token Bucket (HTB)"
  11340.  	---help---
  11341. @@ -84,20 +67,6 @@ config NET_SCH_HFSC
  11342.  	  To compile this code as a module, choose M here: the
  11343.  	  module will be called sch_hfsc.
  11344.  
  11345. -config NET_SCH_ATM
  11346. -	tristate "ATM Virtual Circuits (ATM)"
  11347. -	depends on ATM
  11348. -	---help---
  11349. -	  Say Y here if you want to use the ATM pseudo-scheduler.  This
  11350. -	  provides a framework for invoking classifiers, which in turn
  11351. -	  select classes of this queuing discipline.  Each class maps
  11352. -	  the flow(s) it is handling to a given virtual circuit.
  11353. -
  11354. -	  See the top of <file:net/sched/sch_atm.c> for more details.
  11355. -
  11356. -	  To compile this code as a module, choose M here: the
  11357. -	  module will be called sch_atm.
  11358. -
  11359.  config NET_SCH_PRIO
  11360.  	tristate "Multi Band Priority Queueing (PRIO)"
  11361.  	---help---
  11362. @@ -183,17 +152,6 @@ config NET_SCH_GRED
  11363.  	  To compile this code as a module, choose M here: the
  11364.  	  module will be called sch_gred.
  11365.  
  11366. -config NET_SCH_DSMARK
  11367. -	tristate "Differentiated Services marker (DSMARK)"
  11368. -	---help---
  11369. -	  Say Y if you want to schedule packets according to the
  11370. -	  Differentiated Services architecture proposed in RFC 2475.
  11371. -	  Technical information on this method, with pointers to associated
  11372. -	  RFCs, is available at <http://www.gta.ufrj.br/diffserv/>.
  11373. -
  11374. -	  To compile this code as a module, choose M here: the
  11375. -	  module will be called sch_dsmark.
  11376. -
  11377.  config NET_SCH_NETEM
  11378.  	tristate "Network emulator (NETEM)"
  11379.  	---help---
  11380. diff --git net/sched/Makefile net/sched/Makefile
  11381. index c156c182f546..b2c2cea1fd91 100644
  11382. --- linux-4.14.336/net/sched/Makefile
  11383. +++ linux-4.14.336/net/sched/Makefile
  11384. @@ -28,20 +28,17 @@ obj-$(CONFIG_NET_IFE_SKBPRIO)	+= act_meta_skbprio.o
  11385.  obj-$(CONFIG_NET_IFE_SKBTCINDEX)	+= act_meta_skbtcindex.o
  11386.  obj-$(CONFIG_NET_ACT_TUNNEL_KEY)+= act_tunnel_key.o
  11387.  obj-$(CONFIG_NET_SCH_FIFO)	+= sch_fifo.o
  11388. -obj-$(CONFIG_NET_SCH_CBQ)	+= sch_cbq.o
  11389.  obj-$(CONFIG_NET_SCH_HTB)	+= sch_htb.o
  11390.  obj-$(CONFIG_NET_SCH_HFSC)	+= sch_hfsc.o
  11391.  obj-$(CONFIG_NET_SCH_RED)	+= sch_red.o
  11392.  obj-$(CONFIG_NET_SCH_GRED)	+= sch_gred.o
  11393.  obj-$(CONFIG_NET_SCH_INGRESS)	+= sch_ingress.o 
  11394. -obj-$(CONFIG_NET_SCH_DSMARK)	+= sch_dsmark.o
  11395.  obj-$(CONFIG_NET_SCH_SFB)	+= sch_sfb.o
  11396.  obj-$(CONFIG_NET_SCH_SFQ)	+= sch_sfq.o
  11397.  obj-$(CONFIG_NET_SCH_TBF)	+= sch_tbf.o
  11398.  obj-$(CONFIG_NET_SCH_TEQL)	+= sch_teql.o
  11399.  obj-$(CONFIG_NET_SCH_PRIO)	+= sch_prio.o
  11400.  obj-$(CONFIG_NET_SCH_MULTIQ)	+= sch_multiq.o
  11401. -obj-$(CONFIG_NET_SCH_ATM)	+= sch_atm.o
  11402.  obj-$(CONFIG_NET_SCH_NETEM)	+= sch_netem.o
  11403.  obj-$(CONFIG_NET_SCH_DRR)	+= sch_drr.o
  11404.  obj-$(CONFIG_NET_SCH_PLUG)	+= sch_plug.o
  11405. diff --git net/sched/sch_atm.c net/sched/sch_atm.c
  11406. deleted file mode 100644
  11407. index 184ce9050457..000000000000
  11408. --- linux-4.14.336/net/sched/sch_atm.c
  11409. +++ linux-4.14.336//dev/null
  11410. @@ -1,701 +0,0 @@
  11411. -/* net/sched/sch_atm.c - ATM VC selection "queueing discipline" */
  11412. -
  11413. -/* Written 1998-2000 by Werner Almesberger, EPFL ICA */
  11414. -
  11415. -#include <linux/module.h>
  11416. -#include <linux/slab.h>
  11417. -#include <linux/init.h>
  11418. -#include <linux/interrupt.h>
  11419. -#include <linux/string.h>
  11420. -#include <linux/errno.h>
  11421. -#include <linux/skbuff.h>
  11422. -#include <linux/atmdev.h>
  11423. -#include <linux/atmclip.h>
  11424. -#include <linux/rtnetlink.h>
  11425. -#include <linux/file.h>		/* for fput */
  11426. -#include <net/netlink.h>
  11427. -#include <net/pkt_sched.h>
  11428. -#include <net/pkt_cls.h>
  11429. -
  11430. -/*
  11431. - * The ATM queuing discipline provides a framework for invoking classifiers
  11432. - * (aka "filters"), which in turn select classes of this queuing discipline.
  11433. - * Each class maps the flow(s) it is handling to a given VC. Multiple classes
  11434. - * may share the same VC.
  11435. - *
  11436. - * When creating a class, VCs are specified by passing the number of the open
  11437. - * socket descriptor by which the calling process references the VC. The kernel
  11438. - * keeps the VC open at least until all classes using it are removed.
  11439. - *
  11440. - * In this file, most functions are named atm_tc_* to avoid confusion with all
  11441. - * the atm_* in net/atm. This naming convention differs from what's used in the
  11442. - * rest of net/sched.
  11443. - *
  11444. - * Known bugs:
  11445. - *  - sometimes messes up the IP stack
  11446. - *  - any manipulations besides the few operations described in the README, are
  11447. - *    untested and likely to crash the system
  11448. - *  - should lock the flow while there is data in the queue (?)
  11449. - */
  11450. -
  11451. -#define VCC2FLOW(vcc) ((struct atm_flow_data *) ((vcc)->user_back))
  11452. -
  11453. -struct atm_flow_data {
  11454. -	struct Qdisc_class_common common;
  11455. -	struct Qdisc		*q;	/* FIFO, TBF, etc. */
  11456. -	struct tcf_proto __rcu	*filter_list;
  11457. -	struct tcf_block	*block;
  11458. -	struct atm_vcc		*vcc;	/* VCC; NULL if VCC is closed */
  11459. -	void			(*old_pop)(struct atm_vcc *vcc,
  11460. -					   struct sk_buff *skb); /* chaining */
  11461. -	struct atm_qdisc_data	*parent;	/* parent qdisc */
  11462. -	struct socket		*sock;		/* for closing */
  11463. -	int			ref;		/* reference count */
  11464. -	struct gnet_stats_basic_packed	bstats;
  11465. -	struct gnet_stats_queue	qstats;
  11466. -	struct list_head	list;
  11467. -	struct atm_flow_data	*excess;	/* flow for excess traffic;
  11468. -						   NULL to set CLP instead */
  11469. -	int			hdr_len;
  11470. -	unsigned char		hdr[0];		/* header data; MUST BE LAST */
  11471. -};
  11472. -
  11473. -struct atm_qdisc_data {
  11474. -	struct atm_flow_data	link;		/* unclassified skbs go here */
  11475. -	struct list_head	flows;		/* NB: "link" is also on this
  11476. -						   list */
  11477. -	struct tasklet_struct	task;		/* dequeue tasklet */
  11478. -};
  11479. -
  11480. -/* ------------------------- Class/flow operations ------------------------- */
  11481. -
  11482. -static inline struct atm_flow_data *lookup_flow(struct Qdisc *sch, u32 classid)
  11483. -{
  11484. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11485. -	struct atm_flow_data *flow;
  11486. -
  11487. -	list_for_each_entry(flow, &p->flows, list) {
  11488. -		if (flow->common.classid == classid)
  11489. -			return flow;
  11490. -	}
  11491. -	return NULL;
  11492. -}
  11493. -
  11494. -static int atm_tc_graft(struct Qdisc *sch, unsigned long arg,
  11495. -			struct Qdisc *new, struct Qdisc **old)
  11496. -{
  11497. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11498. -	struct atm_flow_data *flow = (struct atm_flow_data *)arg;
  11499. -
  11500. -	pr_debug("atm_tc_graft(sch %p,[qdisc %p],flow %p,new %p,old %p)\n",
  11501. -		sch, p, flow, new, old);
  11502. -	if (list_empty(&flow->list))
  11503. -		return -EINVAL;
  11504. -	if (!new)
  11505. -		new = &noop_qdisc;
  11506. -	*old = flow->q;
  11507. -	flow->q = new;
  11508. -	if (*old)
  11509. -		qdisc_reset(*old);
  11510. -	return 0;
  11511. -}
  11512. -
  11513. -static struct Qdisc *atm_tc_leaf(struct Qdisc *sch, unsigned long cl)
  11514. -{
  11515. -	struct atm_flow_data *flow = (struct atm_flow_data *)cl;
  11516. -
  11517. -	pr_debug("atm_tc_leaf(sch %p,flow %p)\n", sch, flow);
  11518. -	return flow ? flow->q : NULL;
  11519. -}
  11520. -
  11521. -static unsigned long atm_tc_find(struct Qdisc *sch, u32 classid)
  11522. -{
  11523. -	struct atm_qdisc_data *p __maybe_unused = qdisc_priv(sch);
  11524. -	struct atm_flow_data *flow;
  11525. -
  11526. -	pr_debug("%s(sch %p,[qdisc %p],classid %x)\n", __func__, sch, p, classid);
  11527. -	flow = lookup_flow(sch, classid);
  11528. -	pr_debug("%s: flow %p\n", __func__, flow);
  11529. -	return (unsigned long)flow;
  11530. -}
  11531. -
  11532. -static unsigned long atm_tc_bind_filter(struct Qdisc *sch,
  11533. -					unsigned long parent, u32 classid)
  11534. -{
  11535. -	struct atm_qdisc_data *p __maybe_unused = qdisc_priv(sch);
  11536. -	struct atm_flow_data *flow;
  11537. -
  11538. -	pr_debug("%s(sch %p,[qdisc %p],classid %x)\n", __func__, sch, p, classid);
  11539. -	flow = lookup_flow(sch, classid);
  11540. -	if (flow)
  11541. -		flow->ref++;
  11542. -	pr_debug("%s: flow %p\n", __func__, flow);
  11543. -	return (unsigned long)flow;
  11544. -}
  11545. -
  11546. -/*
  11547. - * atm_tc_put handles all destructions, including the ones that are explicitly
  11548. - * requested (atm_tc_destroy, etc.). The assumption here is that we never drop
  11549. - * anything that still seems to be in use.
  11550. - */
  11551. -static void atm_tc_put(struct Qdisc *sch, unsigned long cl)
  11552. -{
  11553. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11554. -	struct atm_flow_data *flow = (struct atm_flow_data *)cl;
  11555. -
  11556. -	pr_debug("atm_tc_put(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
  11557. -	if (--flow->ref)
  11558. -		return;
  11559. -	pr_debug("atm_tc_put: destroying\n");
  11560. -	list_del_init(&flow->list);
  11561. -	pr_debug("atm_tc_put: qdisc %p\n", flow->q);
  11562. -	qdisc_destroy(flow->q);
  11563. -	tcf_block_put(flow->block);
  11564. -	if (flow->sock) {
  11565. -		pr_debug("atm_tc_put: f_count %ld\n",
  11566. -			file_count(flow->sock->file));
  11567. -		flow->vcc->pop = flow->old_pop;
  11568. -		sockfd_put(flow->sock);
  11569. -	}
  11570. -	if (flow->excess)
  11571. -		atm_tc_put(sch, (unsigned long)flow->excess);
  11572. -	if (flow != &p->link)
  11573. -		kfree(flow);
  11574. -	/*
  11575. -	 * If flow == &p->link, the qdisc no longer works at this point and
  11576. -	 * needs to be removed. (By the caller of atm_tc_put.)
  11577. -	 */
  11578. -}
  11579. -
  11580. -static void sch_atm_pop(struct atm_vcc *vcc, struct sk_buff *skb)
  11581. -{
  11582. -	struct atm_qdisc_data *p = VCC2FLOW(vcc)->parent;
  11583. -
  11584. -	pr_debug("sch_atm_pop(vcc %p,skb %p,[qdisc %p])\n", vcc, skb, p);
  11585. -	VCC2FLOW(vcc)->old_pop(vcc, skb);
  11586. -	tasklet_schedule(&p->task);
  11587. -}
  11588. -
  11589. -static const u8 llc_oui_ip[] = {
  11590. -	0xaa,			/* DSAP: non-ISO */
  11591. -	0xaa,			/* SSAP: non-ISO */
  11592. -	0x03,			/* Ctrl: Unnumbered Information Command PDU */
  11593. -	0x00,			/* OUI: EtherType */
  11594. -	0x00, 0x00,
  11595. -	0x08, 0x00
  11596. -};				/* Ethertype IP (0800) */
  11597. -
  11598. -static const struct nla_policy atm_policy[TCA_ATM_MAX + 1] = {
  11599. -	[TCA_ATM_FD]		= { .type = NLA_U32 },
  11600. -	[TCA_ATM_EXCESS]	= { .type = NLA_U32 },
  11601. -};
  11602. -
  11603. -static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
  11604. -			 struct nlattr **tca, unsigned long *arg)
  11605. -{
  11606. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11607. -	struct atm_flow_data *flow = (struct atm_flow_data *)*arg;
  11608. -	struct atm_flow_data *excess = NULL;
  11609. -	struct nlattr *opt = tca[TCA_OPTIONS];
  11610. -	struct nlattr *tb[TCA_ATM_MAX + 1];
  11611. -	struct socket *sock;
  11612. -	int fd, error, hdr_len;
  11613. -	void *hdr;
  11614. -
  11615. -	pr_debug("atm_tc_change(sch %p,[qdisc %p],classid %x,parent %x,"
  11616. -		"flow %p,opt %p)\n", sch, p, classid, parent, flow, opt);
  11617. -	/*
  11618. -	 * The concept of parents doesn't apply for this qdisc.
  11619. -	 */
  11620. -	if (parent && parent != TC_H_ROOT && parent != sch->handle)
  11621. -		return -EINVAL;
  11622. -	/*
  11623. -	 * ATM classes cannot be changed. In order to change properties of the
  11624. -	 * ATM connection, that socket needs to be modified directly (via the
  11625. -	 * native ATM API. In order to send a flow to a different VC, the old
  11626. -	 * class needs to be removed and a new one added. (This may be changed
  11627. -	 * later.)
  11628. -	 */
  11629. -	if (flow)
  11630. -		return -EBUSY;
  11631. -	if (opt == NULL)
  11632. -		return -EINVAL;
  11633. -
  11634. -	error = nla_parse_nested(tb, TCA_ATM_MAX, opt, atm_policy, NULL);
  11635. -	if (error < 0)
  11636. -		return error;
  11637. -
  11638. -	if (!tb[TCA_ATM_FD])
  11639. -		return -EINVAL;
  11640. -	fd = nla_get_u32(tb[TCA_ATM_FD]);
  11641. -	pr_debug("atm_tc_change: fd %d\n", fd);
  11642. -	if (tb[TCA_ATM_HDR]) {
  11643. -		hdr_len = nla_len(tb[TCA_ATM_HDR]);
  11644. -		hdr = nla_data(tb[TCA_ATM_HDR]);
  11645. -	} else {
  11646. -		hdr_len = RFC1483LLC_LEN;
  11647. -		hdr = NULL;	/* default LLC/SNAP for IP */
  11648. -	}
  11649. -	if (!tb[TCA_ATM_EXCESS])
  11650. -		excess = NULL;
  11651. -	else {
  11652. -		excess = (struct atm_flow_data *)
  11653. -			atm_tc_find(sch, nla_get_u32(tb[TCA_ATM_EXCESS]));
  11654. -		if (!excess)
  11655. -			return -ENOENT;
  11656. -	}
  11657. -	pr_debug("atm_tc_change: type %d, payload %d, hdr_len %d\n",
  11658. -		 opt->nla_type, nla_len(opt), hdr_len);
  11659. -	sock = sockfd_lookup(fd, &error);
  11660. -	if (!sock)
  11661. -		return error;	/* f_count++ */
  11662. -	pr_debug("atm_tc_change: f_count %ld\n", file_count(sock->file));
  11663. -	if (sock->ops->family != PF_ATMSVC && sock->ops->family != PF_ATMPVC) {
  11664. -		error = -EPROTOTYPE;
  11665. -		goto err_out;
  11666. -	}
  11667. -	/* @@@ should check if the socket is really operational or we'll crash
  11668. -	   on vcc->send */
  11669. -	if (classid) {
  11670. -		if (TC_H_MAJ(classid ^ sch->handle)) {
  11671. -			pr_debug("atm_tc_change: classid mismatch\n");
  11672. -			error = -EINVAL;
  11673. -			goto err_out;
  11674. -		}
  11675. -	} else {
  11676. -		int i;
  11677. -		unsigned long cl;
  11678. -
  11679. -		for (i = 1; i < 0x8000; i++) {
  11680. -			classid = TC_H_MAKE(sch->handle, 0x8000 | i);
  11681. -			cl = atm_tc_find(sch, classid);
  11682. -			if (!cl)
  11683. -				break;
  11684. -		}
  11685. -	}
  11686. -	pr_debug("atm_tc_change: new id %x\n", classid);
  11687. -	flow = kzalloc(sizeof(struct atm_flow_data) + hdr_len, GFP_KERNEL);
  11688. -	pr_debug("atm_tc_change: flow %p\n", flow);
  11689. -	if (!flow) {
  11690. -		error = -ENOBUFS;
  11691. -		goto err_out;
  11692. -	}
  11693. -
  11694. -	error = tcf_block_get(&flow->block, &flow->filter_list);
  11695. -	if (error) {
  11696. -		kfree(flow);
  11697. -		goto err_out;
  11698. -	}
  11699. -
  11700. -	flow->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, classid);
  11701. -	if (!flow->q)
  11702. -		flow->q = &noop_qdisc;
  11703. -	pr_debug("atm_tc_change: qdisc %p\n", flow->q);
  11704. -	flow->sock = sock;
  11705. -	flow->vcc = ATM_SD(sock);	/* speedup */
  11706. -	flow->vcc->user_back = flow;
  11707. -	pr_debug("atm_tc_change: vcc %p\n", flow->vcc);
  11708. -	flow->old_pop = flow->vcc->pop;
  11709. -	flow->parent = p;
  11710. -	flow->vcc->pop = sch_atm_pop;
  11711. -	flow->common.classid = classid;
  11712. -	flow->ref = 1;
  11713. -	flow->excess = excess;
  11714. -	list_add(&flow->list, &p->link.list);
  11715. -	flow->hdr_len = hdr_len;
  11716. -	if (hdr)
  11717. -		memcpy(flow->hdr, hdr, hdr_len);
  11718. -	else
  11719. -		memcpy(flow->hdr, llc_oui_ip, sizeof(llc_oui_ip));
  11720. -	*arg = (unsigned long)flow;
  11721. -	return 0;
  11722. -err_out:
  11723. -	sockfd_put(sock);
  11724. -	return error;
  11725. -}
  11726. -
  11727. -static int atm_tc_delete(struct Qdisc *sch, unsigned long arg)
  11728. -{
  11729. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11730. -	struct atm_flow_data *flow = (struct atm_flow_data *)arg;
  11731. -
  11732. -	pr_debug("atm_tc_delete(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
  11733. -	if (list_empty(&flow->list))
  11734. -		return -EINVAL;
  11735. -	if (rcu_access_pointer(flow->filter_list) || flow == &p->link)
  11736. -		return -EBUSY;
  11737. -	/*
  11738. -	 * Reference count must be 2: one for "keepalive" (set at class
  11739. -	 * creation), and one for the reference held when calling delete.
  11740. -	 */
  11741. -	if (flow->ref < 2) {
  11742. -		pr_err("atm_tc_delete: flow->ref == %d\n", flow->ref);
  11743. -		return -EINVAL;
  11744. -	}
  11745. -	if (flow->ref > 2)
  11746. -		return -EBUSY;	/* catch references via excess, etc. */
  11747. -	atm_tc_put(sch, arg);
  11748. -	return 0;
  11749. -}
  11750. -
  11751. -static void atm_tc_walk(struct Qdisc *sch, struct qdisc_walker *walker)
  11752. -{
  11753. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11754. -	struct atm_flow_data *flow;
  11755. -
  11756. -	pr_debug("atm_tc_walk(sch %p,[qdisc %p],walker %p)\n", sch, p, walker);
  11757. -	if (walker->stop)
  11758. -		return;
  11759. -	list_for_each_entry(flow, &p->flows, list) {
  11760. -		if (walker->count >= walker->skip &&
  11761. -		    walker->fn(sch, (unsigned long)flow, walker) < 0) {
  11762. -			walker->stop = 1;
  11763. -			break;
  11764. -		}
  11765. -		walker->count++;
  11766. -	}
  11767. -}
  11768. -
  11769. -static struct tcf_block *atm_tc_tcf_block(struct Qdisc *sch, unsigned long cl)
  11770. -{
  11771. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11772. -	struct atm_flow_data *flow = (struct atm_flow_data *)cl;
  11773. -
  11774. -	pr_debug("atm_tc_find_tcf(sch %p,[qdisc %p],flow %p)\n", sch, p, flow);
  11775. -	return flow ? flow->block : p->link.block;
  11776. -}
  11777. -
  11778. -/* --------------------------- Qdisc operations ---------------------------- */
  11779. -
  11780. -static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch,
  11781. -			  struct sk_buff **to_free)
  11782. -{
  11783. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11784. -	struct atm_flow_data *flow;
  11785. -	struct tcf_result res;
  11786. -	int result;
  11787. -	int ret = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
  11788. -
  11789. -	pr_debug("atm_tc_enqueue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
  11790. -	result = TC_ACT_OK;	/* be nice to gcc */
  11791. -	flow = NULL;
  11792. -	if (TC_H_MAJ(skb->priority) != sch->handle ||
  11793. -	    !(flow = (struct atm_flow_data *)atm_tc_find(sch, skb->priority))) {
  11794. -		struct tcf_proto *fl;
  11795. -
  11796. -		list_for_each_entry(flow, &p->flows, list) {
  11797. -			fl = rcu_dereference_bh(flow->filter_list);
  11798. -			if (fl) {
  11799. -				result = tcf_classify(skb, fl, &res, true);
  11800. -				if (result < 0)
  11801. -					continue;
  11802. -				if (result == TC_ACT_SHOT)
  11803. -					goto done;
  11804. -
  11805. -				flow = (struct atm_flow_data *)res.class;
  11806. -				if (!flow)
  11807. -					flow = lookup_flow(sch, res.classid);
  11808. -				goto drop;
  11809. -			}
  11810. -		}
  11811. -		flow = NULL;
  11812. -done:
  11813. -		;
  11814. -	}
  11815. -	if (!flow) {
  11816. -		flow = &p->link;
  11817. -	} else {
  11818. -		if (flow->vcc)
  11819. -			ATM_SKB(skb)->atm_options = flow->vcc->atm_options;
  11820. -		/*@@@ looks good ... but it's not supposed to work :-) */
  11821. -#ifdef CONFIG_NET_CLS_ACT
  11822. -		switch (result) {
  11823. -		case TC_ACT_QUEUED:
  11824. -		case TC_ACT_STOLEN:
  11825. -		case TC_ACT_TRAP:
  11826. -			__qdisc_drop(skb, to_free);
  11827. -			return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
  11828. -		case TC_ACT_SHOT:
  11829. -			__qdisc_drop(skb, to_free);
  11830. -			goto drop;
  11831. -		case TC_ACT_RECLASSIFY:
  11832. -			if (flow->excess)
  11833. -				flow = flow->excess;
  11834. -			else
  11835. -				ATM_SKB(skb)->atm_options |= ATM_ATMOPT_CLP;
  11836. -			break;
  11837. -		}
  11838. -#endif
  11839. -	}
  11840. -
  11841. -	ret = qdisc_enqueue(skb, flow->q, to_free);
  11842. -	if (ret != NET_XMIT_SUCCESS) {
  11843. -drop: __maybe_unused
  11844. -		if (net_xmit_drop_count(ret)) {
  11845. -			qdisc_qstats_drop(sch);
  11846. -			if (flow)
  11847. -				flow->qstats.drops++;
  11848. -		}
  11849. -		return ret;
  11850. -	}
  11851. -	/*
  11852. -	 * Okay, this may seem weird. We pretend we've dropped the packet if
  11853. -	 * it goes via ATM. The reason for this is that the outer qdisc
  11854. -	 * expects to be able to q->dequeue the packet later on if we return
  11855. -	 * success at this place. Also, sch->q.qdisc needs to reflect whether
  11856. -	 * there is a packet egligible for dequeuing or not. Note that the
  11857. -	 * statistics of the outer qdisc are necessarily wrong because of all
  11858. -	 * this. There's currently no correct solution for this.
  11859. -	 */
  11860. -	if (flow == &p->link) {
  11861. -		sch->q.qlen++;
  11862. -		return NET_XMIT_SUCCESS;
  11863. -	}
  11864. -	tasklet_schedule(&p->task);
  11865. -	return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
  11866. -}
  11867. -
  11868. -/*
  11869. - * Dequeue packets and send them over ATM. Note that we quite deliberately
  11870. - * avoid checking net_device's flow control here, simply because sch_atm
  11871. - * uses its own channels, which have nothing to do with any CLIP/LANE/or
  11872. - * non-ATM interfaces.
  11873. - */
  11874. -
  11875. -static void sch_atm_dequeue(unsigned long data)
  11876. -{
  11877. -	struct Qdisc *sch = (struct Qdisc *)data;
  11878. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11879. -	struct atm_flow_data *flow;
  11880. -	struct sk_buff *skb;
  11881. -
  11882. -	pr_debug("sch_atm_dequeue(sch %p,[qdisc %p])\n", sch, p);
  11883. -	list_for_each_entry(flow, &p->flows, list) {
  11884. -		if (flow == &p->link)
  11885. -			continue;
  11886. -		/*
  11887. -		 * If traffic is properly shaped, this won't generate nasty
  11888. -		 * little bursts. Otherwise, it may ... (but that's okay)
  11889. -		 */
  11890. -		while ((skb = flow->q->ops->peek(flow->q))) {
  11891. -			if (!atm_may_send(flow->vcc, skb->truesize))
  11892. -				break;
  11893. -
  11894. -			skb = qdisc_dequeue_peeked(flow->q);
  11895. -			if (unlikely(!skb))
  11896. -				break;
  11897. -
  11898. -			qdisc_bstats_update(sch, skb);
  11899. -			bstats_update(&flow->bstats, skb);
  11900. -			pr_debug("atm_tc_dequeue: sending on class %p\n", flow);
  11901. -			/* remove any LL header somebody else has attached */
  11902. -			skb_pull(skb, skb_network_offset(skb));
  11903. -			if (skb_headroom(skb) < flow->hdr_len) {
  11904. -				struct sk_buff *new;
  11905. -
  11906. -				new = skb_realloc_headroom(skb, flow->hdr_len);
  11907. -				dev_kfree_skb(skb);
  11908. -				if (!new)
  11909. -					continue;
  11910. -				skb = new;
  11911. -			}
  11912. -			pr_debug("sch_atm_dequeue: ip %p, data %p\n",
  11913. -				 skb_network_header(skb), skb->data);
  11914. -			ATM_SKB(skb)->vcc = flow->vcc;
  11915. -			memcpy(skb_push(skb, flow->hdr_len), flow->hdr,
  11916. -			       flow->hdr_len);
  11917. -			refcount_add(skb->truesize,
  11918. -				   &sk_atm(flow->vcc)->sk_wmem_alloc);
  11919. -			/* atm.atm_options are already set by atm_tc_enqueue */
  11920. -			flow->vcc->send(flow->vcc, skb);
  11921. -		}
  11922. -	}
  11923. -}
  11924. -
  11925. -static struct sk_buff *atm_tc_dequeue(struct Qdisc *sch)
  11926. -{
  11927. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11928. -	struct sk_buff *skb;
  11929. -
  11930. -	pr_debug("atm_tc_dequeue(sch %p,[qdisc %p])\n", sch, p);
  11931. -	tasklet_schedule(&p->task);
  11932. -	skb = qdisc_dequeue_peeked(p->link.q);
  11933. -	if (skb)
  11934. -		sch->q.qlen--;
  11935. -	return skb;
  11936. -}
  11937. -
  11938. -static struct sk_buff *atm_tc_peek(struct Qdisc *sch)
  11939. -{
  11940. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11941. -
  11942. -	pr_debug("atm_tc_peek(sch %p,[qdisc %p])\n", sch, p);
  11943. -
  11944. -	return p->link.q->ops->peek(p->link.q);
  11945. -}
  11946. -
  11947. -static int atm_tc_init(struct Qdisc *sch, struct nlattr *opt)
  11948. -{
  11949. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11950. -	int err;
  11951. -
  11952. -	pr_debug("atm_tc_init(sch %p,[qdisc %p],opt %p)\n", sch, p, opt);
  11953. -	INIT_LIST_HEAD(&p->flows);
  11954. -	INIT_LIST_HEAD(&p->link.list);
  11955. -	list_add(&p->link.list, &p->flows);
  11956. -	p->link.q = qdisc_create_dflt(sch->dev_queue,
  11957. -				      &pfifo_qdisc_ops, sch->handle);
  11958. -	if (!p->link.q)
  11959. -		p->link.q = &noop_qdisc;
  11960. -	pr_debug("atm_tc_init: link (%p) qdisc %p\n", &p->link, p->link.q);
  11961. -	p->link.vcc = NULL;
  11962. -	p->link.sock = NULL;
  11963. -	p->link.common.classid = sch->handle;
  11964. -	p->link.ref = 1;
  11965. -
  11966. -	err = tcf_block_get(&p->link.block, &p->link.filter_list);
  11967. -	if (err)
  11968. -		return err;
  11969. -
  11970. -	tasklet_init(&p->task, sch_atm_dequeue, (unsigned long)sch);
  11971. -	return 0;
  11972. -}
  11973. -
  11974. -static void atm_tc_reset(struct Qdisc *sch)
  11975. -{
  11976. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11977. -	struct atm_flow_data *flow;
  11978. -
  11979. -	pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p);
  11980. -	list_for_each_entry(flow, &p->flows, list)
  11981. -		qdisc_reset(flow->q);
  11982. -	sch->q.qlen = 0;
  11983. -}
  11984. -
  11985. -static void atm_tc_destroy(struct Qdisc *sch)
  11986. -{
  11987. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  11988. -	struct atm_flow_data *flow, *tmp;
  11989. -
  11990. -	pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
  11991. -	list_for_each_entry(flow, &p->flows, list) {
  11992. -		tcf_block_put(flow->block);
  11993. -		flow->block = NULL;
  11994. -	}
  11995. -
  11996. -	list_for_each_entry_safe(flow, tmp, &p->flows, list) {
  11997. -		if (flow->ref > 1)
  11998. -			pr_err("atm_destroy: %p->ref = %d\n", flow, flow->ref);
  11999. -		atm_tc_put(sch, (unsigned long)flow);
  12000. -	}
  12001. -	tasklet_kill(&p->task);
  12002. -}
  12003. -
  12004. -static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
  12005. -			     struct sk_buff *skb, struct tcmsg *tcm)
  12006. -{
  12007. -	struct atm_qdisc_data *p = qdisc_priv(sch);
  12008. -	struct atm_flow_data *flow = (struct atm_flow_data *)cl;
  12009. -	struct nlattr *nest;
  12010. -
  12011. -	pr_debug("atm_tc_dump_class(sch %p,[qdisc %p],flow %p,skb %p,tcm %p)\n",
  12012. -		sch, p, flow, skb, tcm);
  12013. -	if (list_empty(&flow->list))
  12014. -		return -EINVAL;
  12015. -	tcm->tcm_handle = flow->common.classid;
  12016. -	tcm->tcm_info = flow->q->handle;
  12017. -
  12018. -	nest = nla_nest_start(skb, TCA_OPTIONS);
  12019. -	if (nest == NULL)
  12020. -		goto nla_put_failure;
  12021. -
  12022. -	if (nla_put(skb, TCA_ATM_HDR, flow->hdr_len, flow->hdr))
  12023. -		goto nla_put_failure;
  12024. -	if (flow->vcc) {
  12025. -		struct sockaddr_atmpvc pvc;
  12026. -		int state;
  12027. -
  12028. -		memset(&pvc, 0, sizeof(pvc));
  12029. -		pvc.sap_family = AF_ATMPVC;
  12030. -		pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
  12031. -		pvc.sap_addr.vpi = flow->vcc->vpi;
  12032. -		pvc.sap_addr.vci = flow->vcc->vci;
  12033. -		if (nla_put(skb, TCA_ATM_ADDR, sizeof(pvc), &pvc))
  12034. -			goto nla_put_failure;
  12035. -		state = ATM_VF2VS(flow->vcc->flags);
  12036. -		if (nla_put_u32(skb, TCA_ATM_STATE, state))
  12037. -			goto nla_put_failure;
  12038. -	}
  12039. -	if (flow->excess) {
  12040. -		if (nla_put_u32(skb, TCA_ATM_EXCESS, flow->common.classid))
  12041. -			goto nla_put_failure;
  12042. -	} else {
  12043. -		if (nla_put_u32(skb, TCA_ATM_EXCESS, 0))
  12044. -			goto nla_put_failure;
  12045. -	}
  12046. -	return nla_nest_end(skb, nest);
  12047. -
  12048. -nla_put_failure:
  12049. -	nla_nest_cancel(skb, nest);
  12050. -	return -1;
  12051. -}
  12052. -static int
  12053. -atm_tc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
  12054. -			struct gnet_dump *d)
  12055. -{
  12056. -	struct atm_flow_data *flow = (struct atm_flow_data *)arg;
  12057. -
  12058. -	if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
  12059. -				  d, NULL, &flow->bstats) < 0 ||
  12060. -	    gnet_stats_copy_queue(d, NULL, &flow->qstats, flow->q->q.qlen) < 0)
  12061. -		return -1;
  12062. -
  12063. -	return 0;
  12064. -}
  12065. -
  12066. -static int atm_tc_dump(struct Qdisc *sch, struct sk_buff *skb)
  12067. -{
  12068. -	return 0;
  12069. -}
  12070. -
  12071. -static const struct Qdisc_class_ops atm_class_ops = {
  12072. -	.graft		= atm_tc_graft,
  12073. -	.leaf		= atm_tc_leaf,
  12074. -	.find		= atm_tc_find,
  12075. -	.change		= atm_tc_change,
  12076. -	.delete		= atm_tc_delete,
  12077. -	.walk		= atm_tc_walk,
  12078. -	.tcf_block	= atm_tc_tcf_block,
  12079. -	.bind_tcf	= atm_tc_bind_filter,
  12080. -	.unbind_tcf	= atm_tc_put,
  12081. -	.dump		= atm_tc_dump_class,
  12082. -	.dump_stats	= atm_tc_dump_class_stats,
  12083. -};
  12084. -
  12085. -static struct Qdisc_ops atm_qdisc_ops __read_mostly = {
  12086. -	.cl_ops		= &atm_class_ops,
  12087. -	.id		= "atm",
  12088. -	.priv_size	= sizeof(struct atm_qdisc_data),
  12089. -	.enqueue	= atm_tc_enqueue,
  12090. -	.dequeue	= atm_tc_dequeue,
  12091. -	.peek		= atm_tc_peek,
  12092. -	.init		= atm_tc_init,
  12093. -	.reset		= atm_tc_reset,
  12094. -	.destroy	= atm_tc_destroy,
  12095. -	.dump		= atm_tc_dump,
  12096. -	.owner		= THIS_MODULE,
  12097. -};
  12098. -
  12099. -static int __init atm_init(void)
  12100. -{
  12101. -	return register_qdisc(&atm_qdisc_ops);
  12102. -}
  12103. -
  12104. -static void __exit atm_exit(void)
  12105. -{
  12106. -	unregister_qdisc(&atm_qdisc_ops);
  12107. -}
  12108. -
  12109. -module_init(atm_init)
  12110. -module_exit(atm_exit)
  12111. -MODULE_LICENSE("GPL");
  12112. diff --git net/sched/sch_cbq.c net/sched/sch_cbq.c
  12113. deleted file mode 100644
  12114. index 92ff508367e8..000000000000
  12115. --- linux-4.14.336/net/sched/sch_cbq.c
  12116. +++ linux-4.14.336//dev/null
  12117. @@ -1,1794 +0,0 @@
  12118. -/*
  12119. - * net/sched/sch_cbq.c	Class-Based Queueing discipline.
  12120. - *
  12121. - *		This program is free software; you can redistribute it and/or
  12122. - *		modify it under the terms of the GNU General Public License
  12123. - *		as published by the Free Software Foundation; either version
  12124. - *		2 of the License, or (at your option) any later version.
  12125. - *
  12126. - * Authors:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  12127. - *
  12128. - */
  12129. -
  12130. -#include <linux/module.h>
  12131. -#include <linux/slab.h>
  12132. -#include <linux/types.h>
  12133. -#include <linux/kernel.h>
  12134. -#include <linux/string.h>
  12135. -#include <linux/errno.h>
  12136. -#include <linux/skbuff.h>
  12137. -#include <net/netlink.h>
  12138. -#include <net/pkt_sched.h>
  12139. -#include <net/pkt_cls.h>
  12140. -
  12141. -
  12142. -/*	Class-Based Queueing (CBQ) algorithm.
  12143. -	=======================================
  12144. -
  12145. -	Sources: [1] Sally Floyd and Van Jacobson, "Link-sharing and Resource
  12146. -		 Management Models for Packet Networks",
  12147. -		 IEEE/ACM Transactions on Networking, Vol.3, No.4, 1995
  12148. -
  12149. -		 [2] Sally Floyd, "Notes on CBQ and Guaranteed Service", 1995
  12150. -
  12151. -		 [3] Sally Floyd, "Notes on Class-Based Queueing: Setting
  12152. -		 Parameters", 1996
  12153. -
  12154. -		 [4] Sally Floyd and Michael Speer, "Experimental Results
  12155. -		 for Class-Based Queueing", 1998, not published.
  12156. -
  12157. -	-----------------------------------------------------------------------
  12158. -
  12159. -	Algorithm skeleton was taken from NS simulator cbq.cc.
  12160. -	If someone wants to check this code against the LBL version,
  12161. -	he should take into account that ONLY the skeleton was borrowed,
  12162. -	the implementation is different. Particularly:
  12163. -
  12164. -	--- The WRR algorithm is different. Our version looks more
  12165. -	reasonable (I hope) and works when quanta are allowed to be
  12166. -	less than MTU, which is always the case when real time classes
  12167. -	have small rates. Note, that the statement of [3] is
  12168. -	incomplete, delay may actually be estimated even if class
  12169. -	per-round allotment is less than MTU. Namely, if per-round
  12170. -	allotment is W*r_i, and r_1+...+r_k = r < 1
  12171. -
  12172. -	delay_i <= ([MTU/(W*r_i)]*W*r + W*r + k*MTU)/B
  12173. -
  12174. -	In the worst case we have IntServ estimate with D = W*r+k*MTU
  12175. -	and C = MTU*r. The proof (if correct at all) is trivial.
  12176. -
  12177. -
  12178. -	--- It seems that cbq-2.0 is not very accurate. At least, I cannot
  12179. -	interpret some places, which look like wrong translations
  12180. -	from NS. Anyone is advised to find these differences
  12181. -	and explain to me, why I am wrong 8).
  12182. -
  12183. -	--- Linux has no EOI event, so that we cannot estimate true class
  12184. -	idle time. Workaround is to consider the next dequeue event
  12185. -	as sign that previous packet is finished. This is wrong because of
  12186. -	internal device queueing, but on a permanently loaded link it is true.
  12187. -	Moreover, combined with clock integrator, this scheme looks
  12188. -	very close to an ideal solution.  */
  12189. -
  12190. -struct cbq_sched_data;
  12191. -
  12192. -
  12193. -struct cbq_class {
  12194. -	struct Qdisc_class_common common;
  12195. -	struct cbq_class	*next_alive;	/* next class with backlog in this priority band */
  12196. -
  12197. -/* Parameters */
  12198. -	unsigned char		priority;	/* class priority */
  12199. -	unsigned char		priority2;	/* priority to be used after overlimit */
  12200. -	unsigned char		ewma_log;	/* time constant for idle time calculation */
  12201. -
  12202. -	u32			defmap;
  12203. -
  12204. -	/* Link-sharing scheduler parameters */
  12205. -	long			maxidle;	/* Class parameters: see below. */
  12206. -	long			offtime;
  12207. -	long			minidle;
  12208. -	u32			avpkt;
  12209. -	struct qdisc_rate_table	*R_tab;
  12210. -
  12211. -	/* General scheduler (WRR) parameters */
  12212. -	long			allot;
  12213. -	long			quantum;	/* Allotment per WRR round */
  12214. -	long			weight;		/* Relative allotment: see below */
  12215. -
  12216. -	struct Qdisc		*qdisc;		/* Ptr to CBQ discipline */
  12217. -	struct cbq_class	*split;		/* Ptr to split node */
  12218. -	struct cbq_class	*share;		/* Ptr to LS parent in the class tree */
  12219. -	struct cbq_class	*tparent;	/* Ptr to tree parent in the class tree */
  12220. -	struct cbq_class	*borrow;	/* NULL if class is bandwidth limited;
  12221. -						   parent otherwise */
  12222. -	struct cbq_class	*sibling;	/* Sibling chain */
  12223. -	struct cbq_class	*children;	/* Pointer to children chain */
  12224. -
  12225. -	struct Qdisc		*q;		/* Elementary queueing discipline */
  12226. -
  12227. -
  12228. -/* Variables */
  12229. -	unsigned char		cpriority;	/* Effective priority */
  12230. -	unsigned char		delayed;
  12231. -	unsigned char		level;		/* level of the class in hierarchy:
  12232. -						   0 for leaf classes, and maximal
  12233. -						   level of children + 1 for nodes.
  12234. -						 */
  12235. -
  12236. -	psched_time_t		last;		/* Last end of service */
  12237. -	psched_time_t		undertime;
  12238. -	long			avgidle;
  12239. -	long			deficit;	/* Saved deficit for WRR */
  12240. -	psched_time_t		penalized;
  12241. -	struct gnet_stats_basic_packed bstats;
  12242. -	struct gnet_stats_queue qstats;
  12243. -	struct net_rate_estimator __rcu *rate_est;
  12244. -	struct tc_cbq_xstats	xstats;
  12245. -
  12246. -	struct tcf_proto __rcu	*filter_list;
  12247. -	struct tcf_block	*block;
  12248. -
  12249. -	int			filters;
  12250. -
  12251. -	struct cbq_class	*defaults[TC_PRIO_MAX + 1];
  12252. -};
  12253. -
  12254. -struct cbq_sched_data {
  12255. -	struct Qdisc_class_hash	clhash;			/* Hash table of all classes */
  12256. -	int			nclasses[TC_CBQ_MAXPRIO + 1];
  12257. -	unsigned int		quanta[TC_CBQ_MAXPRIO + 1];
  12258. -
  12259. -	struct cbq_class	link;
  12260. -
  12261. -	unsigned int		activemask;
  12262. -	struct cbq_class	*active[TC_CBQ_MAXPRIO + 1];	/* List of all classes
  12263. -								   with backlog */
  12264. -
  12265. -#ifdef CONFIG_NET_CLS_ACT
  12266. -	struct cbq_class	*rx_class;
  12267. -#endif
  12268. -	struct cbq_class	*tx_class;
  12269. -	struct cbq_class	*tx_borrowed;
  12270. -	int			tx_len;
  12271. -	psched_time_t		now;		/* Cached timestamp */
  12272. -	unsigned int		pmask;
  12273. -
  12274. -	struct hrtimer		delay_timer;
  12275. -	struct qdisc_watchdog	watchdog;	/* Watchdog timer,
  12276. -						   started when CBQ has
  12277. -						   backlog, but cannot
  12278. -						   transmit just now */
  12279. -	psched_tdiff_t		wd_expires;
  12280. -	int			toplevel;
  12281. -	u32			hgenerator;
  12282. -};
  12283. -
  12284. -
  12285. -#define L2T(cl, len)	qdisc_l2t((cl)->R_tab, len)
  12286. -
  12287. -static inline struct cbq_class *
  12288. -cbq_class_lookup(struct cbq_sched_data *q, u32 classid)
  12289. -{
  12290. -	struct Qdisc_class_common *clc;
  12291. -
  12292. -	clc = qdisc_class_find(&q->clhash, classid);
  12293. -	if (clc == NULL)
  12294. -		return NULL;
  12295. -	return container_of(clc, struct cbq_class, common);
  12296. -}
  12297. -
  12298. -#ifdef CONFIG_NET_CLS_ACT
  12299. -
  12300. -static struct cbq_class *
  12301. -cbq_reclassify(struct sk_buff *skb, struct cbq_class *this)
  12302. -{
  12303. -	struct cbq_class *cl;
  12304. -
  12305. -	for (cl = this->tparent; cl; cl = cl->tparent) {
  12306. -		struct cbq_class *new = cl->defaults[TC_PRIO_BESTEFFORT];
  12307. -
  12308. -		if (new != NULL && new != this)
  12309. -			return new;
  12310. -	}
  12311. -	return NULL;
  12312. -}
  12313. -
  12314. -#endif
  12315. -
  12316. -/* Classify packet. The procedure is pretty complicated, but
  12317. - * it allows us to combine link sharing and priority scheduling
  12318. - * transparently.
  12319. - *
  12320. - * Namely, you can put link sharing rules (f.e. route based) at root of CBQ,
  12321. - * so that it resolves to split nodes. Then packets are classified
  12322. - * by logical priority, or a more specific classifier may be attached
  12323. - * to the split node.
  12324. - */
  12325. -
  12326. -static struct cbq_class *
  12327. -cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
  12328. -{
  12329. -	struct cbq_sched_data *q = qdisc_priv(sch);
  12330. -	struct cbq_class *head = &q->link;
  12331. -	struct cbq_class **defmap;
  12332. -	struct cbq_class *cl = NULL;
  12333. -	u32 prio = skb->priority;
  12334. -	struct tcf_proto *fl;
  12335. -	struct tcf_result res;
  12336. -
  12337. -	/*
  12338. -	 *  Step 1. If skb->priority points to one of our classes, use it.
  12339. -	 */
  12340. -	if (TC_H_MAJ(prio ^ sch->handle) == 0 &&
  12341. -	    (cl = cbq_class_lookup(q, prio)) != NULL)
  12342. -		return cl;
  12343. -
  12344. -	*qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
  12345. -	for (;;) {
  12346. -		int result = 0;
  12347. -		defmap = head->defaults;
  12348. -
  12349. -		fl = rcu_dereference_bh(head->filter_list);
  12350. -		/*
  12351. -		 * Step 2+n. Apply classifier.
  12352. -		 */
  12353. -		result = tcf_classify(skb, fl, &res, true);
  12354. -		if (!fl || result < 0)
  12355. -			goto fallback;
  12356. -		if (result == TC_ACT_SHOT)
  12357. -			return NULL;
  12358. -
  12359. -		cl = (void *)res.class;
  12360. -		if (!cl) {
  12361. -			if (TC_H_MAJ(res.classid))
  12362. -				cl = cbq_class_lookup(q, res.classid);
  12363. -			else if ((cl = defmap[res.classid & TC_PRIO_MAX]) == NULL)
  12364. -				cl = defmap[TC_PRIO_BESTEFFORT];
  12365. -
  12366. -			if (cl == NULL)
  12367. -				goto fallback;
  12368. -		}
  12369. -		if (cl->level >= head->level)
  12370. -			goto fallback;
  12371. -#ifdef CONFIG_NET_CLS_ACT
  12372. -		switch (result) {
  12373. -		case TC_ACT_QUEUED:
  12374. -		case TC_ACT_STOLEN:
  12375. -		case TC_ACT_TRAP:
  12376. -			*qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
  12377. -		case TC_ACT_RECLASSIFY:
  12378. -			return cbq_reclassify(skb, cl);
  12379. -		}
  12380. -#endif
  12381. -		if (cl->level == 0)
  12382. -			return cl;
  12383. -
  12384. -		/*
  12385. -		 * Step 3+n. If classifier selected a link sharing class,
  12386. -		 *	   apply agency specific classifier.
  12387. -		 *	   Repeat this procdure until we hit a leaf node.
  12388. -		 */
  12389. -		head = cl;
  12390. -	}
  12391. -
  12392. -fallback:
  12393. -	cl = head;
  12394. -
  12395. -	/*
  12396. -	 * Step 4. No success...
  12397. -	 */
  12398. -	if (TC_H_MAJ(prio) == 0 &&
  12399. -	    !(cl = head->defaults[prio & TC_PRIO_MAX]) &&
  12400. -	    !(cl = head->defaults[TC_PRIO_BESTEFFORT]))
  12401. -		return head;
  12402. -
  12403. -	return cl;
  12404. -}
  12405. -
  12406. -/*
  12407. - * A packet has just been enqueued on the empty class.
  12408. - * cbq_activate_class adds it to the tail of active class list
  12409. - * of its priority band.
  12410. - */
  12411. -
  12412. -static inline void cbq_activate_class(struct cbq_class *cl)
  12413. -{
  12414. -	struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
  12415. -	int prio = cl->cpriority;
  12416. -	struct cbq_class *cl_tail;
  12417. -
  12418. -	cl_tail = q->active[prio];
  12419. -	q->active[prio] = cl;
  12420. -
  12421. -	if (cl_tail != NULL) {
  12422. -		cl->next_alive = cl_tail->next_alive;
  12423. -		cl_tail->next_alive = cl;
  12424. -	} else {
  12425. -		cl->next_alive = cl;
  12426. -		q->activemask |= (1<<prio);
  12427. -	}
  12428. -}
  12429. -
  12430. -/*
  12431. - * Unlink class from active chain.
  12432. - * Note that this same procedure is done directly in cbq_dequeue*
  12433. - * during round-robin procedure.
  12434. - */
  12435. -
  12436. -static void cbq_deactivate_class(struct cbq_class *this)
  12437. -{
  12438. -	struct cbq_sched_data *q = qdisc_priv(this->qdisc);
  12439. -	int prio = this->cpriority;
  12440. -	struct cbq_class *cl;
  12441. -	struct cbq_class *cl_prev = q->active[prio];
  12442. -
  12443. -	do {
  12444. -		cl = cl_prev->next_alive;
  12445. -		if (cl == this) {
  12446. -			cl_prev->next_alive = cl->next_alive;
  12447. -			cl->next_alive = NULL;
  12448. -
  12449. -			if (cl == q->active[prio]) {
  12450. -				q->active[prio] = cl_prev;
  12451. -				if (cl == q->active[prio]) {
  12452. -					q->active[prio] = NULL;
  12453. -					q->activemask &= ~(1<<prio);
  12454. -					return;
  12455. -				}
  12456. -			}
  12457. -			return;
  12458. -		}
  12459. -	} while ((cl_prev = cl) != q->active[prio]);
  12460. -}
  12461. -
  12462. -static void
  12463. -cbq_mark_toplevel(struct cbq_sched_data *q, struct cbq_class *cl)
  12464. -{
  12465. -	int toplevel = q->toplevel;
  12466. -
  12467. -	if (toplevel > cl->level) {
  12468. -		psched_time_t now = psched_get_time();
  12469. -
  12470. -		do {
  12471. -			if (cl->undertime < now) {
  12472. -				q->toplevel = cl->level;
  12473. -				return;
  12474. -			}
  12475. -		} while ((cl = cl->borrow) != NULL && toplevel > cl->level);
  12476. -	}
  12477. -}
  12478. -
  12479. -static int
  12480. -cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch,
  12481. -	    struct sk_buff **to_free)
  12482. -{
  12483. -	struct cbq_sched_data *q = qdisc_priv(sch);
  12484. -	int ret;
  12485. -	struct cbq_class *cl = cbq_classify(skb, sch, &ret);
  12486. -
  12487. -#ifdef CONFIG_NET_CLS_ACT
  12488. -	q->rx_class = cl;
  12489. -#endif
  12490. -	if (cl == NULL) {
  12491. -		if (ret & __NET_XMIT_BYPASS)
  12492. -			qdisc_qstats_drop(sch);
  12493. -		__qdisc_drop(skb, to_free);
  12494. -		return ret;
  12495. -	}
  12496. -
  12497. -	ret = qdisc_enqueue(skb, cl->q, to_free);
  12498. -	if (ret == NET_XMIT_SUCCESS) {
  12499. -		sch->q.qlen++;
  12500. -		cbq_mark_toplevel(q, cl);
  12501. -		if (!cl->next_alive)
  12502. -			cbq_activate_class(cl);
  12503. -		return ret;
  12504. -	}
  12505. -
  12506. -	if (net_xmit_drop_count(ret)) {
  12507. -		qdisc_qstats_drop(sch);
  12508. -		cbq_mark_toplevel(q, cl);
  12509. -		cl->qstats.drops++;
  12510. -	}
  12511. -	return ret;
  12512. -}
  12513. -
  12514. -/* Overlimit action: penalize leaf class by adding offtime */
  12515. -static void cbq_overlimit(struct cbq_class *cl)
  12516. -{
  12517. -	struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
  12518. -	psched_tdiff_t delay = cl->undertime - q->now;
  12519. -
  12520. -	if (!cl->delayed) {
  12521. -		delay += cl->offtime;
  12522. -
  12523. -		/*
  12524. -		 * Class goes to sleep, so that it will have no
  12525. -		 * chance to work avgidle. Let's forgive it 8)
  12526. -		 *
  12527. -		 * BTW cbq-2.0 has a crap in this
  12528. -		 * place, apparently they forgot to shift it by cl->ewma_log.
  12529. -		 */
  12530. -		if (cl->avgidle < 0)
  12531. -			delay -= (-cl->avgidle) - ((-cl->avgidle) >> cl->ewma_log);
  12532. -		if (cl->avgidle < cl->minidle)
  12533. -			cl->avgidle = cl->minidle;
  12534. -		if (delay <= 0)
  12535. -			delay = 1;
  12536. -		cl->undertime = q->now + delay;
  12537. -
  12538. -		cl->xstats.overactions++;
  12539. -		cl->delayed = 1;
  12540. -	}
  12541. -	if (q->wd_expires == 0 || q->wd_expires > delay)
  12542. -		q->wd_expires = delay;
  12543. -
  12544. -	/* Dirty work! We must schedule wakeups based on
  12545. -	 * real available rate, rather than leaf rate,
  12546. -	 * which may be tiny (even zero).
  12547. -	 */
  12548. -	if (q->toplevel == TC_CBQ_MAXLEVEL) {
  12549. -		struct cbq_class *b;
  12550. -		psched_tdiff_t base_delay = q->wd_expires;
  12551. -
  12552. -		for (b = cl->borrow; b; b = b->borrow) {
  12553. -			delay = b->undertime - q->now;
  12554. -			if (delay < base_delay) {
  12555. -				if (delay <= 0)
  12556. -					delay = 1;
  12557. -				base_delay = delay;
  12558. -			}
  12559. -		}
  12560. -
  12561. -		q->wd_expires = base_delay;
  12562. -	}
  12563. -}
  12564. -
  12565. -static psched_tdiff_t cbq_undelay_prio(struct cbq_sched_data *q, int prio,
  12566. -				       psched_time_t now)
  12567. -{
  12568. -	struct cbq_class *cl;
  12569. -	struct cbq_class *cl_prev = q->active[prio];
  12570. -	psched_time_t sched = now;
  12571. -
  12572. -	if (cl_prev == NULL)
  12573. -		return 0;
  12574. -
  12575. -	do {
  12576. -		cl = cl_prev->next_alive;
  12577. -		if (now - cl->penalized > 0) {
  12578. -			cl_prev->next_alive = cl->next_alive;
  12579. -			cl->next_alive = NULL;
  12580. -			cl->cpriority = cl->priority;
  12581. -			cl->delayed = 0;
  12582. -			cbq_activate_class(cl);
  12583. -
  12584. -			if (cl == q->active[prio]) {
  12585. -				q->active[prio] = cl_prev;
  12586. -				if (cl == q->active[prio]) {
  12587. -					q->active[prio] = NULL;
  12588. -					return 0;
  12589. -				}
  12590. -			}
  12591. -
  12592. -			cl = cl_prev->next_alive;
  12593. -		} else if (sched - cl->penalized > 0)
  12594. -			sched = cl->penalized;
  12595. -	} while ((cl_prev = cl) != q->active[prio]);
  12596. -
  12597. -	return sched - now;
  12598. -}
  12599. -
  12600. -static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
  12601. -{
  12602. -	struct cbq_sched_data *q = container_of(timer, struct cbq_sched_data,
  12603. -						delay_timer);
  12604. -	struct Qdisc *sch = q->watchdog.qdisc;
  12605. -	psched_time_t now;
  12606. -	psched_tdiff_t delay = 0;
  12607. -	unsigned int pmask;
  12608. -
  12609. -	now = psched_get_time();
  12610. -
  12611. -	pmask = q->pmask;
  12612. -	q->pmask = 0;
  12613. -
  12614. -	while (pmask) {
  12615. -		int prio = ffz(~pmask);
  12616. -		psched_tdiff_t tmp;
  12617. -
  12618. -		pmask &= ~(1<<prio);
  12619. -
  12620. -		tmp = cbq_undelay_prio(q, prio, now);
  12621. -		if (tmp > 0) {
  12622. -			q->pmask |= 1<<prio;
  12623. -			if (tmp < delay || delay == 0)
  12624. -				delay = tmp;
  12625. -		}
  12626. -	}
  12627. -
  12628. -	if (delay) {
  12629. -		ktime_t time;
  12630. -
  12631. -		time = 0;
  12632. -		time = ktime_add_ns(time, PSCHED_TICKS2NS(now + delay));
  12633. -		hrtimer_start(&q->delay_timer, time, HRTIMER_MODE_ABS_PINNED);
  12634. -	}
  12635. -
  12636. -	__netif_schedule(qdisc_root(sch));
  12637. -	return HRTIMER_NORESTART;
  12638. -}
  12639. -
  12640. -/*
  12641. - * It is mission critical procedure.
  12642. - *
  12643. - * We "regenerate" toplevel cutoff, if transmitting class
  12644. - * has backlog and it is not regulated. It is not part of
  12645. - * original CBQ description, but looks more reasonable.
  12646. - * Probably, it is wrong. This question needs further investigation.
  12647. - */
  12648. -
  12649. -static inline void
  12650. -cbq_update_toplevel(struct cbq_sched_data *q, struct cbq_class *cl,
  12651. -		    struct cbq_class *borrowed)
  12652. -{
  12653. -	if (cl && q->toplevel >= borrowed->level) {
  12654. -		if (cl->q->q.qlen > 1) {
  12655. -			do {
  12656. -				if (borrowed->undertime == PSCHED_PASTPERFECT) {
  12657. -					q->toplevel = borrowed->level;
  12658. -					return;
  12659. -				}
  12660. -			} while ((borrowed = borrowed->borrow) != NULL);
  12661. -		}
  12662. -#if 0
  12663. -	/* It is not necessary now. Uncommenting it
  12664. -	   will save CPU cycles, but decrease fairness.
  12665. -	 */
  12666. -		q->toplevel = TC_CBQ_MAXLEVEL;
  12667. -#endif
  12668. -	}
  12669. -}
  12670. -
  12671. -static void
  12672. -cbq_update(struct cbq_sched_data *q)
  12673. -{
  12674. -	struct cbq_class *this = q->tx_class;
  12675. -	struct cbq_class *cl = this;
  12676. -	int len = q->tx_len;
  12677. -	psched_time_t now;
  12678. -
  12679. -	q->tx_class = NULL;
  12680. -	/* Time integrator. We calculate EOS time
  12681. -	 * by adding expected packet transmission time.
  12682. -	 */
  12683. -	now = q->now + L2T(&q->link, len);
  12684. -
  12685. -	for ( ; cl; cl = cl->share) {
  12686. -		long avgidle = cl->avgidle;
  12687. -		long idle;
  12688. -
  12689. -		cl->bstats.packets++;
  12690. -		cl->bstats.bytes += len;
  12691. -
  12692. -		/*
  12693. -		 * (now - last) is total time between packet right edges.
  12694. -		 * (last_pktlen/rate) is "virtual" busy time, so that
  12695. -		 *
  12696. -		 *	idle = (now - last) - last_pktlen/rate
  12697. -		 */
  12698. -
  12699. -		idle = now - cl->last;
  12700. -		if ((unsigned long)idle > 128*1024*1024) {
  12701. -			avgidle = cl->maxidle;
  12702. -		} else {
  12703. -			idle -= L2T(cl, len);
  12704. -
  12705. -		/* true_avgidle := (1-W)*true_avgidle + W*idle,
  12706. -		 * where W=2^{-ewma_log}. But cl->avgidle is scaled:
  12707. -		 * cl->avgidle == true_avgidle/W,
  12708. -		 * hence:
  12709. -		 */
  12710. -			avgidle += idle - (avgidle>>cl->ewma_log);
  12711. -		}
  12712. -
  12713. -		if (avgidle <= 0) {
  12714. -			/* Overlimit or at-limit */
  12715. -
  12716. -			if (avgidle < cl->minidle)
  12717. -				avgidle = cl->minidle;
  12718. -
  12719. -			cl->avgidle = avgidle;
  12720. -
  12721. -			/* Calculate expected time, when this class
  12722. -			 * will be allowed to send.
  12723. -			 * It will occur, when:
  12724. -			 * (1-W)*true_avgidle + W*delay = 0, i.e.
  12725. -			 * idle = (1/W - 1)*(-true_avgidle)
  12726. -			 * or
  12727. -			 * idle = (1 - W)*(-cl->avgidle);
  12728. -			 */
  12729. -			idle = (-avgidle) - ((-avgidle) >> cl->ewma_log);
  12730. -
  12731. -			/*
  12732. -			 * That is not all.
  12733. -			 * To maintain the rate allocated to the class,
  12734. -			 * we add to undertime virtual clock,
  12735. -			 * necessary to complete transmitted packet.
  12736. -			 * (len/phys_bandwidth has been already passed
  12737. -			 * to the moment of cbq_update)
  12738. -			 */
  12739. -
  12740. -			idle -= L2T(&q->link, len);
  12741. -			idle += L2T(cl, len);
  12742. -
  12743. -			cl->undertime = now + idle;
  12744. -		} else {
  12745. -			/* Underlimit */
  12746. -
  12747. -			cl->undertime = PSCHED_PASTPERFECT;
  12748. -			if (avgidle > cl->maxidle)
  12749. -				cl->avgidle = cl->maxidle;
  12750. -			else
  12751. -				cl->avgidle = avgidle;
  12752. -		}
  12753. -		if ((s64)(now - cl->last) > 0)
  12754. -			cl->last = now;
  12755. -	}
  12756. -
  12757. -	cbq_update_toplevel(q, this, q->tx_borrowed);
  12758. -}
  12759. -
  12760. -static inline struct cbq_class *
  12761. -cbq_under_limit(struct cbq_class *cl)
  12762. -{
  12763. -	struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
  12764. -	struct cbq_class *this_cl = cl;
  12765. -
  12766. -	if (cl->tparent == NULL)
  12767. -		return cl;
  12768. -
  12769. -	if (cl->undertime == PSCHED_PASTPERFECT || q->now >= cl->undertime) {
  12770. -		cl->delayed = 0;
  12771. -		return cl;
  12772. -	}
  12773. -
  12774. -	do {
  12775. -		/* It is very suspicious place. Now overlimit
  12776. -		 * action is generated for not bounded classes
  12777. -		 * only if link is completely congested.
  12778. -		 * Though it is in agree with ancestor-only paradigm,
  12779. -		 * it looks very stupid. Particularly,
  12780. -		 * it means that this chunk of code will either
  12781. -		 * never be called or result in strong amplification
  12782. -		 * of burstiness. Dangerous, silly, and, however,
  12783. -		 * no another solution exists.
  12784. -		 */
  12785. -		cl = cl->borrow;
  12786. -		if (!cl) {
  12787. -			this_cl->qstats.overlimits++;
  12788. -			cbq_overlimit(this_cl);
  12789. -			return NULL;
  12790. -		}
  12791. -		if (cl->level > q->toplevel)
  12792. -			return NULL;
  12793. -	} while (cl->undertime != PSCHED_PASTPERFECT && q->now < cl->undertime);
  12794. -
  12795. -	cl->delayed = 0;
  12796. -	return cl;
  12797. -}
  12798. -
  12799. -static inline struct sk_buff *
  12800. -cbq_dequeue_prio(struct Qdisc *sch, int prio)
  12801. -{
  12802. -	struct cbq_sched_data *q = qdisc_priv(sch);
  12803. -	struct cbq_class *cl_tail, *cl_prev, *cl;
  12804. -	struct sk_buff *skb;
  12805. -	int deficit;
  12806. -
  12807. -	cl_tail = cl_prev = q->active[prio];
  12808. -	cl = cl_prev->next_alive;
  12809. -
  12810. -	do {
  12811. -		deficit = 0;
  12812. -
  12813. -		/* Start round */
  12814. -		do {
  12815. -			struct cbq_class *borrow = cl;
  12816. -
  12817. -			if (cl->q->q.qlen &&
  12818. -			    (borrow = cbq_under_limit(cl)) == NULL)
  12819. -				goto skip_class;
  12820. -
  12821. -			if (cl->deficit <= 0) {
  12822. -				/* Class exhausted its allotment per
  12823. -				 * this round. Switch to the next one.
  12824. -				 */
  12825. -				deficit = 1;
  12826. -				cl->deficit += cl->quantum;
  12827. -				goto next_class;
  12828. -			}
  12829. -
  12830. -			skb = cl->q->dequeue(cl->q);
  12831. -
  12832. -			/* Class did not give us any skb :-(
  12833. -			 * It could occur even if cl->q->q.qlen != 0
  12834. -			 * f.e. if cl->q == "tbf"
  12835. -			 */
  12836. -			if (skb == NULL)
  12837. -				goto skip_class;
  12838. -
  12839. -			cl->deficit -= qdisc_pkt_len(skb);
  12840. -			q->tx_class = cl;
  12841. -			q->tx_borrowed = borrow;
  12842. -			if (borrow != cl) {
  12843. -#ifndef CBQ_XSTATS_BORROWS_BYTES
  12844. -				borrow->xstats.borrows++;
  12845. -				cl->xstats.borrows++;
  12846. -#else
  12847. -				borrow->xstats.borrows += qdisc_pkt_len(skb);
  12848. -				cl->xstats.borrows += qdisc_pkt_len(skb);
  12849. -#endif
  12850. -			}
  12851. -			q->tx_len = qdisc_pkt_len(skb);
  12852. -
  12853. -			if (cl->deficit <= 0) {
  12854. -				q->active[prio] = cl;
  12855. -				cl = cl->next_alive;
  12856. -				cl->deficit += cl->quantum;
  12857. -			}
  12858. -			return skb;
  12859. -
  12860. -skip_class:
  12861. -			if (cl->q->q.qlen == 0 || prio != cl->cpriority) {
  12862. -				/* Class is empty or penalized.
  12863. -				 * Unlink it from active chain.
  12864. -				 */
  12865. -				cl_prev->next_alive = cl->next_alive;
  12866. -				cl->next_alive = NULL;
  12867. -
  12868. -				/* Did cl_tail point to it? */
  12869. -				if (cl == cl_tail) {
  12870. -					/* Repair it! */
  12871. -					cl_tail = cl_prev;
  12872. -
  12873. -					/* Was it the last class in this band? */
  12874. -					if (cl == cl_tail) {
  12875. -						/* Kill the band! */
  12876. -						q->active[prio] = NULL;
  12877. -						q->activemask &= ~(1<<prio);
  12878. -						if (cl->q->q.qlen)
  12879. -							cbq_activate_class(cl);
  12880. -						return NULL;
  12881. -					}
  12882. -
  12883. -					q->active[prio] = cl_tail;
  12884. -				}
  12885. -				if (cl->q->q.qlen)
  12886. -					cbq_activate_class(cl);
  12887. -
  12888. -				cl = cl_prev;
  12889. -			}
  12890. -
  12891. -next_class:
  12892. -			cl_prev = cl;
  12893. -			cl = cl->next_alive;
  12894. -		} while (cl_prev != cl_tail);
  12895. -	} while (deficit);
  12896. -
  12897. -	q->active[prio] = cl_prev;
  12898. -
  12899. -	return NULL;
  12900. -}
  12901. -
  12902. -static inline struct sk_buff *
  12903. -cbq_dequeue_1(struct Qdisc *sch)
  12904. -{
  12905. -	struct cbq_sched_data *q = qdisc_priv(sch);
  12906. -	struct sk_buff *skb;
  12907. -	unsigned int activemask;
  12908. -
  12909. -	activemask = q->activemask & 0xFF;
  12910. -	while (activemask) {
  12911. -		int prio = ffz(~activemask);
  12912. -		activemask &= ~(1<<prio);
  12913. -		skb = cbq_dequeue_prio(sch, prio);
  12914. -		if (skb)
  12915. -			return skb;
  12916. -	}
  12917. -	return NULL;
  12918. -}
  12919. -
  12920. -static struct sk_buff *
  12921. -cbq_dequeue(struct Qdisc *sch)
  12922. -{
  12923. -	struct sk_buff *skb;
  12924. -	struct cbq_sched_data *q = qdisc_priv(sch);
  12925. -	psched_time_t now;
  12926. -
  12927. -	now = psched_get_time();
  12928. -
  12929. -	if (q->tx_class)
  12930. -		cbq_update(q);
  12931. -
  12932. -	q->now = now;
  12933. -
  12934. -	for (;;) {
  12935. -		q->wd_expires = 0;
  12936. -
  12937. -		skb = cbq_dequeue_1(sch);
  12938. -		if (skb) {
  12939. -			qdisc_bstats_update(sch, skb);
  12940. -			sch->q.qlen--;
  12941. -			return skb;
  12942. -		}
  12943. -
  12944. -		/* All the classes are overlimit.
  12945. -		 *
  12946. -		 * It is possible, if:
  12947. -		 *
  12948. -		 * 1. Scheduler is empty.
  12949. -		 * 2. Toplevel cutoff inhibited borrowing.
  12950. -		 * 3. Root class is overlimit.
  12951. -		 *
  12952. -		 * Reset 2d and 3d conditions and retry.
  12953. -		 *
  12954. -		 * Note, that NS and cbq-2.0 are buggy, peeking
  12955. -		 * an arbitrary class is appropriate for ancestor-only
  12956. -		 * sharing, but not for toplevel algorithm.
  12957. -		 *
  12958. -		 * Our version is better, but slower, because it requires
  12959. -		 * two passes, but it is unavoidable with top-level sharing.
  12960. -		 */
  12961. -
  12962. -		if (q->toplevel == TC_CBQ_MAXLEVEL &&
  12963. -		    q->link.undertime == PSCHED_PASTPERFECT)
  12964. -			break;
  12965. -
  12966. -		q->toplevel = TC_CBQ_MAXLEVEL;
  12967. -		q->link.undertime = PSCHED_PASTPERFECT;
  12968. -	}
  12969. -
  12970. -	/* No packets in scheduler or nobody wants to give them to us :-(
  12971. -	 * Sigh... start watchdog timer in the last case.
  12972. -	 */
  12973. -
  12974. -	if (sch->q.qlen) {
  12975. -		qdisc_qstats_overlimit(sch);
  12976. -		if (q->wd_expires)
  12977. -			qdisc_watchdog_schedule(&q->watchdog,
  12978. -						now + q->wd_expires);
  12979. -	}
  12980. -	return NULL;
  12981. -}
  12982. -
  12983. -/* CBQ class maintanance routines */
  12984. -
  12985. -static void cbq_adjust_levels(struct cbq_class *this)
  12986. -{
  12987. -	if (this == NULL)
  12988. -		return;
  12989. -
  12990. -	do {
  12991. -		int level = 0;
  12992. -		struct cbq_class *cl;
  12993. -
  12994. -		cl = this->children;
  12995. -		if (cl) {
  12996. -			do {
  12997. -				if (cl->level > level)
  12998. -					level = cl->level;
  12999. -			} while ((cl = cl->sibling) != this->children);
  13000. -		}
  13001. -		this->level = level + 1;
  13002. -	} while ((this = this->tparent) != NULL);
  13003. -}
  13004. -
  13005. -static void cbq_normalize_quanta(struct cbq_sched_data *q, int prio)
  13006. -{
  13007. -	struct cbq_class *cl;
  13008. -	unsigned int h;
  13009. -
  13010. -	if (q->quanta[prio] == 0)
  13011. -		return;
  13012. -
  13013. -	for (h = 0; h < q->clhash.hashsize; h++) {
  13014. -		hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
  13015. -			/* BUGGGG... Beware! This expression suffer of
  13016. -			 * arithmetic overflows!
  13017. -			 */
  13018. -			if (cl->priority == prio) {
  13019. -				cl->quantum = (cl->weight*cl->allot*q->nclasses[prio])/
  13020. -					q->quanta[prio];
  13021. -			}
  13022. -			if (cl->quantum <= 0 ||
  13023. -			    cl->quantum > 32*qdisc_dev(cl->qdisc)->mtu) {
  13024. -				pr_warn("CBQ: class %08x has bad quantum==%ld, repaired.\n",
  13025. -					cl->common.classid, cl->quantum);
  13026. -				cl->quantum = qdisc_dev(cl->qdisc)->mtu/2 + 1;
  13027. -			}
  13028. -		}
  13029. -	}
  13030. -}
  13031. -
  13032. -static void cbq_sync_defmap(struct cbq_class *cl)
  13033. -{
  13034. -	struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
  13035. -	struct cbq_class *split = cl->split;
  13036. -	unsigned int h;
  13037. -	int i;
  13038. -
  13039. -	if (split == NULL)
  13040. -		return;
  13041. -
  13042. -	for (i = 0; i <= TC_PRIO_MAX; i++) {
  13043. -		if (split->defaults[i] == cl && !(cl->defmap & (1<<i)))
  13044. -			split->defaults[i] = NULL;
  13045. -	}
  13046. -
  13047. -	for (i = 0; i <= TC_PRIO_MAX; i++) {
  13048. -		int level = split->level;
  13049. -
  13050. -		if (split->defaults[i])
  13051. -			continue;
  13052. -
  13053. -		for (h = 0; h < q->clhash.hashsize; h++) {
  13054. -			struct cbq_class *c;
  13055. -
  13056. -			hlist_for_each_entry(c, &q->clhash.hash[h],
  13057. -					     common.hnode) {
  13058. -				if (c->split == split && c->level < level &&
  13059. -				    c->defmap & (1<<i)) {
  13060. -					split->defaults[i] = c;
  13061. -					level = c->level;
  13062. -				}
  13063. -			}
  13064. -		}
  13065. -	}
  13066. -}
  13067. -
  13068. -static void cbq_change_defmap(struct cbq_class *cl, u32 splitid, u32 def, u32 mask)
  13069. -{
  13070. -	struct cbq_class *split = NULL;
  13071. -
  13072. -	if (splitid == 0) {
  13073. -		split = cl->split;
  13074. -		if (!split)
  13075. -			return;
  13076. -		splitid = split->common.classid;
  13077. -	}
  13078. -
  13079. -	if (split == NULL || split->common.classid != splitid) {
  13080. -		for (split = cl->tparent; split; split = split->tparent)
  13081. -			if (split->common.classid == splitid)
  13082. -				break;
  13083. -	}
  13084. -
  13085. -	if (split == NULL)
  13086. -		return;
  13087. -
  13088. -	if (cl->split != split) {
  13089. -		cl->defmap = 0;
  13090. -		cbq_sync_defmap(cl);
  13091. -		cl->split = split;
  13092. -		cl->defmap = def & mask;
  13093. -	} else
  13094. -		cl->defmap = (cl->defmap & ~mask) | (def & mask);
  13095. -
  13096. -	cbq_sync_defmap(cl);
  13097. -}
  13098. -
  13099. -static void cbq_unlink_class(struct cbq_class *this)
  13100. -{
  13101. -	struct cbq_class *cl, **clp;
  13102. -	struct cbq_sched_data *q = qdisc_priv(this->qdisc);
  13103. -
  13104. -	qdisc_class_hash_remove(&q->clhash, &this->common);
  13105. -
  13106. -	if (this->tparent) {
  13107. -		clp = &this->sibling;
  13108. -		cl = *clp;
  13109. -		do {
  13110. -			if (cl == this) {
  13111. -				*clp = cl->sibling;
  13112. -				break;
  13113. -			}
  13114. -			clp = &cl->sibling;
  13115. -		} while ((cl = *clp) != this->sibling);
  13116. -
  13117. -		if (this->tparent->children == this) {
  13118. -			this->tparent->children = this->sibling;
  13119. -			if (this->sibling == this)
  13120. -				this->tparent->children = NULL;
  13121. -		}
  13122. -	} else {
  13123. -		WARN_ON(this->sibling != this);
  13124. -	}
  13125. -}
  13126. -
  13127. -static void cbq_link_class(struct cbq_class *this)
  13128. -{
  13129. -	struct cbq_sched_data *q = qdisc_priv(this->qdisc);
  13130. -	struct cbq_class *parent = this->tparent;
  13131. -
  13132. -	this->sibling = this;
  13133. -	qdisc_class_hash_insert(&q->clhash, &this->common);
  13134. -
  13135. -	if (parent == NULL)
  13136. -		return;
  13137. -
  13138. -	if (parent->children == NULL) {
  13139. -		parent->children = this;
  13140. -	} else {
  13141. -		this->sibling = parent->children->sibling;
  13142. -		parent->children->sibling = this;
  13143. -	}
  13144. -}
  13145. -
  13146. -static void
  13147. -cbq_reset(struct Qdisc *sch)
  13148. -{
  13149. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13150. -	struct cbq_class *cl;
  13151. -	int prio;
  13152. -	unsigned int h;
  13153. -
  13154. -	q->activemask = 0;
  13155. -	q->pmask = 0;
  13156. -	q->tx_class = NULL;
  13157. -	q->tx_borrowed = NULL;
  13158. -	qdisc_watchdog_cancel(&q->watchdog);
  13159. -	hrtimer_cancel(&q->delay_timer);
  13160. -	q->toplevel = TC_CBQ_MAXLEVEL;
  13161. -	q->now = psched_get_time();
  13162. -
  13163. -	for (prio = 0; prio <= TC_CBQ_MAXPRIO; prio++)
  13164. -		q->active[prio] = NULL;
  13165. -
  13166. -	for (h = 0; h < q->clhash.hashsize; h++) {
  13167. -		hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
  13168. -			qdisc_reset(cl->q);
  13169. -
  13170. -			cl->next_alive = NULL;
  13171. -			cl->undertime = PSCHED_PASTPERFECT;
  13172. -			cl->avgidle = cl->maxidle;
  13173. -			cl->deficit = cl->quantum;
  13174. -			cl->cpriority = cl->priority;
  13175. -		}
  13176. -	}
  13177. -	sch->q.qlen = 0;
  13178. -}
  13179. -
  13180. -
  13181. -static int cbq_set_lss(struct cbq_class *cl, struct tc_cbq_lssopt *lss)
  13182. -{
  13183. -	if (lss->change & TCF_CBQ_LSS_FLAGS) {
  13184. -		cl->share = (lss->flags & TCF_CBQ_LSS_ISOLATED) ? NULL : cl->tparent;
  13185. -		cl->borrow = (lss->flags & TCF_CBQ_LSS_BOUNDED) ? NULL : cl->tparent;
  13186. -	}
  13187. -	if (lss->change & TCF_CBQ_LSS_EWMA)
  13188. -		cl->ewma_log = lss->ewma_log;
  13189. -	if (lss->change & TCF_CBQ_LSS_AVPKT)
  13190. -		cl->avpkt = lss->avpkt;
  13191. -	if (lss->change & TCF_CBQ_LSS_MINIDLE)
  13192. -		cl->minidle = -(long)lss->minidle;
  13193. -	if (lss->change & TCF_CBQ_LSS_MAXIDLE) {
  13194. -		cl->maxidle = lss->maxidle;
  13195. -		cl->avgidle = lss->maxidle;
  13196. -	}
  13197. -	if (lss->change & TCF_CBQ_LSS_OFFTIME)
  13198. -		cl->offtime = lss->offtime;
  13199. -	return 0;
  13200. -}
  13201. -
  13202. -static void cbq_rmprio(struct cbq_sched_data *q, struct cbq_class *cl)
  13203. -{
  13204. -	q->nclasses[cl->priority]--;
  13205. -	q->quanta[cl->priority] -= cl->weight;
  13206. -	cbq_normalize_quanta(q, cl->priority);
  13207. -}
  13208. -
  13209. -static void cbq_addprio(struct cbq_sched_data *q, struct cbq_class *cl)
  13210. -{
  13211. -	q->nclasses[cl->priority]++;
  13212. -	q->quanta[cl->priority] += cl->weight;
  13213. -	cbq_normalize_quanta(q, cl->priority);
  13214. -}
  13215. -
  13216. -static int cbq_set_wrr(struct cbq_class *cl, struct tc_cbq_wrropt *wrr)
  13217. -{
  13218. -	struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
  13219. -
  13220. -	if (wrr->allot)
  13221. -		cl->allot = wrr->allot;
  13222. -	if (wrr->weight)
  13223. -		cl->weight = wrr->weight;
  13224. -	if (wrr->priority) {
  13225. -		cl->priority = wrr->priority - 1;
  13226. -		cl->cpriority = cl->priority;
  13227. -		if (cl->priority >= cl->priority2)
  13228. -			cl->priority2 = TC_CBQ_MAXPRIO - 1;
  13229. -	}
  13230. -
  13231. -	cbq_addprio(q, cl);
  13232. -	return 0;
  13233. -}
  13234. -
  13235. -static int cbq_set_fopt(struct cbq_class *cl, struct tc_cbq_fopt *fopt)
  13236. -{
  13237. -	cbq_change_defmap(cl, fopt->split, fopt->defmap, fopt->defchange);
  13238. -	return 0;
  13239. -}
  13240. -
  13241. -static const struct nla_policy cbq_policy[TCA_CBQ_MAX + 1] = {
  13242. -	[TCA_CBQ_LSSOPT]	= { .len = sizeof(struct tc_cbq_lssopt) },
  13243. -	[TCA_CBQ_WRROPT]	= { .len = sizeof(struct tc_cbq_wrropt) },
  13244. -	[TCA_CBQ_FOPT]		= { .len = sizeof(struct tc_cbq_fopt) },
  13245. -	[TCA_CBQ_OVL_STRATEGY]	= { .len = sizeof(struct tc_cbq_ovl) },
  13246. -	[TCA_CBQ_RATE]		= { .len = sizeof(struct tc_ratespec) },
  13247. -	[TCA_CBQ_RTAB]		= { .type = NLA_BINARY, .len = TC_RTAB_SIZE },
  13248. -	[TCA_CBQ_POLICE]	= { .len = sizeof(struct tc_cbq_police) },
  13249. -};
  13250. -
  13251. -static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1], struct nlattr *opt)
  13252. -{
  13253. -	int err;
  13254. -
  13255. -	if (!opt)
  13256. -		return -EINVAL;
  13257. -
  13258. -	err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy, NULL);
  13259. -	if (err < 0)
  13260. -		return err;
  13261. -
  13262. -	if (tb[TCA_CBQ_WRROPT]) {
  13263. -		const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]);
  13264. -
  13265. -		if (wrr->priority > TC_CBQ_MAXPRIO)
  13266. -			err = -EINVAL;
  13267. -	}
  13268. -	return err;
  13269. -}
  13270. -
  13271. -static int cbq_init(struct Qdisc *sch, struct nlattr *opt)
  13272. -{
  13273. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13274. -	struct nlattr *tb[TCA_CBQ_MAX + 1];
  13275. -	struct tc_ratespec *r;
  13276. -	int err;
  13277. -
  13278. -	qdisc_watchdog_init(&q->watchdog, sch);
  13279. -	hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
  13280. -	q->delay_timer.function = cbq_undelay;
  13281. -
  13282. -	err = cbq_opt_parse(tb, opt);
  13283. -	if (err < 0)
  13284. -		return err;
  13285. -
  13286. -	if (tb[TCA_CBQ_RTAB] == NULL || tb[TCA_CBQ_RATE] == NULL)
  13287. -		return -EINVAL;
  13288. -
  13289. -	r = nla_data(tb[TCA_CBQ_RATE]);
  13290. -
  13291. -	if ((q->link.R_tab = qdisc_get_rtab(r, tb[TCA_CBQ_RTAB])) == NULL)
  13292. -		return -EINVAL;
  13293. -
  13294. -	err = tcf_block_get(&q->link.block, &q->link.filter_list);
  13295. -	if (err)
  13296. -		goto put_rtab;
  13297. -
  13298. -	err = qdisc_class_hash_init(&q->clhash);
  13299. -	if (err < 0)
  13300. -		goto put_block;
  13301. -
  13302. -	q->link.sibling = &q->link;
  13303. -	q->link.common.classid = sch->handle;
  13304. -	q->link.qdisc = sch;
  13305. -	q->link.q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
  13306. -				      sch->handle);
  13307. -	if (!q->link.q)
  13308. -		q->link.q = &noop_qdisc;
  13309. -	else
  13310. -		qdisc_hash_add(q->link.q, true);
  13311. -
  13312. -	q->link.priority = TC_CBQ_MAXPRIO - 1;
  13313. -	q->link.priority2 = TC_CBQ_MAXPRIO - 1;
  13314. -	q->link.cpriority = TC_CBQ_MAXPRIO - 1;
  13315. -	q->link.allot = psched_mtu(qdisc_dev(sch));
  13316. -	q->link.quantum = q->link.allot;
  13317. -	q->link.weight = q->link.R_tab->rate.rate;
  13318. -
  13319. -	q->link.ewma_log = TC_CBQ_DEF_EWMA;
  13320. -	q->link.avpkt = q->link.allot/2;
  13321. -	q->link.minidle = -0x7FFFFFFF;
  13322. -
  13323. -	q->toplevel = TC_CBQ_MAXLEVEL;
  13324. -	q->now = psched_get_time();
  13325. -
  13326. -	cbq_link_class(&q->link);
  13327. -
  13328. -	if (tb[TCA_CBQ_LSSOPT])
  13329. -		cbq_set_lss(&q->link, nla_data(tb[TCA_CBQ_LSSOPT]));
  13330. -
  13331. -	cbq_addprio(q, &q->link);
  13332. -	return 0;
  13333. -
  13334. -put_block:
  13335. -	tcf_block_put(q->link.block);
  13336. -
  13337. -put_rtab:
  13338. -	qdisc_put_rtab(q->link.R_tab);
  13339. -	return err;
  13340. -}
  13341. -
  13342. -static int cbq_dump_rate(struct sk_buff *skb, struct cbq_class *cl)
  13343. -{
  13344. -	unsigned char *b = skb_tail_pointer(skb);
  13345. -
  13346. -	if (nla_put(skb, TCA_CBQ_RATE, sizeof(cl->R_tab->rate), &cl->R_tab->rate))
  13347. -		goto nla_put_failure;
  13348. -	return skb->len;
  13349. -
  13350. -nla_put_failure:
  13351. -	nlmsg_trim(skb, b);
  13352. -	return -1;
  13353. -}
  13354. -
  13355. -static int cbq_dump_lss(struct sk_buff *skb, struct cbq_class *cl)
  13356. -{
  13357. -	unsigned char *b = skb_tail_pointer(skb);
  13358. -	struct tc_cbq_lssopt opt;
  13359. -
  13360. -	opt.flags = 0;
  13361. -	if (cl->borrow == NULL)
  13362. -		opt.flags |= TCF_CBQ_LSS_BOUNDED;
  13363. -	if (cl->share == NULL)
  13364. -		opt.flags |= TCF_CBQ_LSS_ISOLATED;
  13365. -	opt.ewma_log = cl->ewma_log;
  13366. -	opt.level = cl->level;
  13367. -	opt.avpkt = cl->avpkt;
  13368. -	opt.maxidle = cl->maxidle;
  13369. -	opt.minidle = (u32)(-cl->minidle);
  13370. -	opt.offtime = cl->offtime;
  13371. -	opt.change = ~0;
  13372. -	if (nla_put(skb, TCA_CBQ_LSSOPT, sizeof(opt), &opt))
  13373. -		goto nla_put_failure;
  13374. -	return skb->len;
  13375. -
  13376. -nla_put_failure:
  13377. -	nlmsg_trim(skb, b);
  13378. -	return -1;
  13379. -}
  13380. -
  13381. -static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
  13382. -{
  13383. -	unsigned char *b = skb_tail_pointer(skb);
  13384. -	struct tc_cbq_wrropt opt;
  13385. -
  13386. -	memset(&opt, 0, sizeof(opt));
  13387. -	opt.flags = 0;
  13388. -	opt.allot = cl->allot;
  13389. -	opt.priority = cl->priority + 1;
  13390. -	opt.cpriority = cl->cpriority + 1;
  13391. -	opt.weight = cl->weight;
  13392. -	if (nla_put(skb, TCA_CBQ_WRROPT, sizeof(opt), &opt))
  13393. -		goto nla_put_failure;
  13394. -	return skb->len;
  13395. -
  13396. -nla_put_failure:
  13397. -	nlmsg_trim(skb, b);
  13398. -	return -1;
  13399. -}
  13400. -
  13401. -static int cbq_dump_fopt(struct sk_buff *skb, struct cbq_class *cl)
  13402. -{
  13403. -	unsigned char *b = skb_tail_pointer(skb);
  13404. -	struct tc_cbq_fopt opt;
  13405. -
  13406. -	if (cl->split || cl->defmap) {
  13407. -		opt.split = cl->split ? cl->split->common.classid : 0;
  13408. -		opt.defmap = cl->defmap;
  13409. -		opt.defchange = ~0;
  13410. -		if (nla_put(skb, TCA_CBQ_FOPT, sizeof(opt), &opt))
  13411. -			goto nla_put_failure;
  13412. -	}
  13413. -	return skb->len;
  13414. -
  13415. -nla_put_failure:
  13416. -	nlmsg_trim(skb, b);
  13417. -	return -1;
  13418. -}
  13419. -
  13420. -static int cbq_dump_attr(struct sk_buff *skb, struct cbq_class *cl)
  13421. -{
  13422. -	if (cbq_dump_lss(skb, cl) < 0 ||
  13423. -	    cbq_dump_rate(skb, cl) < 0 ||
  13424. -	    cbq_dump_wrr(skb, cl) < 0 ||
  13425. -	    cbq_dump_fopt(skb, cl) < 0)
  13426. -		return -1;
  13427. -	return 0;
  13428. -}
  13429. -
  13430. -static int cbq_dump(struct Qdisc *sch, struct sk_buff *skb)
  13431. -{
  13432. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13433. -	struct nlattr *nest;
  13434. -
  13435. -	nest = nla_nest_start(skb, TCA_OPTIONS);
  13436. -	if (nest == NULL)
  13437. -		goto nla_put_failure;
  13438. -	if (cbq_dump_attr(skb, &q->link) < 0)
  13439. -		goto nla_put_failure;
  13440. -	return nla_nest_end(skb, nest);
  13441. -
  13442. -nla_put_failure:
  13443. -	nla_nest_cancel(skb, nest);
  13444. -	return -1;
  13445. -}
  13446. -
  13447. -static int
  13448. -cbq_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
  13449. -{
  13450. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13451. -
  13452. -	q->link.xstats.avgidle = q->link.avgidle;
  13453. -	return gnet_stats_copy_app(d, &q->link.xstats, sizeof(q->link.xstats));
  13454. -}
  13455. -
  13456. -static int
  13457. -cbq_dump_class(struct Qdisc *sch, unsigned long arg,
  13458. -	       struct sk_buff *skb, struct tcmsg *tcm)
  13459. -{
  13460. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13461. -	struct nlattr *nest;
  13462. -
  13463. -	if (cl->tparent)
  13464. -		tcm->tcm_parent = cl->tparent->common.classid;
  13465. -	else
  13466. -		tcm->tcm_parent = TC_H_ROOT;
  13467. -	tcm->tcm_handle = cl->common.classid;
  13468. -	tcm->tcm_info = cl->q->handle;
  13469. -
  13470. -	nest = nla_nest_start(skb, TCA_OPTIONS);
  13471. -	if (nest == NULL)
  13472. -		goto nla_put_failure;
  13473. -	if (cbq_dump_attr(skb, cl) < 0)
  13474. -		goto nla_put_failure;
  13475. -	return nla_nest_end(skb, nest);
  13476. -
  13477. -nla_put_failure:
  13478. -	nla_nest_cancel(skb, nest);
  13479. -	return -1;
  13480. -}
  13481. -
  13482. -static int
  13483. -cbq_dump_class_stats(struct Qdisc *sch, unsigned long arg,
  13484. -	struct gnet_dump *d)
  13485. -{
  13486. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13487. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13488. -
  13489. -	cl->xstats.avgidle = cl->avgidle;
  13490. -	cl->xstats.undertime = 0;
  13491. -
  13492. -	if (cl->undertime != PSCHED_PASTPERFECT)
  13493. -		cl->xstats.undertime = cl->undertime - q->now;
  13494. -
  13495. -	if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
  13496. -				  d, NULL, &cl->bstats) < 0 ||
  13497. -	    gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
  13498. -	    gnet_stats_copy_queue(d, NULL, &cl->qstats, cl->q->q.qlen) < 0)
  13499. -		return -1;
  13500. -
  13501. -	return gnet_stats_copy_app(d, &cl->xstats, sizeof(cl->xstats));
  13502. -}
  13503. -
  13504. -static int cbq_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
  13505. -		     struct Qdisc **old)
  13506. -{
  13507. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13508. -
  13509. -	if (new == NULL) {
  13510. -		new = qdisc_create_dflt(sch->dev_queue,
  13511. -					&pfifo_qdisc_ops, cl->common.classid);
  13512. -		if (new == NULL)
  13513. -			return -ENOBUFS;
  13514. -	}
  13515. -
  13516. -	*old = qdisc_replace(sch, new, &cl->q);
  13517. -	return 0;
  13518. -}
  13519. -
  13520. -static struct Qdisc *cbq_leaf(struct Qdisc *sch, unsigned long arg)
  13521. -{
  13522. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13523. -
  13524. -	return cl->q;
  13525. -}
  13526. -
  13527. -static void cbq_qlen_notify(struct Qdisc *sch, unsigned long arg)
  13528. -{
  13529. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13530. -
  13531. -	cbq_deactivate_class(cl);
  13532. -}
  13533. -
  13534. -static unsigned long cbq_find(struct Qdisc *sch, u32 classid)
  13535. -{
  13536. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13537. -
  13538. -	return (unsigned long)cbq_class_lookup(q, classid);
  13539. -}
  13540. -
  13541. -static void cbq_destroy_class(struct Qdisc *sch, struct cbq_class *cl)
  13542. -{
  13543. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13544. -
  13545. -	WARN_ON(cl->filters);
  13546. -
  13547. -	tcf_block_put(cl->block);
  13548. -	qdisc_destroy(cl->q);
  13549. -	qdisc_put_rtab(cl->R_tab);
  13550. -	gen_kill_estimator(&cl->rate_est);
  13551. -	if (cl != &q->link)
  13552. -		kfree(cl);
  13553. -}
  13554. -
  13555. -static void cbq_destroy(struct Qdisc *sch)
  13556. -{
  13557. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13558. -	struct hlist_node *next;
  13559. -	struct cbq_class *cl;
  13560. -	unsigned int h;
  13561. -
  13562. -#ifdef CONFIG_NET_CLS_ACT
  13563. -	q->rx_class = NULL;
  13564. -#endif
  13565. -	/*
  13566. -	 * Filters must be destroyed first because we don't destroy the
  13567. -	 * classes from root to leafs which means that filters can still
  13568. -	 * be bound to classes which have been destroyed already. --TGR '04
  13569. -	 */
  13570. -	for (h = 0; h < q->clhash.hashsize; h++) {
  13571. -		hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
  13572. -			tcf_block_put(cl->block);
  13573. -			cl->block = NULL;
  13574. -		}
  13575. -	}
  13576. -	for (h = 0; h < q->clhash.hashsize; h++) {
  13577. -		hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
  13578. -					  common.hnode)
  13579. -			cbq_destroy_class(sch, cl);
  13580. -	}
  13581. -	qdisc_class_hash_destroy(&q->clhash);
  13582. -}
  13583. -
  13584. -static int
  13585. -cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **tca,
  13586. -		 unsigned long *arg)
  13587. -{
  13588. -	int err;
  13589. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13590. -	struct cbq_class *cl = (struct cbq_class *)*arg;
  13591. -	struct nlattr *opt = tca[TCA_OPTIONS];
  13592. -	struct nlattr *tb[TCA_CBQ_MAX + 1];
  13593. -	struct cbq_class *parent;
  13594. -	struct qdisc_rate_table *rtab = NULL;
  13595. -
  13596. -	err = cbq_opt_parse(tb, opt);
  13597. -	if (err < 0)
  13598. -		return err;
  13599. -
  13600. -	if (tb[TCA_CBQ_OVL_STRATEGY] || tb[TCA_CBQ_POLICE])
  13601. -		return -EOPNOTSUPP;
  13602. -
  13603. -	if (cl) {
  13604. -		/* Check parent */
  13605. -		if (parentid) {
  13606. -			if (cl->tparent &&
  13607. -			    cl->tparent->common.classid != parentid)
  13608. -				return -EINVAL;
  13609. -			if (!cl->tparent && parentid != TC_H_ROOT)
  13610. -				return -EINVAL;
  13611. -		}
  13612. -
  13613. -		if (tb[TCA_CBQ_RATE]) {
  13614. -			rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]),
  13615. -					      tb[TCA_CBQ_RTAB]);
  13616. -			if (rtab == NULL)
  13617. -				return -EINVAL;
  13618. -		}
  13619. -
  13620. -		if (tca[TCA_RATE]) {
  13621. -			err = gen_replace_estimator(&cl->bstats, NULL,
  13622. -						    &cl->rate_est,
  13623. -						    NULL,
  13624. -						    qdisc_root_sleeping_running(sch),
  13625. -						    tca[TCA_RATE]);
  13626. -			if (err) {
  13627. -				qdisc_put_rtab(rtab);
  13628. -				return err;
  13629. -			}
  13630. -		}
  13631. -
  13632. -		/* Change class parameters */
  13633. -		sch_tree_lock(sch);
  13634. -
  13635. -		if (cl->next_alive != NULL)
  13636. -			cbq_deactivate_class(cl);
  13637. -
  13638. -		if (rtab) {
  13639. -			qdisc_put_rtab(cl->R_tab);
  13640. -			cl->R_tab = rtab;
  13641. -		}
  13642. -
  13643. -		if (tb[TCA_CBQ_LSSOPT])
  13644. -			cbq_set_lss(cl, nla_data(tb[TCA_CBQ_LSSOPT]));
  13645. -
  13646. -		if (tb[TCA_CBQ_WRROPT]) {
  13647. -			cbq_rmprio(q, cl);
  13648. -			cbq_set_wrr(cl, nla_data(tb[TCA_CBQ_WRROPT]));
  13649. -		}
  13650. -
  13651. -		if (tb[TCA_CBQ_FOPT])
  13652. -			cbq_set_fopt(cl, nla_data(tb[TCA_CBQ_FOPT]));
  13653. -
  13654. -		if (cl->q->q.qlen)
  13655. -			cbq_activate_class(cl);
  13656. -
  13657. -		sch_tree_unlock(sch);
  13658. -
  13659. -		return 0;
  13660. -	}
  13661. -
  13662. -	if (parentid == TC_H_ROOT)
  13663. -		return -EINVAL;
  13664. -
  13665. -	if (tb[TCA_CBQ_WRROPT] == NULL || tb[TCA_CBQ_RATE] == NULL ||
  13666. -	    tb[TCA_CBQ_LSSOPT] == NULL)
  13667. -		return -EINVAL;
  13668. -
  13669. -	rtab = qdisc_get_rtab(nla_data(tb[TCA_CBQ_RATE]), tb[TCA_CBQ_RTAB]);
  13670. -	if (rtab == NULL)
  13671. -		return -EINVAL;
  13672. -
  13673. -	if (classid) {
  13674. -		err = -EINVAL;
  13675. -		if (TC_H_MAJ(classid ^ sch->handle) ||
  13676. -		    cbq_class_lookup(q, classid))
  13677. -			goto failure;
  13678. -	} else {
  13679. -		int i;
  13680. -		classid = TC_H_MAKE(sch->handle, 0x8000);
  13681. -
  13682. -		for (i = 0; i < 0x8000; i++) {
  13683. -			if (++q->hgenerator >= 0x8000)
  13684. -				q->hgenerator = 1;
  13685. -			if (cbq_class_lookup(q, classid|q->hgenerator) == NULL)
  13686. -				break;
  13687. -		}
  13688. -		err = -ENOSR;
  13689. -		if (i >= 0x8000)
  13690. -			goto failure;
  13691. -		classid = classid|q->hgenerator;
  13692. -	}
  13693. -
  13694. -	parent = &q->link;
  13695. -	if (parentid) {
  13696. -		parent = cbq_class_lookup(q, parentid);
  13697. -		err = -EINVAL;
  13698. -		if (parent == NULL)
  13699. -			goto failure;
  13700. -	}
  13701. -
  13702. -	err = -ENOBUFS;
  13703. -	cl = kzalloc(sizeof(*cl), GFP_KERNEL);
  13704. -	if (cl == NULL)
  13705. -		goto failure;
  13706. -
  13707. -	err = tcf_block_get(&cl->block, &cl->filter_list);
  13708. -	if (err) {
  13709. -		kfree(cl);
  13710. -		goto failure;
  13711. -	}
  13712. -
  13713. -	if (tca[TCA_RATE]) {
  13714. -		err = gen_new_estimator(&cl->bstats, NULL, &cl->rate_est,
  13715. -					NULL,
  13716. -					qdisc_root_sleeping_running(sch),
  13717. -					tca[TCA_RATE]);
  13718. -		if (err) {
  13719. -			tcf_block_put(cl->block);
  13720. -			kfree(cl);
  13721. -			goto failure;
  13722. -		}
  13723. -	}
  13724. -
  13725. -	cl->R_tab = rtab;
  13726. -	rtab = NULL;
  13727. -	cl->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, classid);
  13728. -	if (!cl->q)
  13729. -		cl->q = &noop_qdisc;
  13730. -	else
  13731. -		qdisc_hash_add(cl->q, true);
  13732. -
  13733. -	cl->common.classid = classid;
  13734. -	cl->tparent = parent;
  13735. -	cl->qdisc = sch;
  13736. -	cl->allot = parent->allot;
  13737. -	cl->quantum = cl->allot;
  13738. -	cl->weight = cl->R_tab->rate.rate;
  13739. -
  13740. -	sch_tree_lock(sch);
  13741. -	cbq_link_class(cl);
  13742. -	cl->borrow = cl->tparent;
  13743. -	if (cl->tparent != &q->link)
  13744. -		cl->share = cl->tparent;
  13745. -	cbq_adjust_levels(parent);
  13746. -	cl->minidle = -0x7FFFFFFF;
  13747. -	cbq_set_lss(cl, nla_data(tb[TCA_CBQ_LSSOPT]));
  13748. -	cbq_set_wrr(cl, nla_data(tb[TCA_CBQ_WRROPT]));
  13749. -	if (cl->ewma_log == 0)
  13750. -		cl->ewma_log = q->link.ewma_log;
  13751. -	if (cl->maxidle == 0)
  13752. -		cl->maxidle = q->link.maxidle;
  13753. -	if (cl->avpkt == 0)
  13754. -		cl->avpkt = q->link.avpkt;
  13755. -	if (tb[TCA_CBQ_FOPT])
  13756. -		cbq_set_fopt(cl, nla_data(tb[TCA_CBQ_FOPT]));
  13757. -	sch_tree_unlock(sch);
  13758. -
  13759. -	qdisc_class_hash_grow(sch, &q->clhash);
  13760. -
  13761. -	*arg = (unsigned long)cl;
  13762. -	return 0;
  13763. -
  13764. -failure:
  13765. -	qdisc_put_rtab(rtab);
  13766. -	return err;
  13767. -}
  13768. -
  13769. -static int cbq_delete(struct Qdisc *sch, unsigned long arg)
  13770. -{
  13771. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13772. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13773. -	unsigned int qlen, backlog;
  13774. -
  13775. -	if (cl->filters || cl->children || cl == &q->link)
  13776. -		return -EBUSY;
  13777. -
  13778. -	sch_tree_lock(sch);
  13779. -
  13780. -	qlen = cl->q->q.qlen;
  13781. -	backlog = cl->q->qstats.backlog;
  13782. -	qdisc_reset(cl->q);
  13783. -	qdisc_tree_reduce_backlog(cl->q, qlen, backlog);
  13784. -
  13785. -	if (cl->next_alive)
  13786. -		cbq_deactivate_class(cl);
  13787. -
  13788. -	if (q->tx_borrowed == cl)
  13789. -		q->tx_borrowed = q->tx_class;
  13790. -	if (q->tx_class == cl) {
  13791. -		q->tx_class = NULL;
  13792. -		q->tx_borrowed = NULL;
  13793. -	}
  13794. -#ifdef CONFIG_NET_CLS_ACT
  13795. -	if (q->rx_class == cl)
  13796. -		q->rx_class = NULL;
  13797. -#endif
  13798. -
  13799. -	cbq_unlink_class(cl);
  13800. -	cbq_adjust_levels(cl->tparent);
  13801. -	cl->defmap = 0;
  13802. -	cbq_sync_defmap(cl);
  13803. -
  13804. -	cbq_rmprio(q, cl);
  13805. -	sch_tree_unlock(sch);
  13806. -
  13807. -	cbq_destroy_class(sch, cl);
  13808. -	return 0;
  13809. -}
  13810. -
  13811. -static struct tcf_block *cbq_tcf_block(struct Qdisc *sch, unsigned long arg)
  13812. -{
  13813. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13814. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13815. -
  13816. -	if (cl == NULL)
  13817. -		cl = &q->link;
  13818. -
  13819. -	return cl->block;
  13820. -}
  13821. -
  13822. -static unsigned long cbq_bind_filter(struct Qdisc *sch, unsigned long parent,
  13823. -				     u32 classid)
  13824. -{
  13825. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13826. -	struct cbq_class *p = (struct cbq_class *)parent;
  13827. -	struct cbq_class *cl = cbq_class_lookup(q, classid);
  13828. -
  13829. -	if (cl) {
  13830. -		if (p && p->level <= cl->level)
  13831. -			return 0;
  13832. -		cl->filters++;
  13833. -		return (unsigned long)cl;
  13834. -	}
  13835. -	return 0;
  13836. -}
  13837. -
  13838. -static void cbq_unbind_filter(struct Qdisc *sch, unsigned long arg)
  13839. -{
  13840. -	struct cbq_class *cl = (struct cbq_class *)arg;
  13841. -
  13842. -	cl->filters--;
  13843. -}
  13844. -
  13845. -static void cbq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
  13846. -{
  13847. -	struct cbq_sched_data *q = qdisc_priv(sch);
  13848. -	struct cbq_class *cl;
  13849. -	unsigned int h;
  13850. -
  13851. -	if (arg->stop)
  13852. -		return;
  13853. -
  13854. -	for (h = 0; h < q->clhash.hashsize; h++) {
  13855. -		hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
  13856. -			if (arg->count < arg->skip) {
  13857. -				arg->count++;
  13858. -				continue;
  13859. -			}
  13860. -			if (arg->fn(sch, (unsigned long)cl, arg) < 0) {
  13861. -				arg->stop = 1;
  13862. -				return;
  13863. -			}
  13864. -			arg->count++;
  13865. -		}
  13866. -	}
  13867. -}
  13868. -
  13869. -static const struct Qdisc_class_ops cbq_class_ops = {
  13870. -	.graft		=	cbq_graft,
  13871. -	.leaf		=	cbq_leaf,
  13872. -	.qlen_notify	=	cbq_qlen_notify,
  13873. -	.find		=	cbq_find,
  13874. -	.change		=	cbq_change_class,
  13875. -	.delete		=	cbq_delete,
  13876. -	.walk		=	cbq_walk,
  13877. -	.tcf_block	=	cbq_tcf_block,
  13878. -	.bind_tcf	=	cbq_bind_filter,
  13879. -	.unbind_tcf	=	cbq_unbind_filter,
  13880. -	.dump		=	cbq_dump_class,
  13881. -	.dump_stats	=	cbq_dump_class_stats,
  13882. -};
  13883. -
  13884. -static struct Qdisc_ops cbq_qdisc_ops __read_mostly = {
  13885. -	.next		=	NULL,
  13886. -	.cl_ops		=	&cbq_class_ops,
  13887. -	.id		=	"cbq",
  13888. -	.priv_size	=	sizeof(struct cbq_sched_data),
  13889. -	.enqueue	=	cbq_enqueue,
  13890. -	.dequeue	=	cbq_dequeue,
  13891. -	.peek		=	qdisc_peek_dequeued,
  13892. -	.init		=	cbq_init,
  13893. -	.reset		=	cbq_reset,
  13894. -	.destroy	=	cbq_destroy,
  13895. -	.change		=	NULL,
  13896. -	.dump		=	cbq_dump,
  13897. -	.dump_stats	=	cbq_dump_stats,
  13898. -	.owner		=	THIS_MODULE,
  13899. -};
  13900. -
  13901. -static int __init cbq_module_init(void)
  13902. -{
  13903. -	return register_qdisc(&cbq_qdisc_ops);
  13904. -}
  13905. -static void __exit cbq_module_exit(void)
  13906. -{
  13907. -	unregister_qdisc(&cbq_qdisc_ops);
  13908. -}
  13909. -module_init(cbq_module_init)
  13910. -module_exit(cbq_module_exit)
  13911. -MODULE_LICENSE("GPL");
  13912. diff --git net/sched/sch_dsmark.c net/sched/sch_dsmark.c
  13913. deleted file mode 100644
  13914. index b972d50828ca..000000000000
  13915. --- linux-4.14.336/net/sched/sch_dsmark.c
  13916. +++ linux-4.14.336//dev/null
  13917. @@ -1,514 +0,0 @@
  13918. -/* net/sched/sch_dsmark.c - Differentiated Services field marker */
  13919. -
  13920. -/* Written 1998-2000 by Werner Almesberger, EPFL ICA */
  13921. -
  13922. -
  13923. -#include <linux/module.h>
  13924. -#include <linux/init.h>
  13925. -#include <linux/slab.h>
  13926. -#include <linux/types.h>
  13927. -#include <linux/string.h>
  13928. -#include <linux/errno.h>
  13929. -#include <linux/skbuff.h>
  13930. -#include <linux/rtnetlink.h>
  13931. -#include <linux/bitops.h>
  13932. -#include <net/pkt_sched.h>
  13933. -#include <net/pkt_cls.h>
  13934. -#include <net/dsfield.h>
  13935. -#include <net/inet_ecn.h>
  13936. -#include <asm/byteorder.h>
  13937. -
  13938. -/*
  13939. - * classid	class		marking
  13940. - * -------	-----		-------
  13941. - *   n/a	  0		n/a
  13942. - *   x:0	  1		use entry [0]
  13943. - *   ...	 ...		...
  13944. - *   x:y y>0	 y+1		use entry [y]
  13945. - *   ...	 ...		...
  13946. - * x:indices-1	indices		use entry [indices-1]
  13947. - *   ...	 ...		...
  13948. - *   x:y	 y+1		use entry [y & (indices-1)]
  13949. - *   ...	 ...		...
  13950. - * 0xffff	0x10000		use entry [indices-1]
  13951. - */
  13952. -
  13953. -
  13954. -#define NO_DEFAULT_INDEX	(1 << 16)
  13955. -
  13956. -struct mask_value {
  13957. -	u8			mask;
  13958. -	u8			value;
  13959. -};
  13960. -
  13961. -struct dsmark_qdisc_data {
  13962. -	struct Qdisc		*q;
  13963. -	struct tcf_proto __rcu	*filter_list;
  13964. -	struct tcf_block	*block;
  13965. -	struct mask_value	*mv;
  13966. -	u16			indices;
  13967. -	u8			set_tc_index;
  13968. -	u32			default_index;	/* index range is 0...0xffff */
  13969. -#define DSMARK_EMBEDDED_SZ	16
  13970. -	struct mask_value	embedded[DSMARK_EMBEDDED_SZ];
  13971. -};
  13972. -
  13973. -static inline int dsmark_valid_index(struct dsmark_qdisc_data *p, u16 index)
  13974. -{
  13975. -	return index <= p->indices && index > 0;
  13976. -}
  13977. -
  13978. -/* ------------------------- Class/flow operations ------------------------- */
  13979. -
  13980. -static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
  13981. -			struct Qdisc *new, struct Qdisc **old)
  13982. -{
  13983. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  13984. -
  13985. -	pr_debug("%s(sch %p,[qdisc %p],new %p,old %p)\n",
  13986. -		 __func__, sch, p, new, old);
  13987. -
  13988. -	if (new == NULL) {
  13989. -		new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
  13990. -					sch->handle);
  13991. -		if (new == NULL)
  13992. -			new = &noop_qdisc;
  13993. -	}
  13994. -
  13995. -	*old = qdisc_replace(sch, new, &p->q);
  13996. -	return 0;
  13997. -}
  13998. -
  13999. -static struct Qdisc *dsmark_leaf(struct Qdisc *sch, unsigned long arg)
  14000. -{
  14001. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14002. -	return p->q;
  14003. -}
  14004. -
  14005. -static unsigned long dsmark_find(struct Qdisc *sch, u32 classid)
  14006. -{
  14007. -	return TC_H_MIN(classid) + 1;
  14008. -}
  14009. -
  14010. -static unsigned long dsmark_bind_filter(struct Qdisc *sch,
  14011. -					unsigned long parent, u32 classid)
  14012. -{
  14013. -	pr_debug("%s(sch %p,[qdisc %p],classid %x)\n",
  14014. -		 __func__, sch, qdisc_priv(sch), classid);
  14015. -
  14016. -	return dsmark_find(sch, classid);
  14017. -}
  14018. -
  14019. -static void dsmark_unbind_filter(struct Qdisc *sch, unsigned long cl)
  14020. -{
  14021. -}
  14022. -
  14023. -static const struct nla_policy dsmark_policy[TCA_DSMARK_MAX + 1] = {
  14024. -	[TCA_DSMARK_INDICES]		= { .type = NLA_U16 },
  14025. -	[TCA_DSMARK_DEFAULT_INDEX]	= { .type = NLA_U16 },
  14026. -	[TCA_DSMARK_SET_TC_INDEX]	= { .type = NLA_FLAG },
  14027. -	[TCA_DSMARK_MASK]		= { .type = NLA_U8 },
  14028. -	[TCA_DSMARK_VALUE]		= { .type = NLA_U8 },
  14029. -};
  14030. -
  14031. -static int dsmark_change(struct Qdisc *sch, u32 classid, u32 parent,
  14032. -			 struct nlattr **tca, unsigned long *arg)
  14033. -{
  14034. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14035. -	struct nlattr *opt = tca[TCA_OPTIONS];
  14036. -	struct nlattr *tb[TCA_DSMARK_MAX + 1];
  14037. -	int err = -EINVAL;
  14038. -
  14039. -	pr_debug("%s(sch %p,[qdisc %p],classid %x,parent %x), arg 0x%lx\n",
  14040. -		 __func__, sch, p, classid, parent, *arg);
  14041. -
  14042. -	if (!dsmark_valid_index(p, *arg)) {
  14043. -		err = -ENOENT;
  14044. -		goto errout;
  14045. -	}
  14046. -
  14047. -	if (!opt)
  14048. -		goto errout;
  14049. -
  14050. -	err = nla_parse_nested(tb, TCA_DSMARK_MAX, opt, dsmark_policy, NULL);
  14051. -	if (err < 0)
  14052. -		goto errout;
  14053. -
  14054. -	if (tb[TCA_DSMARK_VALUE])
  14055. -		p->mv[*arg - 1].value = nla_get_u8(tb[TCA_DSMARK_VALUE]);
  14056. -
  14057. -	if (tb[TCA_DSMARK_MASK])
  14058. -		p->mv[*arg - 1].mask = nla_get_u8(tb[TCA_DSMARK_MASK]);
  14059. -
  14060. -	err = 0;
  14061. -
  14062. -errout:
  14063. -	return err;
  14064. -}
  14065. -
  14066. -static int dsmark_delete(struct Qdisc *sch, unsigned long arg)
  14067. -{
  14068. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14069. -
  14070. -	if (!dsmark_valid_index(p, arg))
  14071. -		return -EINVAL;
  14072. -
  14073. -	p->mv[arg - 1].mask = 0xff;
  14074. -	p->mv[arg - 1].value = 0;
  14075. -
  14076. -	return 0;
  14077. -}
  14078. -
  14079. -static void dsmark_walk(struct Qdisc *sch, struct qdisc_walker *walker)
  14080. -{
  14081. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14082. -	int i;
  14083. -
  14084. -	pr_debug("%s(sch %p,[qdisc %p],walker %p)\n",
  14085. -		 __func__, sch, p, walker);
  14086. -
  14087. -	if (walker->stop)
  14088. -		return;
  14089. -
  14090. -	for (i = 0; i < p->indices; i++) {
  14091. -		if (p->mv[i].mask == 0xff && !p->mv[i].value)
  14092. -			goto ignore;
  14093. -		if (walker->count >= walker->skip) {
  14094. -			if (walker->fn(sch, i + 1, walker) < 0) {
  14095. -				walker->stop = 1;
  14096. -				break;
  14097. -			}
  14098. -		}
  14099. -ignore:
  14100. -		walker->count++;
  14101. -	}
  14102. -}
  14103. -
  14104. -static struct tcf_block *dsmark_tcf_block(struct Qdisc *sch, unsigned long cl)
  14105. -{
  14106. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14107. -
  14108. -	return p->block;
  14109. -}
  14110. -
  14111. -/* --------------------------- Qdisc operations ---------------------------- */
  14112. -
  14113. -static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch,
  14114. -			  struct sk_buff **to_free)
  14115. -{
  14116. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14117. -	int err;
  14118. -
  14119. -	pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
  14120. -
  14121. -	if (p->set_tc_index) {
  14122. -		int wlen = skb_network_offset(skb);
  14123. -
  14124. -		switch (tc_skb_protocol(skb)) {
  14125. -		case htons(ETH_P_IP):
  14126. -			wlen += sizeof(struct iphdr);
  14127. -			if (!pskb_may_pull(skb, wlen) ||
  14128. -			    skb_try_make_writable(skb, wlen))
  14129. -				goto drop;
  14130. -
  14131. -			skb->tc_index = ipv4_get_dsfield(ip_hdr(skb))
  14132. -				& ~INET_ECN_MASK;
  14133. -			break;
  14134. -
  14135. -		case htons(ETH_P_IPV6):
  14136. -			wlen += sizeof(struct ipv6hdr);
  14137. -			if (!pskb_may_pull(skb, wlen) ||
  14138. -			    skb_try_make_writable(skb, wlen))
  14139. -				goto drop;
  14140. -
  14141. -			skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb))
  14142. -				& ~INET_ECN_MASK;
  14143. -			break;
  14144. -		default:
  14145. -			skb->tc_index = 0;
  14146. -			break;
  14147. -		}
  14148. -	}
  14149. -
  14150. -	if (TC_H_MAJ(skb->priority) == sch->handle)
  14151. -		skb->tc_index = TC_H_MIN(skb->priority);
  14152. -	else {
  14153. -		struct tcf_result res;
  14154. -		struct tcf_proto *fl = rcu_dereference_bh(p->filter_list);
  14155. -		int result = tcf_classify(skb, fl, &res, false);
  14156. -
  14157. -		pr_debug("result %d class 0x%04x\n", result, res.classid);
  14158. -
  14159. -		switch (result) {
  14160. -#ifdef CONFIG_NET_CLS_ACT
  14161. -		case TC_ACT_QUEUED:
  14162. -		case TC_ACT_STOLEN:
  14163. -		case TC_ACT_TRAP:
  14164. -			__qdisc_drop(skb, to_free);
  14165. -			return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
  14166. -
  14167. -		case TC_ACT_SHOT:
  14168. -			goto drop;
  14169. -#endif
  14170. -		case TC_ACT_OK:
  14171. -			skb->tc_index = TC_H_MIN(res.classid);
  14172. -			break;
  14173. -
  14174. -		default:
  14175. -			if (p->default_index != NO_DEFAULT_INDEX)
  14176. -				skb->tc_index = p->default_index;
  14177. -			break;
  14178. -		}
  14179. -	}
  14180. -
  14181. -	err = qdisc_enqueue(skb, p->q, to_free);
  14182. -	if (err != NET_XMIT_SUCCESS) {
  14183. -		if (net_xmit_drop_count(err))
  14184. -			qdisc_qstats_drop(sch);
  14185. -		return err;
  14186. -	}
  14187. -
  14188. -	qdisc_qstats_backlog_inc(sch, skb);
  14189. -	sch->q.qlen++;
  14190. -
  14191. -	return NET_XMIT_SUCCESS;
  14192. -
  14193. -drop:
  14194. -	qdisc_drop(skb, sch, to_free);
  14195. -	return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
  14196. -}
  14197. -
  14198. -static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
  14199. -{
  14200. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14201. -	struct sk_buff *skb;
  14202. -	u32 index;
  14203. -
  14204. -	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
  14205. -
  14206. -	skb = qdisc_dequeue_peeked(p->q);
  14207. -	if (skb == NULL)
  14208. -		return NULL;
  14209. -
  14210. -	qdisc_bstats_update(sch, skb);
  14211. -	qdisc_qstats_backlog_dec(sch, skb);
  14212. -	sch->q.qlen--;
  14213. -
  14214. -	index = skb->tc_index & (p->indices - 1);
  14215. -	pr_debug("index %d->%d\n", skb->tc_index, index);
  14216. -
  14217. -	switch (tc_skb_protocol(skb)) {
  14218. -	case htons(ETH_P_IP):
  14219. -		ipv4_change_dsfield(ip_hdr(skb), p->mv[index].mask,
  14220. -				    p->mv[index].value);
  14221. -			break;
  14222. -	case htons(ETH_P_IPV6):
  14223. -		ipv6_change_dsfield(ipv6_hdr(skb), p->mv[index].mask,
  14224. -				    p->mv[index].value);
  14225. -			break;
  14226. -	default:
  14227. -		/*
  14228. -		 * Only complain if a change was actually attempted.
  14229. -		 * This way, we can send non-IP traffic through dsmark
  14230. -		 * and don't need yet another qdisc as a bypass.
  14231. -		 */
  14232. -		if (p->mv[index].mask != 0xff || p->mv[index].value)
  14233. -			pr_warn("%s: unsupported protocol %d\n",
  14234. -				__func__, ntohs(tc_skb_protocol(skb)));
  14235. -		break;
  14236. -	}
  14237. -
  14238. -	return skb;
  14239. -}
  14240. -
  14241. -static struct sk_buff *dsmark_peek(struct Qdisc *sch)
  14242. -{
  14243. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14244. -
  14245. -	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
  14246. -
  14247. -	return p->q->ops->peek(p->q);
  14248. -}
  14249. -
  14250. -static int dsmark_init(struct Qdisc *sch, struct nlattr *opt)
  14251. -{
  14252. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14253. -	struct nlattr *tb[TCA_DSMARK_MAX + 1];
  14254. -	int err = -EINVAL;
  14255. -	u32 default_index = NO_DEFAULT_INDEX;
  14256. -	u16 indices;
  14257. -	int i;
  14258. -
  14259. -	pr_debug("%s(sch %p,[qdisc %p],opt %p)\n", __func__, sch, p, opt);
  14260. -
  14261. -	if (!opt)
  14262. -		goto errout;
  14263. -
  14264. -	err = tcf_block_get(&p->block, &p->filter_list);
  14265. -	if (err)
  14266. -		return err;
  14267. -
  14268. -	err = nla_parse_nested(tb, TCA_DSMARK_MAX, opt, dsmark_policy, NULL);
  14269. -	if (err < 0)
  14270. -		goto errout;
  14271. -
  14272. -	err = -EINVAL;
  14273. -	if (!tb[TCA_DSMARK_INDICES])
  14274. -		goto errout;
  14275. -	indices = nla_get_u16(tb[TCA_DSMARK_INDICES]);
  14276. -
  14277. -	if (hweight32(indices) != 1)
  14278. -		goto errout;
  14279. -
  14280. -	if (tb[TCA_DSMARK_DEFAULT_INDEX])
  14281. -		default_index = nla_get_u16(tb[TCA_DSMARK_DEFAULT_INDEX]);
  14282. -
  14283. -	if (indices <= DSMARK_EMBEDDED_SZ)
  14284. -		p->mv = p->embedded;
  14285. -	else
  14286. -		p->mv = kmalloc_array(indices, sizeof(*p->mv), GFP_KERNEL);
  14287. -	if (!p->mv) {
  14288. -		err = -ENOMEM;
  14289. -		goto errout;
  14290. -	}
  14291. -	for (i = 0; i < indices; i++) {
  14292. -		p->mv[i].mask = 0xff;
  14293. -		p->mv[i].value = 0;
  14294. -	}
  14295. -	p->indices = indices;
  14296. -	p->default_index = default_index;
  14297. -	p->set_tc_index = nla_get_flag(tb[TCA_DSMARK_SET_TC_INDEX]);
  14298. -
  14299. -	p->q = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops, sch->handle);
  14300. -	if (p->q == NULL)
  14301. -		p->q = &noop_qdisc;
  14302. -	else
  14303. -		qdisc_hash_add(p->q, true);
  14304. -
  14305. -	pr_debug("%s: qdisc %p\n", __func__, p->q);
  14306. -
  14307. -	err = 0;
  14308. -errout:
  14309. -	return err;
  14310. -}
  14311. -
  14312. -static void dsmark_reset(struct Qdisc *sch)
  14313. -{
  14314. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14315. -
  14316. -	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
  14317. -	if (p->q)
  14318. -		qdisc_reset(p->q);
  14319. -	sch->qstats.backlog = 0;
  14320. -	sch->q.qlen = 0;
  14321. -}
  14322. -
  14323. -static void dsmark_destroy(struct Qdisc *sch)
  14324. -{
  14325. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14326. -
  14327. -	pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
  14328. -
  14329. -	tcf_block_put(p->block);
  14330. -	qdisc_destroy(p->q);
  14331. -	if (p->mv != p->embedded)
  14332. -		kfree(p->mv);
  14333. -}
  14334. -
  14335. -static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
  14336. -			     struct sk_buff *skb, struct tcmsg *tcm)
  14337. -{
  14338. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14339. -	struct nlattr *opts = NULL;
  14340. -
  14341. -	pr_debug("%s(sch %p,[qdisc %p],class %ld\n", __func__, sch, p, cl);
  14342. -
  14343. -	if (!dsmark_valid_index(p, cl))
  14344. -		return -EINVAL;
  14345. -
  14346. -	tcm->tcm_handle = TC_H_MAKE(TC_H_MAJ(sch->handle), cl - 1);
  14347. -	tcm->tcm_info = p->q->handle;
  14348. -
  14349. -	opts = nla_nest_start(skb, TCA_OPTIONS);
  14350. -	if (opts == NULL)
  14351. -		goto nla_put_failure;
  14352. -	if (nla_put_u8(skb, TCA_DSMARK_MASK, p->mv[cl - 1].mask) ||
  14353. -	    nla_put_u8(skb, TCA_DSMARK_VALUE, p->mv[cl - 1].value))
  14354. -		goto nla_put_failure;
  14355. -
  14356. -	return nla_nest_end(skb, opts);
  14357. -
  14358. -nla_put_failure:
  14359. -	nla_nest_cancel(skb, opts);
  14360. -	return -EMSGSIZE;
  14361. -}
  14362. -
  14363. -static int dsmark_dump(struct Qdisc *sch, struct sk_buff *skb)
  14364. -{
  14365. -	struct dsmark_qdisc_data *p = qdisc_priv(sch);
  14366. -	struct nlattr *opts = NULL;
  14367. -
  14368. -	opts = nla_nest_start(skb, TCA_OPTIONS);
  14369. -	if (opts == NULL)
  14370. -		goto nla_put_failure;
  14371. -	if (nla_put_u16(skb, TCA_DSMARK_INDICES, p->indices))
  14372. -		goto nla_put_failure;
  14373. -
  14374. -	if (p->default_index != NO_DEFAULT_INDEX &&
  14375. -	    nla_put_u16(skb, TCA_DSMARK_DEFAULT_INDEX, p->default_index))
  14376. -		goto nla_put_failure;
  14377. -
  14378. -	if (p->set_tc_index &&
  14379. -	    nla_put_flag(skb, TCA_DSMARK_SET_TC_INDEX))
  14380. -		goto nla_put_failure;
  14381. -
  14382. -	return nla_nest_end(skb, opts);
  14383. -
  14384. -nla_put_failure:
  14385. -	nla_nest_cancel(skb, opts);
  14386. -	return -EMSGSIZE;
  14387. -}
  14388. -
  14389. -static const struct Qdisc_class_ops dsmark_class_ops = {
  14390. -	.graft		=	dsmark_graft,
  14391. -	.leaf		=	dsmark_leaf,
  14392. -	.find		=	dsmark_find,
  14393. -	.change		=	dsmark_change,
  14394. -	.delete		=	dsmark_delete,
  14395. -	.walk		=	dsmark_walk,
  14396. -	.tcf_block	=	dsmark_tcf_block,
  14397. -	.bind_tcf	=	dsmark_bind_filter,
  14398. -	.unbind_tcf	=	dsmark_unbind_filter,
  14399. -	.dump		=	dsmark_dump_class,
  14400. -};
  14401. -
  14402. -static struct Qdisc_ops dsmark_qdisc_ops __read_mostly = {
  14403. -	.next		=	NULL,
  14404. -	.cl_ops		=	&dsmark_class_ops,
  14405. -	.id		=	"dsmark",
  14406. -	.priv_size	=	sizeof(struct dsmark_qdisc_data),
  14407. -	.enqueue	=	dsmark_enqueue,
  14408. -	.dequeue	=	dsmark_dequeue,
  14409. -	.peek		=	dsmark_peek,
  14410. -	.init		=	dsmark_init,
  14411. -	.reset		=	dsmark_reset,
  14412. -	.destroy	=	dsmark_destroy,
  14413. -	.change		=	NULL,
  14414. -	.dump		=	dsmark_dump,
  14415. -	.owner		=	THIS_MODULE,
  14416. -};
  14417. -
  14418. -static int __init dsmark_module_init(void)
  14419. -{
  14420. -	return register_qdisc(&dsmark_qdisc_ops);
  14421. -}
  14422. -
  14423. -static void __exit dsmark_module_exit(void)
  14424. -{
  14425. -	unregister_qdisc(&dsmark_qdisc_ops);
  14426. -}
  14427. -
  14428. -module_init(dsmark_module_init)
  14429. -module_exit(dsmark_module_exit)
  14430. -
  14431. -MODULE_LICENSE("GPL");
  14432. diff --git net/sunrpc/xprtmultipath.c net/sunrpc/xprtmultipath.c
  14433. index e2d64c7138c3..699d5ba128fa 100644
  14434. --- linux-4.14.336/net/sunrpc/xprtmultipath.c
  14435. +++ linux-4.14.336/net/sunrpc/xprtmultipath.c
  14436. @@ -235,8 +235,9 @@ struct rpc_xprt *xprt_iter_current_entry(struct rpc_xprt_iter *xpi)
  14437.  	return xprt_switch_find_current_entry(head, xpi->xpi_cursor);
  14438.  }
  14439.  
  14440. -bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
  14441. -			      const struct sockaddr *sap)
  14442. +static
  14443. +bool __rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
  14444. +				const struct sockaddr *sap)
  14445.  {
  14446.  	struct list_head *head;
  14447.  	struct rpc_xprt *pos;
  14448. @@ -255,6 +256,18 @@ bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
  14449.  	return false;
  14450.  }
  14451.  
  14452. +bool rpc_xprt_switch_has_addr(struct rpc_xprt_switch *xps,
  14453. +			      const struct sockaddr *sap)
  14454. +{
  14455. +	bool res;
  14456. +
  14457. +	rcu_read_lock();
  14458. +	res = __rpc_xprt_switch_has_addr(xps, sap);
  14459. +	rcu_read_unlock();
  14460. +
  14461. +	return res;
  14462. +}
  14463. +
  14464.  static
  14465.  struct rpc_xprt *xprt_switch_find_next_entry(struct list_head *head,
  14466.  		const struct rpc_xprt *cur)
  14467. diff --git net/tipc/bearer.c net/tipc/bearer.c
  14468. index 506cbd1b2223..db21e00806f5 100644
  14469. --- linux-4.14.336/net/tipc/bearer.c
  14470. +++ linux-4.14.336/net/tipc/bearer.c
  14471. @@ -931,6 +931,12 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info)
  14472.  
  14473.  #ifdef CONFIG_TIPC_MEDIA_UDP
  14474.  	if (attrs[TIPC_NLA_BEARER_UDP_OPTS]) {
  14475. +		if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) {
  14476. +			rtnl_unlock();
  14477. +			NL_SET_ERR_MSG(info->extack, "UDP option is unsupported");
  14478. +			return -EINVAL;
  14479. +		}
  14480. +
  14481.  		err = tipc_udp_nl_bearer_add(b,
  14482.  					     attrs[TIPC_NLA_BEARER_UDP_OPTS]);
  14483.  		if (err) {
  14484. diff --git net/unix/af_unix.c net/unix/af_unix.c
  14485. index 8d25d50f916e..b1855778acd0 100644
  14486. --- linux-4.14.336/net/unix/af_unix.c
  14487. +++ linux-4.14.336/net/unix/af_unix.c
  14488. @@ -1127,13 +1127,11 @@ static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
  14489.  		unix_state_lock(sk1);
  14490.  		return;
  14491.  	}
  14492. -	if (sk1 < sk2) {
  14493. -		unix_state_lock(sk1);
  14494. -		unix_state_lock_nested(sk2);
  14495. -	} else {
  14496. -		unix_state_lock(sk2);
  14497. -		unix_state_lock_nested(sk1);
  14498. -	}
  14499. +	if (sk1 > sk2)
  14500. +		swap(sk1, sk2);
  14501. +
  14502. +	unix_state_lock(sk1);
  14503. +	unix_state_lock_nested(sk2, U_LOCK_SECOND);
  14504.  }
  14505.  
  14506.  static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
  14507. @@ -1352,7 +1350,7 @@ restart:
  14508.  		goto out_unlock;
  14509.  	}
  14510.  
  14511. -	unix_state_lock_nested(sk);
  14512. +	unix_state_lock_nested(sk, U_LOCK_SECOND);
  14513.  
  14514.  	if (sk->sk_state != st) {
  14515.  		unix_state_unlock(sk);
  14516. diff --git net/unix/diag.c net/unix/diag.c
  14517. index 3183d9b8ab33..d6ceac688def 100644
  14518. --- linux-4.14.336/net/unix/diag.c
  14519. +++ linux-4.14.336/net/unix/diag.c
  14520. @@ -80,7 +80,7 @@ static int sk_diag_dump_icons(struct sock *sk, struct sk_buff *nlskb)
  14521.  			 * queue lock. With the other's queue locked it's
  14522.  			 * OK to lock the state.
  14523.  			 */
  14524. -			unix_state_lock_nested(req);
  14525. +			unix_state_lock_nested(req, U_LOCK_DIAG);
  14526.  			peer = unix_sk(req)->peer;
  14527.  			buf[i++] = (peer ? sock_i_ino(peer) : 0);
  14528.  			unix_state_unlock(req);
  14529. diff --git net/wireless/nl80211.c net/wireless/nl80211.c
  14530. index b4b564182db0..4f43f4dfb996 100644
  14531. --- linux-4.14.336/net/wireless/nl80211.c
  14532. +++ linux-4.14.336/net/wireless/nl80211.c
  14533. @@ -2717,6 +2717,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
  14534.  			if_idx++;
  14535.  		}
  14536.  
  14537. +		if_start = 0;
  14538.  		wp_idx++;
  14539.  	}
  14540.   out:
  14541. @@ -2896,6 +2897,8 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
  14542.  
  14543.  		if (ntype != NL80211_IFTYPE_MESH_POINT)
  14544.  			return -EINVAL;
  14545. +		if (otype != NL80211_IFTYPE_MESH_POINT)
  14546. +			return -EINVAL;
  14547.  		if (netif_running(dev))
  14548.  			return -EBUSY;
  14549.  
  14550. diff --git net/wireless/scan.c net/wireless/scan.c
  14551. index 8bbcdcf5c829..88fe0e8e8b18 100644
  14552. --- linux-4.14.336/net/wireless/scan.c
  14553. +++ linux-4.14.336/net/wireless/scan.c
  14554. @@ -1015,8 +1015,12 @@ cfg80211_bss_update(struct cfg80211_registered_device *rdev,
  14555.  				list_add(&new->hidden_list,
  14556.  					 &hidden->hidden_list);
  14557.  				hidden->refcount++;
  14558. +
  14559. +				ies = (void *)rcu_access_pointer(new->pub.beacon_ies);
  14560.  				rcu_assign_pointer(new->pub.beacon_ies,
  14561.  						   hidden->pub.beacon_ies);
  14562. +				if (ies)
  14563. +					kfree_rcu(ies, rcu_head);
  14564.  			}
  14565.  		} else {
  14566.  			/*
  14567. diff --git security/apparmor/policy_unpack.c security/apparmor/policy_unpack.c
  14568. index 2cef8d4404cc..4f41aa6ff897 100644
  14569. --- linux-4.14.336/security/apparmor/policy_unpack.c
  14570. +++ linux-4.14.336/security/apparmor/policy_unpack.c
  14571. @@ -604,6 +604,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
  14572.  
  14573.  	tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
  14574.  	if (tmpns) {
  14575. +		if (!tmpname) {
  14576. +			info = "empty profile name";
  14577. +			goto fail;
  14578. +		}
  14579.  		*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
  14580.  		if (!*ns_name) {
  14581.  			info = "out of memory";
  14582. diff --git security/security.c security/security.c
  14583. index b5e3d7a91b33..90c2094380e2 100644
  14584. --- linux-4.14.336/security/security.c
  14585. +++ linux-4.14.336/security/security.c
  14586. @@ -884,6 +884,23 @@ int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
  14587.  	return call_int_hook(file_ioctl, 0, file, cmd, arg);
  14588.  }
  14589.  
  14590. +/**
  14591. + * security_file_ioctl_compat() - Check if an ioctl is allowed in compat mode
  14592. + * @file: associated file
  14593. + * @cmd: ioctl cmd
  14594. + * @arg: ioctl arguments
  14595. + *
  14596. + * Compat version of security_file_ioctl() that correctly handles 32-bit
  14597. + * processes running on 64-bit kernels.
  14598. + *
  14599. + * Return: Returns 0 if permission is granted.
  14600. + */
  14601. +int security_file_ioctl_compat(struct file *file, unsigned int cmd,
  14602. +			       unsigned long arg)
  14603. +{
  14604. +	return call_int_hook(file_ioctl_compat, 0, file, cmd, arg);
  14605. +}
  14606. +
  14607.  static inline unsigned long mmap_prot(struct file *file, unsigned long prot)
  14608.  {
  14609.  	/*
  14610. diff --git security/selinux/hooks.c security/selinux/hooks.c
  14611. index 38a4db1f3aaa..a1613e22a734 100644
  14612. --- linux-4.14.336/security/selinux/hooks.c
  14613. +++ linux-4.14.336/security/selinux/hooks.c
  14614. @@ -3571,6 +3571,33 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
  14615.  	return error;
  14616.  }
  14617.  
  14618. +static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
  14619. +			      unsigned long arg)
  14620. +{
  14621. +	/*
  14622. +	 * If we are in a 64-bit kernel running 32-bit userspace, we need to
  14623. +	 * make sure we don't compare 32-bit flags to 64-bit flags.
  14624. +	 */
  14625. +	switch (cmd) {
  14626. +	case FS_IOC32_GETFLAGS:
  14627. +		cmd = FS_IOC_GETFLAGS;
  14628. +		break;
  14629. +	case FS_IOC32_SETFLAGS:
  14630. +		cmd = FS_IOC_SETFLAGS;
  14631. +		break;
  14632. +	case FS_IOC32_GETVERSION:
  14633. +		cmd = FS_IOC_GETVERSION;
  14634. +		break;
  14635. +	case FS_IOC32_SETVERSION:
  14636. +		cmd = FS_IOC_SETVERSION;
  14637. +		break;
  14638. +	default:
  14639. +		break;
  14640. +	}
  14641. +
  14642. +	return selinux_file_ioctl(file, cmd, arg);
  14643. +}
  14644. +
  14645.  static int default_noexec;
  14646.  
  14647.  static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
  14648. @@ -6377,6 +6404,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
  14649.  	LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
  14650.  	LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
  14651.  	LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
  14652. +	LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
  14653.  	LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
  14654.  	LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
  14655.  	LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
  14656. diff --git security/smack/smack_lsm.c security/smack/smack_lsm.c
  14657. index fe070669dc18..a6e81ef73b42 100644
  14658. --- linux-4.14.336/security/smack/smack_lsm.c
  14659. +++ linux-4.14.336/security/smack/smack_lsm.c
  14660. @@ -4651,6 +4651,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
  14661.  	LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
  14662.  	LSM_HOOK_INIT(file_free_security, smack_file_free_security),
  14663.  	LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
  14664. +	LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl),
  14665.  	LSM_HOOK_INIT(file_lock, smack_file_lock),
  14666.  	LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
  14667.  	LSM_HOOK_INIT(mmap_file, smack_mmap_file),
  14668. diff --git security/tomoyo/tomoyo.c security/tomoyo/tomoyo.c
  14669. index 213b8c593668..195f9b706926 100644
  14670. --- linux-4.14.336/security/tomoyo/tomoyo.c
  14671. +++ linux-4.14.336/security/tomoyo/tomoyo.c
  14672. @@ -516,6 +516,7 @@ static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = {
  14673.  	LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
  14674.  	LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
  14675.  	LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
  14676. +	LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl),
  14677.  	LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
  14678.  	LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
  14679.  	LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
  14680. diff --git sound/core/Makefile sound/core/Makefile
  14681. index ee4a4a6b99ba..753bf1a0dbf3 100644
  14682. --- linux-4.14.336/sound/core/Makefile
  14683. +++ linux-4.14.336/sound/core/Makefile
  14684. @@ -30,7 +30,6 @@ snd-pcm-dmaengine-objs := pcm_dmaengine.o
  14685.  snd-rawmidi-objs  := rawmidi.o
  14686.  snd-timer-objs    := timer.o
  14687.  snd-hrtimer-objs  := hrtimer.o
  14688. -snd-rtctimer-objs := rtctimer.o
  14689.  snd-hwdep-objs    := hwdep.o
  14690.  snd-seq-device-objs := seq_device.o
  14691.  
  14692. diff --git sound/pci/hda/hda_intel.c sound/pci/hda/hda_intel.c
  14693. index 978719fc4cd3..bb76b9c26da8 100644
  14694. --- linux-4.14.336/sound/pci/hda/hda_intel.c
  14695. +++ linux-4.14.336/sound/pci/hda/hda_intel.c
  14696. @@ -2545,6 +2545,12 @@ static const struct pci_device_id azx_ids[] = {
  14697.  	/* Cannonlake */
  14698.  	{ PCI_DEVICE(0x8086, 0x9dc8),
  14699.  	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
  14700. +	/* Icelake */
  14701. +	{ PCI_DEVICE(0x8086, 0x34c8),
  14702. +	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
  14703. +	/* Arrow Lake */
  14704. +	{ PCI_DEVICE(0x8086, 0x7728),
  14705. +	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE},
  14706.  	/* Broxton-P(Apollolake) */
  14707.  	{ PCI_DEVICE(0x8086, 0x5a98),
  14708.  	  .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON },
  14709. diff --git sound/pci/hda/patch_conexant.c sound/pci/hda/patch_conexant.c
  14710. index 9263cb56df7d..6215d85428c7 100644
  14711. --- linux-4.14.336/sound/pci/hda/patch_conexant.c
  14712. +++ linux-4.14.336/sound/pci/hda/patch_conexant.c
  14713. @@ -263,6 +263,7 @@ enum {
  14714.  	CXT_FIXUP_MUTE_LED_GPIO,
  14715.  	CXT_FIXUP_HEADSET_MIC,
  14716.  	CXT_FIXUP_HP_MIC_NO_PRESENCE,
  14717. +	CXT_PINCFG_SWS_JS201D,
  14718.  };
  14719.  
  14720.  /* for hda_fixup_thinkpad_acpi() */
  14721. @@ -754,6 +755,17 @@ static const struct hda_pintbl cxt_pincfg_lemote[] = {
  14722.  	{}
  14723.  };
  14724.  
  14725. +/* SuoWoSi/South-holding JS201D with sn6140 */
  14726. +static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
  14727. +	{ 0x16, 0x03211040 }, /* hp out */
  14728. +	{ 0x17, 0x91170110 }, /* SPK/Class_D */
  14729. +	{ 0x18, 0x95a70130 }, /* Internal mic */
  14730. +	{ 0x19, 0x03a11020 }, /* Headset Mic */
  14731. +	{ 0x1a, 0x40f001f0 }, /* Not used */
  14732. +	{ 0x21, 0x40f001f0 }, /* Not used */
  14733. +	{}
  14734. +};
  14735. +
  14736.  static const struct hda_fixup cxt_fixups[] = {
  14737.  	[CXT_PINCFG_LENOVO_X200] = {
  14738.  		.type = HDA_FIXUP_PINS,
  14739. @@ -905,6 +917,10 @@ static const struct hda_fixup cxt_fixups[] = {
  14740.  		.chained = true,
  14741.  		.chain_id = CXT_FIXUP_HEADSET_MIC,
  14742.  	},
  14743. +	[CXT_PINCFG_SWS_JS201D] = {
  14744. +		.type = HDA_FIXUP_PINS,
  14745. +		.v.pins = cxt_pincfg_sws_js201d,
  14746. +	},
  14747.  };
  14748.  
  14749.  static const struct snd_pci_quirk cxt5045_fixups[] = {
  14750. @@ -973,6 +989,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
  14751.  	SND_PCI_QUIRK(0x103c, 0x8402, "HP ProBook 645 G4", CXT_FIXUP_MUTE_LED_GPIO),
  14752.  	SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE),
  14753.  	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
  14754. +	SND_PCI_QUIRK(0x14f1, 0x0265, "SWS JS201D", CXT_PINCFG_SWS_JS201D),
  14755.  	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
  14756.  	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
  14757.  	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
  14758. @@ -1011,6 +1028,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = {
  14759.  	{ .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" },
  14760.  	{ .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" },
  14761.  	{ .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" },
  14762. +	{ .id = CXT_PINCFG_SWS_JS201D, .name = "sws-js201d" },
  14763.  	{}
  14764.  };
  14765.  
  14766. diff --git sound/pci/oxygen/oxygen_mixer.c sound/pci/oxygen/oxygen_mixer.c
  14767. index 4ca12665ff73..64a82688d7fb 100644
  14768. --- linux-4.14.336/sound/pci/oxygen/oxygen_mixer.c
  14769. +++ linux-4.14.336/sound/pci/oxygen/oxygen_mixer.c
  14770. @@ -730,7 +730,7 @@ static int ac97_fp_rec_volume_put(struct snd_kcontrol *ctl,
  14771.  	oldreg = oxygen_read_ac97(chip, 1, AC97_REC_GAIN);
  14772.  	newreg = oldreg & ~0x0707;
  14773.  	newreg = newreg | (value->value.integer.value[0] & 7);
  14774. -	newreg = newreg | ((value->value.integer.value[0] & 7) << 8);
  14775. +	newreg = newreg | ((value->value.integer.value[1] & 7) << 8);
  14776.  	change = newreg != oldreg;
  14777.  	if (change)
  14778.  		oxygen_write_ac97(chip, 1, AC97_REC_GAIN, newreg);
  14779. diff --git sound/soc/codecs/cs35l33.c sound/soc/codecs/cs35l33.c
  14780. index e2c1194ea61a..32048c4c7e71 100644
  14781. --- linux-4.14.336/sound/soc/codecs/cs35l33.c
  14782. +++ linux-4.14.336/sound/soc/codecs/cs35l33.c
  14783. @@ -26,13 +26,11 @@
  14784.  #include <sound/soc-dapm.h>
  14785.  #include <sound/initval.h>
  14786.  #include <sound/tlv.h>
  14787. -#include <linux/gpio.h>
  14788.  #include <linux/gpio/consumer.h>
  14789.  #include <sound/cs35l33.h>
  14790.  #include <linux/pm_runtime.h>
  14791.  #include <linux/regulator/consumer.h>
  14792.  #include <linux/regulator/machine.h>
  14793. -#include <linux/of_gpio.h>
  14794.  #include <linux/of.h>
  14795.  #include <linux/of_device.h>
  14796.  #include <linux/of_irq.h>
  14797. @@ -1173,7 +1171,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,
  14798.  
  14799.  	/* We could issue !RST or skip it based on AMP topology */
  14800.  	cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
  14801. -			"reset-gpios", GPIOD_OUT_HIGH);
  14802. +			"reset", GPIOD_OUT_HIGH);
  14803.  	if (IS_ERR(cs35l33->reset_gpio)) {
  14804.  		dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n",
  14805.  			__func__);
  14806. diff --git sound/soc/codecs/cs35l34.c sound/soc/codecs/cs35l34.c
  14807. index 1e05026bedca..8a0ca34d828e 100644
  14808. --- linux-4.14.336/sound/soc/codecs/cs35l34.c
  14809. +++ linux-4.14.336/sound/soc/codecs/cs35l34.c
  14810. @@ -24,14 +24,12 @@
  14811.  #include <linux/regulator/machine.h>
  14812.  #include <linux/pm_runtime.h>
  14813.  #include <linux/of_device.h>
  14814. -#include <linux/of_gpio.h>
  14815.  #include <linux/of_irq.h>
  14816.  #include <sound/core.h>
  14817.  #include <sound/pcm.h>
  14818.  #include <sound/pcm_params.h>
  14819.  #include <sound/soc.h>
  14820.  #include <sound/soc-dapm.h>
  14821. -#include <linux/gpio.h>
  14822.  #include <linux/gpio/consumer.h>
  14823.  #include <sound/initval.h>
  14824.  #include <sound/tlv.h>
  14825. @@ -1068,7 +1066,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client,
  14826.  		dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
  14827.  
  14828.  	cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
  14829. -				"reset-gpios", GPIOD_OUT_LOW);
  14830. +				"reset", GPIOD_OUT_LOW);
  14831.  	if (IS_ERR(cs35l34->reset_gpio))
  14832.  		return PTR_ERR(cs35l34->reset_gpio);
  14833.  
  14834. diff --git sound/soc/codecs/cs43130.c sound/soc/codecs/cs43130.c
  14835. index 643e37fc218e..ad5d527e6e52 100644
  14836. --- linux-4.14.336/sound/soc/codecs/cs43130.c
  14837. +++ linux-4.14.336/sound/soc/codecs/cs43130.c
  14838. @@ -581,7 +581,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,
  14839.  		break;
  14840.  	case SND_SOC_DAIFMT_LEFT_J:
  14841.  		hi_size = bitwidth_sclk;
  14842. -		frm_delay = 2;
  14843. +		frm_delay = 0;
  14844.  		frm_phase = 1;
  14845.  		break;
  14846.  	case SND_SOC_DAIFMT_DSP_A:
  14847. @@ -1675,7 +1675,7 @@ static ssize_t cs43130_show_dc_r(struct device *dev,
  14848.  	return cs43130_show_dc(dev, buf, HP_RIGHT);
  14849.  }
  14850.  
  14851. -static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = {
  14852. +static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = {
  14853.  	24,
  14854.  	43,
  14855.  	93,
  14856. @@ -2351,7 +2351,7 @@ static const struct regmap_config cs43130_regmap = {
  14857.  	.use_single_rw		= true, /* needed for regcache_sync */
  14858.  };
  14859.  
  14860. -static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
  14861. +static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
  14862.  	50,
  14863.  	120,
  14864.  };
  14865. diff --git sound/soc/codecs/da7219-aad.c sound/soc/codecs/da7219-aad.c
  14866. index 793c8768f7c4..5a31a4db1e23 100644
  14867. --- linux-4.14.336/sound/soc/codecs/da7219-aad.c
  14868. +++ linux-4.14.336/sound/soc/codecs/da7219-aad.c
  14869. @@ -650,7 +650,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct snd_soc_codec *cod
  14870.  		aad_pdata->mic_det_thr =
  14871.  			da7219_aad_fw_mic_det_thr(codec, fw_val32);
  14872.  	else
  14873. -		aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS;
  14874. +		aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS;
  14875.  
  14876.  	if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0)
  14877.  		aad_pdata->jack_ins_deb =
  14878. diff --git sound/soc/codecs/rt5645.c sound/soc/codecs/rt5645.c
  14879. index 822c42101c3f..536a33820265 100644
  14880. --- linux-4.14.336/sound/soc/codecs/rt5645.c
  14881. +++ linux-4.14.336/sound/soc/codecs/rt5645.c
  14882. @@ -417,6 +417,7 @@ struct rt5645_priv {
  14883.  	struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)];
  14884.  	struct rt5645_eq_param_s *eq_param;
  14885.  	struct timer_list btn_check_timer;
  14886. +	struct mutex jd_mutex;
  14887.  
  14888.  	int codec_type;
  14889.  	int sysclk;
  14890. @@ -3158,6 +3159,8 @@ static int rt5645_jack_detect(struct snd_soc_codec *codec, int jack_insert)
  14891.  				rt5645_enable_push_button_irq(codec, true);
  14892.  			}
  14893.  		} else {
  14894. +			if (rt5645->en_button_func)
  14895. +				rt5645_enable_push_button_irq(codec, false);
  14896.  			snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
  14897.  			snd_soc_dapm_sync(dapm);
  14898.  			rt5645->jack_type = SND_JACK_HEADPHONE;
  14899. @@ -3238,6 +3241,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
  14900.  	if (!rt5645->codec)
  14901.  		return;
  14902.  
  14903. +	mutex_lock(&rt5645->jd_mutex);
  14904. +
  14905.  	switch (rt5645->pdata.jd_mode) {
  14906.  	case 0: /* Not using rt5645 JD */
  14907.  		if (rt5645->gpiod_hp_det) {
  14908. @@ -3250,6 +3255,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)
  14909.  				    report, SND_JACK_HEADPHONE);
  14910.  		snd_soc_jack_report(rt5645->mic_jack,
  14911.  				    report, SND_JACK_MICROPHONE);
  14912. +		mutex_unlock(&rt5645->jd_mutex);
  14913.  		return;
  14914.  	default: /* read rt5645 jd1_1 status */
  14915.  		val = snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x1000;
  14916. @@ -3259,7 +3265,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)
  14917.  
  14918.  	if (!val && (rt5645->jack_type == 0)) { /* jack in */
  14919.  		report = rt5645_jack_detect(rt5645->codec, 1);
  14920. -	} else if (!val && rt5645->jack_type != 0) {
  14921. +	} else if (!val && rt5645->jack_type == SND_JACK_HEADSET) {
  14922.  		/* for push button and jack out */
  14923.  		btn_type = 0;
  14924.  		if (snd_soc_read(rt5645->codec, RT5645_INT_IRQ_ST) & 0x4) {
  14925. @@ -3315,6 +3321,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
  14926.  		rt5645_jack_detect(rt5645->codec, 0);
  14927.  	}
  14928.  
  14929. +	mutex_unlock(&rt5645->jd_mutex);
  14930. +
  14931.  	snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE);
  14932.  	snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE);
  14933.  	if (rt5645->en_button_func)
  14934. @@ -3939,6 +3947,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
  14935.  	setup_timer(&rt5645->btn_check_timer,
  14936.  		rt5645_btn_check_callback, (unsigned long)rt5645);
  14937.  
  14938. +	mutex_init(&rt5645->jd_mutex);
  14939.  	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
  14940.  	INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work);
  14941.  
  14942. diff --git tools/lib/subcmd/help.c tools/lib/subcmd/help.c
  14943. index 2859f107abc8..4260c8b4257b 100644
  14944. --- linux-4.14.336/tools/lib/subcmd/help.c
  14945. +++ linux-4.14.336/tools/lib/subcmd/help.c
  14946. @@ -50,11 +50,21 @@ void uniq(struct cmdnames *cmds)
  14947.  	if (!cmds->cnt)
  14948.  		return;
  14949.  
  14950. -	for (i = j = 1; i < cmds->cnt; i++)
  14951. -		if (strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
  14952. -			cmds->names[j++] = cmds->names[i];
  14953. -
  14954. +	for (i = 1; i < cmds->cnt; i++) {
  14955. +		if (!strcmp(cmds->names[i]->name, cmds->names[i-1]->name))
  14956. +			zfree(&cmds->names[i - 1]);
  14957. +	}
  14958. +	for (i = 0, j = 0; i < cmds->cnt; i++) {
  14959. +		if (cmds->names[i]) {
  14960. +			if (i == j)
  14961. +				j++;
  14962. +			else
  14963. +				cmds->names[j++] = cmds->names[i];
  14964. +		}
  14965. +	}
  14966.  	cmds->cnt = j;
  14967. +	while (j < i)
  14968. +		cmds->names[j++] = NULL;
  14969.  }
  14970.  
  14971.  void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
  14972. diff --git tools/testing/selftests/powerpc/math/fpu_preempt.c tools/testing/selftests/powerpc/math/fpu_preempt.c
  14973. index 0f85b79d883d..c91f3b36e884 100644
  14974. --- linux-4.14.336/tools/testing/selftests/powerpc/math/fpu_preempt.c
  14975. +++ linux-4.14.336/tools/testing/selftests/powerpc/math/fpu_preempt.c
  14976. @@ -41,19 +41,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
  14977.  int threads_starting;
  14978.  int running;
  14979.  
  14980. -extern void preempt_fpu(double *darray, int *threads_starting, int *running);
  14981. +extern int preempt_fpu(double *darray, int *threads_starting, int *running);
  14982.  
  14983.  void *preempt_fpu_c(void *p)
  14984.  {
  14985. +	long rc;
  14986.  	int i;
  14987. +
  14988.  	srand(pthread_self());
  14989.  	for (i = 0; i < 21; i++)
  14990.  		darray[i] = rand();
  14991.  
  14992. -	/* Test failed if it ever returns */
  14993. -	preempt_fpu(darray, &threads_starting, &running);
  14994. +	rc = preempt_fpu(darray, &threads_starting, &running);
  14995.  
  14996. -	return p;
  14997. +	return (void *)rc;
  14998.  }
  14999.  
  15000.  int test_preempt_fpu(void)
  15001. diff --git tools/testing/selftests/powerpc/math/vmx_preempt.c tools/testing/selftests/powerpc/math/vmx_preempt.c
  15002. index 9ef376c55b13..7ba95ceaaa50 100644
  15003. --- linux-4.14.336/tools/testing/selftests/powerpc/math/vmx_preempt.c
  15004. +++ linux-4.14.336/tools/testing/selftests/powerpc/math/vmx_preempt.c
  15005. @@ -41,19 +41,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},
  15006.  int threads_starting;
  15007.  int running;
  15008.  
  15009. -extern void preempt_vmx(vector int *varray, int *threads_starting, int *running);
  15010. +extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);
  15011.  
  15012.  void *preempt_vmx_c(void *p)
  15013.  {
  15014.  	int i, j;
  15015. +	long rc;
  15016. +
  15017.  	srand(pthread_self());
  15018.  	for (i = 0; i < 12; i++)
  15019.  		for (j = 0; j < 4; j++)
  15020.  			varray[i][j] = rand();
  15021.  
  15022. -	/* Test fails if it ever returns */
  15023. -	preempt_vmx(varray, &threads_starting, &running);
  15024. -	return p;
  15025. +	rc = preempt_vmx(varray, &threads_starting, &running);
  15026. +
  15027. +	return (void *)rc;
  15028.  }
  15029.  
  15030.  int test_preempt_vmx(void)
  15031. diff --git virt/kvm/arm/vgic/vgic-its.c virt/kvm/arm/vgic/vgic-its.c
  15032. index fd25c2161060..a4398f58a830 100644
  15033. --- linux-4.14.336/virt/kvm/arm/vgic/vgic-its.c
  15034. +++ linux-4.14.336/virt/kvm/arm/vgic/vgic-its.c
  15035. @@ -424,6 +424,9 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
  15036.  		}
  15037.  
  15038.  		irq = vgic_get_irq(vcpu->kvm, NULL, intids[i]);
  15039. +		if (!irq)
  15040. +			continue;
  15041. +
  15042.  		spin_lock(&irq->irq_lock);
  15043.  		irq->pending_latch = pendmask & (1U << bit_nr);
  15044.  		vgic_queue_irq_unlock(vcpu->kvm, irq);